Processing method, logic control unit and electronic equipment

Abstract

The invention discloses a processing method, a logic control unit and electronic equipment. The method comprises the following steps: detecting state information of a security chip; the state information at least represents whether the security chip is in an in-place state; the security chip is used for performing access protection on the target memory; when the state information represents that the security chip is in an in-place state, a first access path is used as a target access path, and the first access path comprises the security chip; when the state information represents that the security chip is in a non-in-place state, a second access path is used as a target access path, and the second access path does not contain the security chip; the target access path is used for transmitting a signal of a main control unit in the system main control board to the target memory, data source information of the first access path and the second access path is the same, and output final destinations are the same.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a processing method, a logic control unit, and an electronic device. Background Technology

[0002] Currently, PFR (Platform Firmware Resilience) technology primarily protects Flash memory in electronic devices by designing dedicated PFR chips on the SPI (Serial Peripheral Interface) link. However, not all customers require PFR functionality; therefore, separate circuit boards are often manufactured for devices with and without PFR capabilities, reducing the adaptability and flexibility of electronic devices. Summary of the Invention

[0003] The technical solution provided in this application is as follows:

[0004] The first aspect of this application provides a processing method, including:

[0005] The status information of the security chip is detected; the status information at least indicates whether the security chip is in an in-situ state; the security chip is used to protect the target memory from access.

[0006] When the status information indicates that the security chip is in an in-place state, the first access path is used as the target access path, and the first access path includes the security chip.

[0007] When the status information indicates that the security chip is in an off-site state, the second access path is used as the target access path, and the second access path does not contain the security chip;

[0008] The target access path is used to transmit signals from the main control unit in the system main control board to the target memory. The data source information of the first access path and the second access path are the same, and the final destination of the output is the same.

[0009] In one possible implementation, when the status information indicates that the security chip is in an in-situ state, using a first access path as the target access path includes:

[0010] When the status information indicates that the security chip is in an in-situ state, the signal of the main control unit is split into a first signal and a second signal; the first signal is transmitted through a first access path; the second signal is transmitted through a second access path.

[0011] The first signal is selected from the first signal and the second signal and output, and transmitted to the target memory;

[0012] When the status information indicates that the security chip is in an in-place state, the second access path is used as the target access path, including:

[0013] When the status information indicates that the security chip is in an off-site state, the signal of the main control unit is split into the first signal and the second signal;

[0014] The second signal is selected from the first signal and the second signal as the output and transmitted to the target memory.

[0015] In one possible implementation, if the main control unit comprises multiple units; when the status information indicates that the security chip is in an in-situ state, using the first access path as the target access path includes:

[0016] When the status information indicates that the security chip is in an in-situ state, the first access path corresponding to each of the main control units is used as the target access path of each of the main control units.

[0017] In one possible implementation, the detection of the security chip's state information includes:

[0018] The level signals of at least two target interfaces of the security chip are detected, and the level combination formed by the level signals of the at least two target interfaces is determined as the status information of the security chip; the at least two target interfaces are pre-configured on the security chip to present a specified level combination to uniquely characterize the in-situ status of the security chip and / or its type.

[0019] In one possible implementation, the processing method further includes:

[0020] The type of the security chip is identified based on the level combination;

[0021] The type of the security chip is sent to the main control unit so that the main control unit loads the target driver based on the type of the security chip. The target driver is used to realize communication between the main control unit and the security chip.

[0022] In another aspect, this application provides a logic control unit, comprising:

[0023] A status detection circuit is used to detect the status information of the security chip; the status information at least indicates whether the security chip is in an in-situ state; the security chip is used to protect the target memory from access.

[0024] Control logic circuits are used for:

[0025] When the status information indicates that the security chip is in an in-place state, the first access path is used as the target access path, and the first access path includes the security chip.

[0026] When the status information indicates that the security chip is in an off-site state, the second access path is used as the target access path, and the second access path does not contain the security chip;

[0027] The target access path is used to transmit signals from the main control unit in the system main control board to the target memory. The data source information of the first access path and the second access path are the same, and the final destination of the output is the same.

[0028] In a third aspect of this application, an electronic device is provided, comprising:

[0029] At least one main control unit;

[0030] At least one target memory;

[0031] A signal selection logic unit group corresponding to the target memory; the signal selection logic unit group includes a first signal selection logic unit and a second signal selection logic unit; the first signal output interface of the first signal selection logic unit is connected to the first signal input interface of the second signal selection logic unit through a security chip; the second signal output interface of the first signal selection logic unit is connected to the second signal input interface of the second signal selection logic unit.

[0032] The security chip is used to protect the target memory from access.

[0033] A logic control unit is used to detect the status information of the security chip. When the status information indicates that the security chip is in an in-position state, it outputs a first control signal to the first signal selection logic unit and the second signal selection logic unit; when the status information indicates that the security chip is not in an in-position state, it outputs a second control signal to the first signal selection logic unit and the second signal selection logic unit.

[0034] The first signal selection logic unit is used to split the signal of the main control unit into a first signal and a second signal based on the first control signal or the second control signal;

[0035] The second signal selection logic unit is used to select the first signal from the first signal and the second signal as an output based on the first control signal and transmit it to the target memory; or, based on the second control signal, select the second signal from the first signal and the second signal as an output and transmit it to the target memory.

[0036] In one possible implementation, if the target memory supports access by multiple master control units, the signal selection logic unit group further includes: a third signal selection logic unit;

[0037] The third signal selection logic unit is used to select one signal from the signals output by each of the main control units and send it to the first signal selection logic unit.

[0038] In one possible implementation, the logic control unit is connected to at least two target interfaces of the security chip to detect the level signals of the at least two target interfaces of the security chip, and determines the level combination formed by the level signals of the at least two target interfaces as the status information of the security chip; the at least two target interfaces are pre-configured on the security chip to present a specified level combination to uniquely characterize the in-situ status of the security chip and / or its type.

[0039] In one possible implementation, the electronic device further includes:

[0040] The system main control board includes: at least one main control unit, at least one target memory, and a signal selection logic component group corresponding to the target memory;

[0041] The security chip is detachably connected to the system main control board. Attached Figure Description

[0042] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0043] Figure 1 A flowchart illustrating a processing method provided in Embodiment 1 of this application;

[0044] Figure 2 This is a flowchart illustrating a processing method provided in Embodiment 2 of this application;

[0045] Figure 3 A schematic diagram of the structure of an electronic device provided in this application;

[0046] Figure 4 Another structural schematic diagram of an electronic device provided in this application;

[0047] Figure 5 This is a flowchart illustrating a processing method provided in Embodiment 4 of this application;

[0048] Figure 6 A schematic diagram of another structure of an electronic device provided in this application;

[0049] Figure 7 A schematic diagram of another structure of an electronic device provided in this application;

[0050] Figure 8 A connection diagram of a security chip provided in this application;

[0051] Figure 9 This is a schematic diagram of a connector definition provided in this application. Detailed Implementation

[0052] The embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the implementation section of this application is for explaining specific embodiments only and is not intended to limit the scope of this application.

[0053] The embodiments of this application will now be described with reference to the accompanying drawings. Those skilled in the art will recognize that, with technological advancements and the emergence of new scenarios, the technical solutions provided in the embodiments of this application are equally applicable to similar technical problems.

[0054] The terms "first," "second," etc., used in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of units is not necessarily limited to those units, but may include other units not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0055] Reference Figure 1 This is a flowchart illustrating a processing method provided in Embodiment 1 of this application, as shown below. Figure 1 As shown, the method may include, but is not limited to, the following steps:

[0056] Step S101: Detect the status information of the security chip; the status information at least indicates whether the security chip is in an in-situ state; the security chip is used to protect the target memory from access.

[0057] In this embodiment, the security chip may, but is not limited to, perform integrity and legality verification on the firmware of the BIOS and BMC based on the PFR algorithm or other security algorithms; or, detect malicious tampering, illegal injection, and other behaviors, and trigger a recovery mechanism when an anomaly is detected.

[0058] Specific protection scenarios may include, but are not limited to, the following:

[0059] System startup pre-boot verification protection: Before the main control unit accesses the target memory to read the BIOS and BMC firmware, the security chip first performs integrity verification (such as hash algorithm-based verification) on the firmware data stored in the target memory. Only after confirming that the firmware has not been tampered with will the main control unit be allowed to read the firmware and execute the boot process. If the verification fails, the security chip will block the main control unit from accessing the target memory and trigger a recovery mechanism to prevent abnormal firmware from being loaded.

[0060] Firmware whitelist access control: The security chip has a built-in firmware whitelist database that stores authorized firmware version information (such as firmware hash value and version number). When the main control unit writes firmware to the target memory or calls firmware, the security chip verifies the authorization status of the firmware and only allows authorized firmware in the whitelist to be written to or executed in the target memory, effectively preventing malicious code from being injected into the target memory.

[0061] Abnormal Firmware Recovery Protection: The security chip monitors the firmware read and write operations of the target memory in real time. When it detects that the firmware is damaged due to malicious modification, hardware failure or other reasons, it will immediately suspend the main control unit's access to the target memory. At the same time, it will call the firmware image pre-stored inside the security chip or in the dedicated backup area of ​​the target memory to overwrite and restore the damaged firmware. After the restoration is completed, the main control unit will be allowed to continue to access the target memory, ensuring that the target memory always stores legitimate and complete firmware data.

[0062] In this embodiment, at the hardware level, the electronic device can reserve an assembly interface for the security chip, power lines, and physical signal links. The physical signal links provide the basic physical channel for data transmission under different access paths.

[0063] In practical applications, two different assembly scenarios may exist. When electronic devices require safety protection functions, i.e., when a safety chip needs to be installed, production personnel can precisely install the safety chip onto the reserved assembly interface. In this case, the power supply pins of the safety chip will establish a tight electrical connection with the controllable switching element and the voltage comparator circuit through a pre-designed preset circuit. The controllable switching element can flexibly control the on / off state of the power supply, while the voltage comparator circuit can monitor the voltage status of the safety chip's power supply pins in real time, providing crucial information for subsequent system determination of whether the safety chip is in place.

[0064] Conversely, if the electronic device does not require safety protection functions, i.e., does not need to install a safety chip, the reserved assembly interface can remain empty. This means that no safety chip will be installed inside the electronic device, and the corresponding power supply pins will not have voltage input.

[0065] In this application, there are no restrictions on the method of detecting the status information of the security chip; hardware circuit detection, software detection, or a combination of both can be used.

[0066] For example, methods for hardware circuit testing can include, but are not limited to:

[0067] When the security chip is properly connected to the system main control board, its power supply pins will have a stable voltage supply. Logic control units (such as CPLDs (Complex Programmable Logic Devices) and Field-Programmable Gate Arrays (FPGAs) can monitor the voltage on this power supply pin by connecting to a voltage comparator circuit. The voltage comparator compares the monitored voltage with a preset threshold. If the voltage is within the normal range, it indicates that the security chip has a power supply and may be in a present state; if the voltage is below the threshold or there is no voltage, the security chip may be absent or there may be a power failure. For example, the normal operating voltage of the security chip is 3.3V, and the preset threshold can be set to 3.0V. When a voltage greater than 3.0V is detected, it is preliminarily determined that the security chip has power.

[0068] Software detection methods can include, but are not limited to:

[0069] During the system startup process of an electronic device, the BIOS or firmware can initialize and detect the hardware. The status of the security chip can be detected by writing specific code within the BIOS or firmware. For example, the BIOS can determine whether the security chip responds and whether the response is correct by sending specific commands to the security chip or reading the register values ​​of the security chip. If the security chip responds correctly to the command, it indicates that the security chip is present and working properly; if there is no response or the response is incorrect, the security chip may be absent or malfunctioning.

[0070] After detecting the status of the security chip, the BIOS or firmware can write the status information to the memory address corresponding to the register of the logic control unit. The logic control unit can then read these memory addresses to obtain the status of the security chip.

[0071] Step S102: When the status information indicates that the security chip is in an in-situ state, the first access path is used as the target access path, and the first access path includes the security chip.

[0072] The target access path can be used to transmit signals from the main control unit in the system main control board to the target memory.

[0073] The system main control board may include, but is not limited to, main control units (such as CPU, BMC), target memory, logic control units, and functional modules such as hardware lines and interfaces required for signal transmission. It can be used to connect various functional modules and ensure normal signal transmission between modules.

[0074] Signals emitted by the main control unit on the system's main control board can be transmitted to the security chip. The security chip can perform a series of security processing operations on these signals, depending on its built-in security algorithms and strategies, commonly including encryption, authentication, and integrity verification.

[0075] Taking encryption as an example, suppose the main control unit wants to write data to the target memory (e.g., Flash). The main control unit first sends the raw data to the security chip. The security chip uses a pre-stored encryption key and a specific encryption algorithm (e.g., AES algorithm) to encrypt the raw data, converting it into ciphertext data. Then, the security chip transmits the encrypted ciphertext data to the target memory for storage.

[0076] From a signal transmission perspective, a complete and fixed signal transmission path, or first access path, is established between the main control unit, the security chip, and the target memory. In this data writing scenario, the original data follows this predetermined first access path, passing sequentially through the main control unit and the security chip, and finally reaching the target memory, thus realizing a secure data writing process involving the security chip.

[0077] During data reading, when the main control unit needs to read data from the target memory, the signal also follows the first access path, first passing through the security chip. After the security chip obtains the encrypted data from the target memory, it uses the corresponding decryption key and algorithm to decrypt the encrypted data, restore the original data, and then transmits the original data to the main control unit. The entire data reading process is also completed within this predetermined first access path, ensuring the security of the data during the reading process.

[0078] Step S103: When the status information indicates that the security chip is in an in-place state, the second access path is used as the target access path, and the second access path does not contain the security chip.

[0079] From a signal transmission perspective, a complete and fixed signal transmission path, also known as the second access path, is established between the main control unit in the system's main control board and the target memory. Signals emitted by the main control unit (e.g., CPU, BMC) in the system's main control board can be transmitted directly to the target memory without passing through the security chip.

[0080] The second access path can have the same data source information (e.g., signals output by the main control unit in the system main control board) as the first access path, and the same final destination (e.g., target memory).

[0081] Taking a data writing scenario as an example, when the main control unit (such as CPU or BMC) needs to write data to the target memory (such as Flash), since the security chip is not in place, the original data and the write command will be directly transmitted to the target memory along the second access path. After receiving the original data and the write command, the target memory completes the original data storage according to the write command. The entire process does not require any security processing operations and only realizes the data writing function.

[0082] In data reading scenarios, when the main control unit needs to read data from the target memory, both the data and the read command are transmitted along the second access path: the main control unit sends a read command to the target memory, which is then directly delivered to the target memory via the second access path. The target memory retrieves the corresponding data based on the read command and then directly feeds the data back to the main control unit via the second access path. The entire reading process does not require a security chip for decryption or verification; data is transmitted directly from the target memory to the main control unit, ensuring smooth data interaction.

[0083] In this embodiment, when the presence of the security chip is detected, the security chip can intervene in the access process through the first access path to provide comprehensive protection for the target memory, ensuring the data security and stable operation of the system in the target memory, thereby fully meeting the user's security needs.

[0084] When the security chip is detected to be absent, the system can bypass the security chip and directly perform fast read and write operations on the target memory through the second access path. This can significantly improve the speed and efficiency of data read and write operations, meeting users' needs for high performance and fast response in electronic devices.

[0085] In this embodiment, by reserving an assembly interface for a security chip and employing a dual-access path logic design, both production configurations with and without a security chip can be simultaneously compatible, enhancing the product adaptability flexibility of the electronic device. For example, among the target user groups of the electronic device, some users (such as those in the financial and government sectors) have extremely high requirements for data security, requiring PFR (Proof-of-Flight) functionality to ensure that the firmware in the target memory is not tampered with or maliciously injected. In this case, the manufacturer only needs to install a security chip on the reserved interface, and the device can automatically activate the first access path, meeting security requirements through the verification, protection, and recovery mechanisms of the security chip. On the other hand, other users (such as those in ordinary office and home scenarios) prioritize the device's read / write speed and cost control, requiring no additional security protection. The manufacturer only needs not to install a security chip, and the device will automatically switch to the second access path, achieving high-speed read / write through a direct connection, meeting their performance and cost-effectiveness requirements. The same hardware architecture can simultaneously cover both security-first and performance-first core requirements without adjustment, avoiding the limitations of designing separate hardware for different users.

[0086] For manufacturers, they only need to decide whether to install a security chip based on the user's order requirements, without having to replan the circuit board layout, change the physical signal links, or make different versions of the main control board, thus achieving flexible adaptation on the production side.

[0087] Furthermore, the device features a reserved interface for security chip assembly and dual access paths, allowing users to flexibly upgrade according to changing needs. If a user initially chooses a device without a security chip, subsequent upgrades requiring security protection functions will not require replacing the entire device or main control board. This upgradable design breaks the limitation of fixed functions at the factory, allowing the functionality of electronic devices to be adjusted to meet changing user needs, further extending the product's adaptability and lifecycle, and enhancing the user's flexible experience.

[0088] As another optional embodiment of this application, refer to Figure 2 This is a flowchart illustrating a processing method provided in Embodiment 2 of this application. This embodiment is mainly an implementation of steps S102 and S103 in Embodiment 1, such as... Figure 2 As shown, step S102 may include, but is not limited to:

[0089] Step S1021: When the status information indicates that the security chip is in an in-situ state, the signal of the main control unit is split into a first signal and a second signal; the first signal is transmitted through a first access path; the second signal is transmitted through a second access path.

[0090] In this embodiment, refer to Figure 3The signal output interface of the main control unit (which can be represented as O-CU) can establish a physical connection with the signal input interface of the first signal selection logic unit (which can be represented as I-MUX1) through hardware lines. This connection is in a continuous state and is used to transmit signals (including firmware read / write instructions, data, etc.) issued by the main control unit.

[0091] The first signal selection logic unit (which can be represented as MUX1) has two independent signal output interfaces, corresponding to the transmission of two signals from the same source:

[0092] The first signal output interface (which can be represented as O1-MUX1) is directly connected to the signal input interface (which can be represented as I-SEC) of the security chip through hardware circuitry, forming the core transmission link of the first access path;

[0093] The second signal output interface (which can be represented as O2-MUX1) is directly connected to the second signal input interface (which can be represented as I2-MUX2) of the second signal selection logic unit (which can be represented as MUX2) through an independent hardware line, forming the core transmission link of the second access path;

[0094] The signal output interface of the security chip (which can be represented as O-SEC) establishes a physical connection with the first signal input interface of the second signal selection logic unit (which can be represented as I1-MUX2) through hardware circuitry.

[0095] The output interface of the second signal selection logic section (which can be represented as O-MUX2) can establish a physical connection with the target memory.

[0096] The control signal output interface of the logic control unit (which can be represented as O-CTRL) is connected to the control terminal of the first signal selection logic unit (which can be represented as C-MUX1) and the control terminal of the second signal selection logic unit (which can be represented as C-MUX2) through two parallel hardware lines, respectively, to synchronously send control signals and ensure that the timing of the two logic units is consistent.

[0097] In this embodiment, the logic control unit can be connected to the power supply pin (which can be represented as VCC-SEC) of the security module. The logic control unit can detect (e.g., if the voltage of the security chip's power supply pin (which can be represented as VCC-SEC) is >3.0V) through hardware circuitry, and after confirming that the security chip is in place, it simultaneously outputs a first control signal to the first signal selection logic unit and the second signal selection logic unit.

[0098] The security module may include hardware such as power supply filter resistors / capacitors, signal matching components, and reset circuits, which can provide a stable working environment for the security chip.

[0099] After receiving the first control signal, the first signal selection logic unit synchronously splits the signal output by the main control unit (including firmware read / write instructions, data, etc.) into two completely identical signals, namely the first signal and the second signal.

[0100] The first signal is transmitted to the security chip, which performs security processing such as encryption, integrity verification, and whitelist verification before transmitting it to the second signal selection logic unit. That is, the physical link of the first access path is the main control unit → the first signal selection logic unit → the security chip → the second signal selection logic unit.

[0101] The second signal, obtained after being split by the first signal selection logic unit, can be directly transmitted to the second signal selection logic unit without passing through the security chip. That is, the physical link of the second access path is: main control unit → first signal selection logic unit → second signal selection logic unit.

[0102] Step S1022: Select the first signal from the first signal and the second signal as the output and transmit it to the target memory.

[0103] In this embodiment, after receiving the first control signal, the second signal selection logic unit keeps its timing synchronized with the first signal selection logic unit and starts the selection mechanism: through an internal logic switch, it switches the output path to the first signal input interface (I1-MUX2) (this input interface is continuously connected in hardware to the output interface of the security chip), and receives and conducts the first signal processed by the security chip.

[0104] After security processing, the first signal can be transmitted to the target memory through the output interface (O-MUX2) of the second signal selection logic unit, thus completing the secure output of the signal.

[0105] Step S103 may include, but is not limited to:

[0106] Step S1031: When the status information indicates that the security chip is in an off-site state, the signal of the main control unit is split into the first signal and the second signal.

[0107] After receiving the second control signal, the first signal selection logic unit can synchronously split the signal output by the main control unit (including firmware read / write instructions, data, etc.) into the first signal and the second signal based on the signal splitting method that is completely consistent with step S1021.

[0108] The process of transmitting the first and second signals to the second signal selection logic unit can be found in the relevant description in step S1021, and will not be repeated here.

[0109] Step S1032: Select the second signal from the first signal and the second signal as the output and transmit it to the target memory.

[0110] In this embodiment, after receiving the second control signal, the second signal selection logic unit keeps its timing synchronized with the first signal selection logic unit and starts the selection mechanism: through an internal logic switch, it switches the output path to the second signal input interface (I2-MUX2) (this input interface is continuously connected to the output interface of the security chip in hardware), conducts the second signal that has not passed through the security chip, and at the same time blocks the signal transmission of the first signal input interface (I1-MUX2).

[0111] The second signal, which does not pass through the security chip, can be directly transmitted to the target memory through the output interface (O-MUX2) of the two-signal selection logic unit to complete the high-speed output of the signal.

[0112] In this embodiment, the main control unit signal is synchronously split into two co-source signals by the first signal selection logic component to ensure the signal consistency of the two access paths. In conjunction with the second signal selection logic component, the precise selection based on the control signal avoids signal conflicts and timing delays during path switching. This ensures the integrity and security of firmware reading and writing when the security chip is in place (selecting the first signal) and ensures high-speed and smooth data transmission when the security chip is not in place (selecting the second signal).

[0113] Meanwhile, the unified signal splitting and selection logic makes the solution compatible with different types of security chips without adjusting the hardware layout or firmware core logic, which improves the flexibility and compatibility of product adaptation. It reduces production complexity and hardware costs while taking into account both high security and high performance requirements, further extending the application scenarios and life cycle of electronic devices.

[0114] As another optional embodiment of this application, providing a processing method for Embodiment 3 of this application, this embodiment is mainly an implementation of step S102 in Embodiment 1. In this embodiment, the main control unit may include multiple units, and step S102 may include, but is not limited to:

[0115] Step S1023: When the status information indicates that the security chip is in the in-situ state, the first access path corresponding to each of the main control units is taken as the target access path of each of the main control units.

[0116] In this embodiment, the signals of each master control unit (such as CPU1, CPU2, BMC) can be transmitted to the security chip through their respective signal selection logic component groups (which may include at least the first signal selection logic component and the second signal selection logic component). The security chip independently performs security processing (such as encryption, integrity verification, whitelist verification, etc.) on the signals of each master control unit, without signal crossover or processing resource preemption, ensuring security and real-time performance when multiple master control units access the chip simultaneously.

[0117] If a single main control unit has multiple signal output interfaces (such as simultaneously outputting high-speed and low-speed signals), an independent signal selection logic unit group can be configured for each signal output interface to ensure independent transmission and secure processing of signals with different attributes.

[0118] If the signal output interfaces of different main control units meet the conditions of signal attribute compatibility (such as consistent rate and protocol) or access to the same target memory, they can share a set of signal selection logic components, simplifying the hardware architecture.

[0119] Each signal selection logic unit group in the security chip has an input interface and an output interface. The input interface is physically connected to the first signal selection logic unit in the signal selection logic unit group, and the output interface can be physically connected to the second signal selection logic unit in the signal selection logic unit group.

[0120] The working mechanisms (signal splitting and path switching) of the first signal selection logic unit and the second signal selection logic unit corresponding to each master control unit, as well as the signal transmission process of the first access path (including the security chip) and the second access path (direct access), are consistent with the relevant design in Embodiment 2. No additional hardware logic adjustments are required. The expansion and adaptation of the multi-master control unit scenario can be achieved simply by configuring multiple signal selection logic unit groups and the corresponding security chip. This will not be elaborated further here.

[0121] For example, such as Figure 4 As shown, multiple main control units may include: BMC (Baseboard Management Controller) and CPU (Central Processing Unit). The BMC's FWSPI output interface (i.e., an implementation of a signal output interface) can establish a physical connection with the signal input interface (which can be represented as I-MUX1) of the first signal selection logic unit through hardware lines. This connection is in a continuous state and is used to transmit signals such as boot firmware (e.g., IPMI management program), hardware monitoring data, and network configuration (e.g., IP address) issued by the BMC.

[0122] The first signal selection logic unit (which can be represented as MUX1) has two independent signal output interfaces, corresponding to the transmission of two signals from the same source:

[0123] The first signal output interface (which can be represented as O1-MUX1) is directly connected to the first signal input interface (which can be represented as I1-SEC) of the security chip through hardware lines, forming the core transmission link of the first access path;

[0124] The second signal output interface (which can be represented as O2-MUX1) is directly connected to the second signal input interface (which can be represented as I2-MUX2) of the second signal selection logic unit (which can be represented as MUX2) through an independent hardware line, forming the core transmission link of the second access path;

[0125] The first signal output interface of the security chip (which can be represented as O1-SEC) establishes a physical connection with the first signal input interface of the second signal selection logic unit (which can be represented as I1-MUX2) through hardware circuitry.

[0126] The output interface of the second signal selection logic unit (which can be represented as O-MUX2) can establish a physical connection with the BMC ROM (i.e., an implementation of a target memory that can be used to store BMC firmware).

[0127] The BMC's SPI0 output interface (i.e., an implementation of a signal output interface that can output low-speed signals) can establish a physical connection with the first signal input interface (which can be represented as I1-MUX3) of the third signal selection logic unit (which can be represented as MUX3) through the LS (low-speed) hardware line.

[0128] The CPU's QSPI output interface (i.e., an implementation of a signal output interface capable of outputting high-speed signals) can establish a physical connection with the second signal input interface (which can be represented as I2-MUX3) of the third signal selection logic unit (MUX3) via hardware lines. The CPU and the BMC's LTPI (Low-Speed ​​Tracking Port Interface) can establish a connection through SCI CONN (Serial Communication Interface Connector) to achieve low-speed communication and state synchronization between the two.

[0129] The output interface (which can be represented as O-MUX3) of the third signal selection logic unit (MUX3) can establish a physical connection with the input interface (which can be represented as I-MUX4) of the fourth signal selection logic unit (MUX4).

[0130] The third signal selection logic unit (MUX3) can select one of the signals from the QSPI output interface and the SPI0 output interface to output to the fourth signal selection logic unit (MUX4).

[0131] The fourth signal selection logic unit (which can be represented as MUX4) has two independent signal output interfaces, each corresponding to the transmission of two signals from the same source:

[0132] The first signal output interface (which can be represented as O1-MUX4) is directly connected to the second signal input interface (which can be represented as I2-SEC) of the security chip through hardware circuitry, forming the core transmission link of the first access path;

[0133] The second signal output interface (which can be represented as O2-MUX4) is directly connected to the second signal input interface (which can be represented as I2-MUX5) of the fifth signal selection logic unit (which can be represented as MUX5) through an independent hardware line, forming the core transmission link of the second access path;

[0134] The second signal output interface of the security chip (which can be represented as O2-SEC) establishes a physical connection with the first signal input interface of the fifth signal selection logic unit (which can be represented as I1-MUX5) through hardware circuitry.

[0135] The output interface of the fifth signal selection logic unit (which can be represented as O-MUX5) can establish a physical connection with the BIOS ROM (i.e., an implementation of a target memory that can be used to store BIOS firmware).

[0136] In this embodiment, the logic control unit can be connected to the power supply pin (which can be represented as VCC-SEC) of the security module. The logic control unit can detect (e.g., detect that the voltage of the security chip's power supply pin (which can be represented as VCC-SEC) is >3.0V) through hardware circuitry. After confirming that the security chip is in place, the logic control unit simultaneously outputs the first control signal of two signal selection logic components (e.g., MUX1 and MUX2 belonging to the same group; or MUX4 and MUX5 belonging to the same group) to the first signal selection logic component and the second signal selection logic component.

[0137] The core function of the FWSPI (Firmware SPI) signal is to carry core business data such as the BMC's own boot firmware (e.g., IPMI management program), hardware monitoring data (e.g., temperature and voltage acquisition data), and network configuration parameters (e.g., IP address, subnet mask). The transmission stability and real-time performance of this type of signal directly determine whether the BMC can complete basic core functions such as initialization, hardware status monitoring, and remote management. It is a crucial guarantee for the normal operation of the BMC. Therefore, it is necessary to configure a dedicated signal selection logic unit group with the highest transmission priority for it to avoid interference from other signal transmissions.

[0138] The SPI0 (Serial Peripheral Interface 0) signal is limited to the BMC's online update operation of the BIOS ROM (the Flash chip that stores the CPU BIOS firmware). Its use case is highly specific (only enabled during firmware updates), and its usage frequency is significantly lower than that of the FWSPI signal. Its functional importance and transmission priority are both lower than those of the FWSPI signal.

[0139] Based on the significant differences between the two in terms of functional positioning, core importance, usage scenarios, and transmission priority, in order to ensure the stable and reliable implementation of the BMC core functions and the precise and independent execution of the SPI0 signal functions, this embodiment sets up independent signal selection logic component groups for the BMC's FWSPI output interface and SPI0 output interface, so that the transmission links of the two signals are isolated from each other and do not interfere with each other, ensuring the reliable implementation of their respective functions.

[0140] Furthermore, the signals transmitted by the BMC via the SPI0 output interface and the signals transmitted by the CPU via the QSPI output interface both access the BIOS ROM (a Flash chip storing the CPU BIOS firmware), thus eliminating the need for additional independent target memory. Based on this commonality, the BMC's SPI0 output interface and the CPU's QSPI output interface can share MUX4 and MUX5, avoiding the need to design separate transmission links for the two signals. This significantly simplifies the hardware architecture, reduces the number of signal selection logic devices used, and lowers the system's main control board footprint and hardware manufacturing costs.

[0141] SPI0 is a general-purpose low-speed serial communication protocol, while QSPI is a high-speed four-wire serial communication protocol. Although there is a difference in their transmission rates, they both belong to the category of serial communication protocols and are fully compatible with the read and write instruction format and data transmission specifications of BIOS ROM. No additional protocol conversion module is required to achieve orderly transmission of the two signals in the same group of components.

[0142] The MUX3's built-in preset timing scheduling logic (such as prioritizing the transmission of the CPU's high-speed QSPI signal by default, and scheduling the BMC's low-speed SPI0 signal during the QSPI signal transmission interval) can effectively avoid transmission conflicts between the two signal rates, ensuring that the functions of the CPU reading BIOS firmware via QSPI signal (high priority, high frequency) and the BMC updating BIOS firmware via SPI0 signal (low priority, low frequency) can both be reliably implemented without the need to design separate signal selection logic components due to the speed difference.

[0143] In this embodiment, by configuring an independent first access path for each master control unit, it is ensured that the signals of each master control unit can be independently processed (such as encryption, integrity verification, whitelist verification, etc.) through the dedicated channel of the security chip. This avoids cross-interference of signals from multiple master control units and contention for processing resources, and ensures security and real-time performance during simultaneous access. It not only meets the secure access requirements of multiple master control units (such as BMC and CPU) to their respective associated target memories (such as BMC ROM and BIOS ROM), but also ensures the integrity and legality of firmware data in all target memories through a unified security processing strategy, effectively preventing risks such as malicious tampering and illegal injection.

[0144] Meanwhile, the design is compatible with independent transmission of multiple signal output interfaces of the same main control unit and flexible reuse of signal selection logic component groups of different main control units. Without increasing hardware complexity, it takes into account the requirements of access independence and simplified hardware architecture, further improving the product's adaptability to multiple scenarios. It also supports users to expand and upgrade security functions in the future, extending the product life cycle and application scope.

[0145] As another optional embodiment of this application, refer to Figure 5 This is a flowchart illustrating a processing method provided in Embodiment 4 of this application. This embodiment is mainly an implementation of step S101 in Embodiment 1, such as... Figure 5 As shown, step S101 may include, but is not limited to:

[0146] Step S1011: Detect the level signals of at least two target interfaces of the security chip, and determine the level combination formed by the level signals of the at least two target interfaces as the status information of the security chip; the at least two target interfaces are pre-configured on the security chip to present a specified level combination to uniquely characterize the in-situ status of the security chip and / or its type.

[0147] In electronic devices, security chips are typically integrated within security modules. These modules also include the necessary resistors, capacitors, connectors, and other components to ensure stable operation of the security chip. To identify the presence and type of the security chip, the security module pre-configures at least two target interfaces (such as PRSNT_0 and PRSNT_1 pins) during the design phase. The core design, through fixed board-level circuitry, ensures that the target interfaces form a specific voltage level combination that corresponds one-to-one with the security chip's state. Specific implementations may include:

[0148] During the hardware design phase of the security module, a fixed circuit connection method can be planned for each target interface according to the preset level combination rules: for interfaces that need to output a high level (logic 1), a physical connection is established between the interface and the high-level power supply (e.g., 3.3V) of the device through a standard pull-up resistor (e.g., 10kΩ); for interfaces that need to output a low level (logic 0), a physical connection is established between the interface and the ground (GND, 0V) of the device through a standard pull-down resistor (e.g., 10kΩ).

[0149] This type of resistor connection is solidified by soldering during the production of the safety module, forming an unmodifiable hardware circuit. When the safety module is assembled into the electronic device, without the need for software configuration or external signal triggering, the target interface will naturally present a fixed level due to the preset resistor connection relationship. For example, the interface connected by the pull-up resistor will stably output a high level, and the interface connected by the pull-down resistor will stably output a low level, which will then be combined into a preset level combination (such as "01", "10", "00", etc.).

[0150] For example, if the target interface combination needs to present "01" to indicate that "the security chip is in place and is of type A", then during the design phase, the PRSNT_0 pin is grounded through a pull-down resistor and the PRSNT_1 pin is connected to a 3.3V power supply through a pull-up resistor. This configuration is completed and solidified before the security module leaves the factory. During subsequent assembly and use, the two pins will continuously output a combination of "0" and "1" levels, realizing the function of identifying the security chip status without additional configuration.

[0151] Specifically, different level combinations have different meanings. For example, as shown in Table 1, when the level combination is 11, it can be defined as the security chip not being present; while when the level combination is 01, 00, or 10, it indicates that the security chip is present, and respectively represents different types of security chips.

[0152] Table 1

[0153] PRSNT_0 PRSNT_1 Definition 1 1 Not in place 0 1 In place, type 1 1 0 In place, type 2 0 0 In place, type 3

[0154] In this embodiment, after the logic control unit (e.g., CPLD) reads the above level combination, it can identify the type of security chip. Based on the identified security chip type, it generates and sends a reset signal, enable signal, and clock signal that match the type of chip, ensuring that the security chip can start and work stably according to the preset logic.

[0155] For example, the logic control unit can have a pre-stored library of control signal parameters for different types of security chips. After identifying the chip type, it will automatically call the corresponding parameters to generate suitable reset signals, control signals, and clock signals.

[0156] The adaptation of the reset signal can include: different security chips have different reset trigger conditions (such as level active type and reset duration) (e.g., type A chip supports low-level reset, and the reset duration must be ≥10μs; type B chip supports high-level reset, and the reset duration must be ≥5μs). The CPLD will generate a matching reset signal (e.g., RSTIN signal) to ensure that the chip can complete initialization and load the internal security configuration and register default state after power-on.

[0157] Enable signal adaptation can include: different enable signal level requirements for various security chips (e.g., type A requires high level enable, type C requires low level enable), the CPLD will output the corresponding level enable signal to accurately activate the chip's security protection function and avoid chip function failure due to enable signal mismatch;

[0158] Clock signal adaptation can include: the operating clock frequency of the security chip has an adaptation range (e.g., type B supports 20-50MHz, type C supports 10-30MHz), the CPLD will generate a clock signal of the corresponding frequency through the internal clock module to provide a stable timing reference for the chip's security processing (such as verification and encryption).

[0159] In this embodiment, board-level circuitry (such as pull-up resistors and pin definitions) is used to determine the signal level, rather than directly detecting the pin levels of the security chip itself. The advantage of this approach is that module-level level detection aligns better with the core logic of modular PCB design. In actual production and use, there may be abnormal scenarios where the chip is not soldered but the module is already assembled. Directly detecting the chip pin levels could lead to misjudgments. By detecting the combination of module levels, this situation can be avoided, while also simplifying the detection logic of the logic control unit (e.g., CPLD), eliminating the need for direct interconnection with the security chip pins and reducing the complexity of the hardware design.

[0160] For example, such as Figure 6 As shown, in a server system, the PFR module (i.e., one implementation of a security module) is responsible for protecting the server's BIOS and BMC firmware. The CPLD, as a logic control unit, needs to monitor the presence and type of the PFR module in real time. The CPLD determines whether the PFR chip (i.e., one implementation of a security chip) is present and what type it is by reading the levels of the PRSNT_0 and PRSNT_1 pins (which can be represented as PFR_PRSNT0 and PFR_PRSNT1).

[0161] When the PFR module powers on, the logic control unit can send an RSTIN signal (usually active low) to trigger the PFR chip to execute the initialization process. During this process, the PFR chip loads internal security configurations, resets register states, and synchronizes communication timings to ensure it connects to the system in a stable state. For example, during initialization, the PFR chip loads pre-stored security algorithm parameters to prepare for subsequent firmware protection.

[0162] During system operation, the logic control unit can monitor the PFR module's operating status in real time. If an abnormality is detected in the PFR module, such as firmware verification timeout or signal feedback error, the logic control unit will restart the PFR chip via the RSTIN signal. This clears the abnormal state of the PFR chip, restores its security protection function, and improves system stability. For example, if an error occurs during firmware verification, preventing the verification process from completing normally, the logic control unit will detect this abnormality and send an RSTIN signal to restart the PFR chip, causing it to re-perform the verification.

[0163] The various components in electronic devices require strict timing coordination during startup and operation. The logic control unit sends the RSTIN signal to ensure that the startup timing of the PFR chip matches the power supply and signal transmission timing of the system main control board (e.g., DC_SCM baseboard). This avoids signal conflicts or access failures caused by the PFR chip not being ready. For example, if the PFR chip starts up too early and attempts to access the target memory before the system baseboard is fully powered and stable, it may lead to data transmission errors or hardware damage. Controlling the RSTIN signal ensures that the PFR chip starts up and operates at the appropriate time.

[0164] The P3V3_STBY power supply can provide standby power for core devices such as PFR modules and logic control units. Even when the system is powered off or in a low-power state, the P3V3_STBY can still maintain basic power supply. For example, after the server is powered off, it will continue to supply power to the CPLD, enabling the CPLD to detect the presence status of the PFR modules in real time (e.g., PFR_PRSNT0 / 1 level).

[0165] In this embodiment, by using the unique mapping of multiple interface level combinations, the synchronous and accurate identification of the in-situ status and type of the security chip is achieved, avoiding misjudgments that may occur with single interface detection (such as misreading of status due to poor contact). Furthermore, by pre-configuring the target interface, status identification can be completed without additional software intervention, requiring only hardware-level level reading, thereby improving detection response speed and reliability.

[0166] As another optional embodiment of this application, a processing method provided in embodiment 5 of this application may include, but is not limited to, the following steps:

[0167] Step S201: Detect the level signals of at least two target interfaces of the security chip, and determine the level combination formed by the level signals of the at least two target interfaces as the status information of the security chip; the at least two target interfaces are pre-configured on the security chip to present a specified level combination to uniquely characterize the in-situ status of the security chip and / or its type.

[0168] The detailed process of step S201 can be found in the relevant description in Example 4, and will not be repeated here.

[0169] Step S202: Identify the type of the security chip based on the level combination.

[0170] In this embodiment, the logic control unit can look up the chip type corresponding to the level combination in the mapping relationship between level combination and chip type as the type of the security chip.

[0171] Step S203: Send the type of the security chip to the main control unit so that the main control unit loads the target driver based on the type of the security chip. The target driver is used to realize communication between the main control unit and the security chip.

[0172] The logic control unit sends the identified chip type information to the main control unit (BMC or CPU) via a general-purpose interface (such as GPIO or I2C). The transmission process includes simple verification (such as parity checking) to prevent errors in type information transmission. For example, ... Figure 7 As shown, the CPLD can send the type of the security chip to the BMC via GPIO (General-Purpose Input / Output).

[0173] The firmware of the main control unit can include dedicated driver libraries for various types of security chips. After receiving the type of security chip, the target driver that matches the type of security chip can be loaded from the driver library.

[0174] The target driver can be used to convert the standard instructions of the main control unit into a format recognizable by the chip of that type, while adapting the chip's functional interfaces (such as encryption instruction interfaces and verification result feedback interfaces) to ensure that the two can correctly and efficiently exchange data and transmit instructions. For example, different types of security chips may use different communication protocols or data formats. By loading the adapted driver, the main control unit can send and receive data according to the requirements of the security chip, achieving stable communication.

[0175] Step S204: When the status information indicates that the security chip is in an in-situ state, the first access path is used as the target access path, and the first access path includes the security chip.

[0176] Step S205: When the status information indicates that the security chip is in an in-place state, the second access path is used as the target access path, and the second access path does not contain the security chip.

[0177] The target access path is used to transmit signals from the main control unit in the system main control board to the target memory. The data source information of the first access path and the second access path are the same, and the final destination of the output is the same.

[0178] For a detailed description of steps S204-S205, please refer to the relevant description of steps S102-S103 in Example 1, which will not be repeated here.

[0179] In this embodiment, the chip type is accurately identified by the combination of levels at the hardware level, and the target driver is loaded at the software level to realize the adaptation communication between the main control unit and different types of security chips. This not only solves the compatibility problem caused by the differences in communication protocols and functional logic of different security chips, but also eliminates the need to customize dedicated hardware or firmware versions for a single chip. Furthermore, it ensures the accuracy of instruction interaction and data transmission between the main control unit and the security chip, and guarantees the stable implementation of the core functions of the security chip such as verification, encryption, and recovery.

[0180] Meanwhile, the adaptation process requires no manual intervention, realizing an automated closed loop of detection, identification, adaptation, and communication. It retains the flexible adaptation feature with or without security chips, while expanding the compatibility with multiple security chips, improving the product's adaptation flexibility and scenario coverage, and reducing the version control costs on the production side and the difficulty of later upgrades on the user side.

[0181] The logic control unit provided in this application will be described below. The logic control unit described below can be referred to in correspondence with the processing method described above.

[0182] The logic control unit may include:

[0183] A status detection circuit is used to detect the status information of the security chip; the status information at least indicates whether the security chip is in an in-situ state; the security chip is used to protect the target memory from access.

[0184] Control logic circuits are used for:

[0185] When the status information indicates that the security chip is in an in-place state, the first access path is used as the target access path, and the first access path includes the security chip.

[0186] When the status information indicates that the security chip is in an off-site state, the second access path is used as the target access path, and the second access path does not contain the security chip;

[0187] The target access path is used to transmit signals from the main control unit in the system main control board to the target memory. The data source information of the first access path and the second access path are the same, and the final destination of the output is the same.

[0188] In this embodiment, when the status information indicates that the security chip is in an in-situ state, the control logic circuit uses the first access path as the target access path, which may specifically include:

[0189] When the status information indicates that the security chip is in an in-situ state, the signal of the main control unit is split into a first signal and a second signal; the first signal is transmitted through a first access path; the second signal is transmitted through a second access path.

[0190] The first signal is selected as the output from the first signal and the second signal and transmitted to the target memory.

[0191] When the status information indicates that the security chip is in an in-place state, the control logic circuit uses the second access path as the target access path, which may specifically include:

[0192] When the status information indicates that the security chip is in an off-site state, the signal of the main control unit is split into the first signal and the second signal;

[0193] The second signal is selected from the first signal and the second signal as the output and transmitted to the target memory.

[0194] If the main control unit comprises multiple units; when the status information indicates that the security chip is in an in-situ state, the control logic circuit uses the first access path as the target access path, which may specifically include:

[0195] When the status information indicates that the security chip is in an in-situ state, the first access path corresponding to each of the main control units is used as the target access path of each of the main control units.

[0196] In this embodiment, the state detection circuit can specifically be used for:

[0197] The level signals of at least two target interfaces of the security chip are detected, and the level combination formed by the level signals of the at least two target interfaces is determined as the status information of the security chip; the at least two target interfaces are pre-configured on the security chip to present a specified level combination to uniquely characterize the in-situ status of the security chip and / or its type.

[0198] In this embodiment, the control logic circuit can also be used for:

[0199] The type of the security chip is identified based on the level combination;

[0200] The type of the security chip is sent to the main control unit so that the main control unit loads the target driver based on the type of the security chip. The target driver is used to realize communication between the main control unit and the security chip.

[0201] In another embodiment of this application, an electronic device is provided. The electronic device may include, but is not limited to:

[0202] At least one main control unit;

[0203] At least one target memory;

[0204] A signal selection logic unit group corresponding to the target memory; the signal selection logic unit group includes a first signal selection logic unit and a second signal selection logic unit; the first signal output interface of the first signal selection logic unit is connected to the first signal input interface of the second signal selection logic unit through a security chip; the second signal output interface of the first signal selection logic unit is connected to the second signal input interface of the second signal selection logic unit.

[0205] The security chip is used to protect the target memory from access.

[0206] A logic control unit is used to detect the status information of the security chip. When the status information indicates that the security chip is in an in-position state, it outputs a first control signal to the first signal selection logic unit and the second signal selection logic unit; when the status information indicates that the security chip is not in an in-position state, it outputs a second control signal to the first signal selection logic unit and the second signal selection logic unit.

[0207] The first signal selection logic unit is used to split the signal of the main control unit into a first signal and a second signal based on the first control signal or the second control signal;

[0208] The second signal selection logic unit is used to select the first signal from the first signal and the second signal as an output based on the first control signal and transmit it to the target memory; or, based on the second control signal, select the second signal from the first signal and the second signal as an output and transmit it to the target memory.

[0209] In this embodiment, if the target memory supports access by multiple master control units, the signal selection logic unit group further includes: a third signal selection logic unit;

[0210] The third signal selection logic unit is used to select one signal from the signals output by each of the main control units and send it to the first signal selection logic unit.

[0211] In this embodiment, the logic control unit can be connected to at least two target interfaces of the security chip to detect the level signals of the at least two target interfaces of the security chip, and determine the level combination formed by the level signals of the at least two target interfaces as the status information of the security chip; the at least two target interfaces are pre-configured on the security chip to present a specified level combination to uniquely characterize the in-situ status of the security chip and / or its type.

[0212] In this embodiment, the working mechanisms of the main control unit, each signal selection logic component, security chip, and logic control unit can be found in the relevant descriptions in the embodiments of the above processing method, and will not be repeated here.

[0213] In this embodiment, the electronic device may further include:

[0214] The system main control board includes: at least one main control unit, at least one target memory, and a signal selection logic component group corresponding to the target memory.

[0215] The security chip is detachably connected to the system's main control board. This design facilitates subsequent maintenance and upgrades. Figure 8 In the example shown, the DC_SCM card, as a specific implementation of the system main control board, strictly adheres to the OCP DC_SCM2.0 protocol specification in its structural design. For example... Figure 8 As shown, the vertical distance from the bottom mounting surface of the system main control board to the surface connecting with the security chip is 5.90mm, and the vertical distance from the bottom mounting surface of the system main control board to the top of the security module is 8.85mm. The total height of the system main control board with the security chip installed fully complies with the 11.5mm MAX height requirement specified in the OCP protocol specification.

[0216] Regarding the connection method, such as Figure 8As shown, the security chip and the system main control board can be electrically connected via a connector. Furthermore, based on the main functional requirements of the PFR and referring to commonly used PFR chip models, such as CEC1736 and AST1060, it is possible to select from... Figure 9 The connector definition shown is used to connect the security chip to the system main control board. For example, a connector containing PRSNT_0_N and PRSNT_1_N pins can be selected.

[0217] The PRSNT_0_N and PRSNT_1_N signals are primarily used to provide feedback to the system's main control board regarding the insertion status of the security chip. When the security chip is correctly inserted into the connector, PRSNT_0_N and PRSNT_1_N will output specific level signals. By detecting these signals, it is possible to accurately determine whether the security chip is in place, and thus decide whether to activate the functional modules related to the security chip, ensuring that the entire system operates stably when the security chip is properly connected.

[0218] for Figure 9 The specific definitions, functional characteristics, and application scenarios of other connectors shown herein can be found in relevant publicly available literature, standards, or industry-standard interpretations in the existing technical field. To avoid repetition, the definitions of these connectors will not be elaborated upon here.

[0219] In this embodiment, the electronic device is equipped with a system main control board including at least one main control unit, at least one target memory, and a corresponding signal selection logic component group, which can realize efficient data processing and storage management. The security chip is detachably connected to the system main control board, which facilitates quick replacement when the security chip fails or needs to be upgraded, ensuring the continuous and stable operation of the device. It also allows for flexible replacement of the appropriate security chip according to different security requirements, enhancing the security protection flexibility and scalability of the electronic device and reducing maintenance costs and usage limitations.

[0220] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0221] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, training equipment, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0222] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0223] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, training device, or data center to another website, computer, training device, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

Claims

1. A processing method, comprising: Detect the status information of the security chip; The status information at least indicates whether the security chip is in an in-situ state; The security chip is used to protect access to the target memory; When the status information indicates that the security chip is in an in-place state, the first access path is used as the target access path, and the first access path includes the security chip. When the status information indicates that the security chip is in an off-site state, the second access path is used as the target access path, and the second access path does not contain the security chip; The target access path is used to transmit signals from the main control unit in the system main control board to the target memory. The data source information of the first access path and the second access path are the same, and the final destination of the output is the same.

2. The processing method according to claim 1, wherein when the status information indicates that the security chip is in an in-situ state, the first access path is used as the target access path, comprising: When the status information indicates that the security chip is in an in-situ state, the signal of the main control unit is split into a first signal and a second signal; The first signal is transmitted through the first access path; the second signal is transmitted through the second access path. The first signal is selected from the first signal and the second signal and output, and transmitted to the target memory; When the status information indicates that the security chip is in an in-place state, the second access path is used as the target access path, including: When the status information indicates that the security chip is in an off-site state, the signal of the main control unit is split into the first signal and the second signal; The second signal is selected from the first signal and the second signal as the output and transmitted to the target memory.

3. The processing method according to claim 1, wherein if the main control unit comprises multiple units; when the status information indicates that the security chip is in an in-situ state, using the first access path as the target access path includes: When the status information indicates that the security chip is in an in-situ state, the first access path corresponding to each of the main control units is used as the target access path of each of the main control units.

4. The processing method according to claim 1, wherein detecting the status information of the security chip includes: The level signals of at least two target interfaces of the security chip are detected, and the level combination formed by the level signals of the at least two target interfaces is determined as the status information of the security chip; The at least two target interfaces are pre-configured on the security chip to present a specified combination of levels to uniquely characterize the in-situ state of the security chip and / or the type to which it belongs.

5. The processing method according to claim 4, further comprising: The type of the security chip is identified based on the level combination; The type of the security chip is sent to the main control unit so that the main control unit loads the target driver based on the type of the security chip. The target driver is used to realize communication between the main control unit and the security chip.

6. A logic control unit, comprising: Status detection circuit, used to detect the status information of the security chip; The status information at least indicates whether the security chip is in an in-situ state; The security chip is used to protect access to the target memory; Control logic circuits are used for: When the status information indicates that the security chip is in an in-place state, the first access path is used as the target access path, and the first access path includes the security chip. When the status information indicates that the security chip is in an off-site state, the second access path is used as the target access path, and the second access path does not contain the security chip; The target access path is used to transmit signals from the main control unit in the system main control board to the target memory. The data source information of the first access path and the second access path are the same, and the final destination of the output is the same.

7. An electronic device, comprising: At least one main control unit; At least one target memory; The signal selection logic unit group corresponding to the target memory; The signal selection logic component group includes a first signal selection logic component and a second signal selection logic component; the first signal output interface of the first signal selection logic component is connected to the first signal input interface of the second signal selection logic component through a security chip; the second signal output interface of the first signal selection logic component is connected to the second signal input interface of the second signal selection logic component. The security chip is used to protect the target memory from access. A logic control unit is used to detect the status information of the security chip. When the status information indicates that the security chip is in an in-position state, it outputs a first control signal to the first signal selection logic unit and the second signal selection logic unit; when the status information indicates that the security chip is not in an in-position state, it outputs a second control signal to the first signal selection logic unit and the second signal selection logic unit. The first signal selection logic unit is used to split the signal of the main control unit into a first signal and a second signal based on the first control signal or the second control signal; The second signal selection logic unit is used to select the first signal from the first signal and the second signal as an output based on the first control signal, and transmit it to the target memory; Alternatively, based on the second control signal, the second signal is selected from the first signal and the second signal as the output and transmitted to the target memory.

8. The electronic device of claim 7, wherein if the target memory supports access by multiple master control units, the signal selection logic unit group further comprises: Third signal selection logic unit; The third signal selection logic unit is used to select one signal from the signals output by each of the main control units and send it to the first signal selection logic unit.

9. The electronic device according to claim 7, wherein the logic control unit is connected to at least two target interfaces of the security chip, for detecting the level signals of the at least two target interfaces of the security chip, and determining the level combination formed by the level signals of the at least two target interfaces as the status information of the security chip; the at least two target interfaces are pre-configured on the security chip to present a specified level combination to uniquely characterize the in-situ status of the security chip and / or its type.

10. The electronic device according to claim 7, further comprising: The system main control board includes: at least one main control unit, at least one target memory, and a signal selection logic component group corresponding to the target memory; The security chip is detachably connected to the system main control board.

Images