Bus system, chip, chip system and computer system of hardware security module

Abstract

The invention discloses a bus system, a chip, a chip system and a computer system of a hardware security module, and belongs to the field of chip hardware security and bus interaction. The hardware security module comprises at least one external bus, and under the condition that a pre-configured starting instruction of the hardware security module is stored in an ROM or an RAM of the hardware security module, the hardware security module starts the starting instruction through the at least one external bus and a main system bus which is serial with the at least one external bus. Reading and executing the corresponding instructions to be executed stored in the nonvolatile memory; and the hardware security module directly reads and executes the corresponding instructions to be executed stored in the nonvolatile memory through the nonvolatile storage instruction bus under the condition that the starting instructions of the hardware security module are not stored in the ROM or the RAM of the hardware security module. According to the method, the data interaction efficiency of the hardware security module and the main system nonvolatile memory is improved by introducing the special data channel of the hardware security module.

Description

Technical Field

[0001] This application relates to the fields of chip hardware security and bus interaction, and in particular to a bus system, chip, chip system and computer system of a hardware security module. Background Technology

[0002] In modern automotive electronic systems, with the rapid development of vehicle intelligence and networking, the requirements for the performance and data security of onboard chips are increasing. Especially in scenarios involving critical functions such as vehicle control and data transmission, ensuring system security and reliability is paramount. The Hardware Security Module (HSM) within the chip integrates various security mechanisms, such as encryption algorithm units and security authentication units, to protect the data security of the chip system.

[0003] The hardware security module, as an independent unit within the chip, interacts with the main system via the main system bus. It intercepts and verifies commands and data transmitted via the bus through strict access control policies, performing real-time encryption / decryption or digital signature verification on sensitive information. The hardware security module can promptly identify and block abnormal access behavior, providing hardware-level trusted protection for critical vehicle control commands and data, thus constructing a vehicle network foundation that meets functional safety and information security requirements.

[0004] In existing technical solutions, the hardware security module interacts with the main system through the main system bus. The access to the main system is limited to a single method, and data transmission takes a long time and is inefficient due to the long time spent on the main system bus and bus matrix. Furthermore, the hardware security module does not have the ability to directly access the main system's non-volatile memory. When reading instructions stored in the main system's non-volatile memory, it needs to sequentially pass through the data bus connecting the hardware security module and the main system bus, the main system bus, and the data bus connecting the non-volatile memory and the main system bus. This results in a long time consumption and low reading efficiency for the hardware security module when reading instructions stored in the main system's non-volatile memory. Summary of the Invention

[0005] To address the problems of existing technologies where hardware security modules have limited access methods to the main system and lack the ability to directly access the main system's non-volatile memory, this application provides a bus system, chip, chip system, and computer system for a hardware security module.

[0006] To achieve the above objectives, the first technical solution adopted in this application is: providing a bus system for a hardware security module, comprising: at least one external bus, wherein, when the boot instructions pre-configured by the hardware security module are stored in the ROM or RAM of the hardware security module, the hardware security module reads and executes the corresponding instructions to be executed by the hardware security module stored in non-volatile memory via the at least one external bus and a main system bus serially connected to the at least one external bus; and a non-volatile memory instruction bus, wherein, when the boot instructions of the hardware security module are not stored in the ROM or RAM of the hardware security module, the hardware security module directly reads and executes the corresponding instructions to be executed by the hardware security module stored in the instruction area of ​​the non-volatile memory via the non-volatile memory instruction bus.

[0007] The second technical solution adopted in this application is: to provide a chip that includes a bus system of a hardware security module according to the first technical solution of this application, as well as a hardware security module and a non-volatile memory.

[0008] The third technical solution adopted in this application is to provide a chip system that includes the chip in the second technical solution of this application.

[0009] The fourth technical solution adopted in this application is: to provide a computer system that includes the chip system in the third technical solution of this application.

[0010] The beneficial effects of the technical solution of this application are as follows: By introducing at least one external bus into the bus system of the hardware security module, the hardware security module can access the main system for data interaction via at least one external bus and the main system bus serial with at least one external bus. This increases the forms in which the hardware security module can access the main system, reduces the time spent by the hardware security module in the main system bus and bus matrix when transmitting data with the main system, and improves the data transmission efficiency. By introducing a non-volatile memory instruction bus, the hardware security module has the ability to directly access the non-volatile memory of the main system, thereby improving the efficiency of reading instructions when the hardware security module reads instructions stored in the non-volatile memory of the main system. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1This is a schematic diagram of a specific implementation of the bus system of the hardware security module of this application; Figure 2 This is a schematic diagram of the overall system structure of a bus system including the hardware security module of this application, according to a specific embodiment. Figure 3 This is a schematic diagram of the overall structure of the hardware security module in a specific embodiment of a bus system including the hardware security module of this application; Figure 4 This is a schematic diagram of the hardware security module startup process of a specific embodiment of a bus system including the hardware security module of this application.

[0013] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0014] The preferred embodiments of this application will now be described in detail with reference to the accompanying drawings, so that the advantages and features of this application can be more easily understood by those skilled in the art, thereby providing a clearer and more definite definition of the scope of protection of this application.

[0015] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0016] The technical solutions of this application and how they solve the aforementioned technical problems will be described in detail below with specific embodiments. The specific embodiments described below can be combined with each other to form new embodiments. The same or similar ideas or processes described in one embodiment may not be repeated in other embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0017] Figure 1 This is a schematic diagram of a specific implementation of the bus system of the hardware security module of this application.

[0018] exist Figure 1 In one specific embodiment shown, the bus system of the hardware security module of this application includes at least one external bus 101. When the boot instructions pre-configured by the hardware security module are stored in the ROM or RAM of the hardware security module, the hardware security module reads and executes the corresponding instructions to be executed by the hardware security module stored in the main system non-volatile memory via at least one external bus 101 and the main system bus.

[0019] In this specific implementation, at least one external bus 101 is responsible for connecting the hardware security module and the main system bus. When at least one external bus 101 is serially connected to the main system bus, it undertakes the data interaction task between the hardware security module and the non-volatile memory of the main system, including reading and writing instructions in the instruction area of ​​the non-volatile memory and data in the data area.

[0020] exist Figure 1 In one specific embodiment shown, the bus system of the hardware security module of this application further includes a non-volatile memory instruction bus 102. When the startup instruction of the hardware security module is not stored in the ROM or RAM of the hardware security module, the hardware security module directly reads and executes the corresponding instructions to be executed by the hardware security module stored in the instruction area of ​​the main system's non-volatile memory via the non-volatile memory instruction bus 102.

[0021] In this specific embodiment, the non-volatile memory instruction bus 102 connects the hardware security module to the non-volatile memory of the main system. The hardware security module can directly access the instruction area of ​​the main system's non-volatile memory and read instructions from that area via the non-volatile memory instruction bus 102. The non-volatile memory instruction bus 102 improves the efficiency of the hardware security module in accessing the main system's non-volatile memory and reading instructions.

[0022] In one specific embodiment of this application, at least one external bus is actually multiple parallel external buses. The hardware security module reads and executes corresponding instructions stored in non-volatile memory in parallel via these multiple parallel external buses and a main system bus serial to the at least one external bus. Compared to a traditional single external bus, multiple external buses enable parallel instruction reading operations, improving the throughput of the hardware security module's instruction reading. Multiple parallel external buses can each handle the tasks of reading instructions and data, as well as writing instructions and data, and can also allocate read and write tasks independently to improve transmission efficiency. The hardware security module with multiple parallel external buses provides faster response speeds and higher processing efficiency.

[0023] In one specific embodiment of this application, the central processing unit (CPU) in the hardware security module directly reads and executes the corresponding instructions to be executed by the hardware security module, stored in the instruction region of the non-volatile memory, via the non-volatile memory instruction bus. The non-volatile memory instruction bus directly connects the CPU in the hardware security module to the instruction region of the non-volatile memory, undertaking the task of the CPU in the hardware security module reading the instructions stored in the instruction region of the non-volatile memory. The non-volatile memory instruction bus 102 significantly improves the speed and efficiency of the CPU in the hardware security module in reading instructions, thereby improving the processing speed and efficiency of the CPU in the hardware security module.

[0024] In one specific embodiment of this application, the bus system of the hardware security module further includes a peripheral bus. The hardware security module can directly interact with the registers of external devices in the host system via the peripheral bus. The peripheral bus directly connects the central processing unit in the hardware security module to the registers of the external devices in the host system. Common hardware security modules that do not have the aforementioned peripheral bus need to access the registers of external devices in the host system, including control registers, status registers, and data registers, sequentially through the internal bus of the hardware security module, the external bus of the hardware security module, and the host system bus, to read the device status and input data of the external devices and write control instructions.

[0025] In this specific embodiment, the central processing unit (CPU) of the hardware security module equipped with the aforementioned peripheral bus can directly access the control registers, status registers, and data registers of the host system's external devices via the peripheral bus for data interaction. Compared to common hardware security modules without the aforementioned peripheral bus, the hardware security module with the aforementioned peripheral bus achieves more efficient access to the host system's external devices, improves the processing efficiency of the CPU in the hardware security module, and reduces the data throughput of the host system bus.

[0026] In one specific embodiment of this application, after receiving a pre-configured boot instruction, the central processing unit (CPU) within the hardware security module parses the boot instruction and verifies whether the address of the boot instruction falls within the address space of the hardware security module's ROM or RAM, thereby determining whether the boot instruction is stored in the hardware security module's ROM or RAM. Different boot instruction addresses trigger different boot methods from the hardware security module. Multiple boot methods allow the hardware security module to handle various boot requirements, improving its operational efficiency.

[0027] In this specific implementation, if the boot instruction of the hardware security module is stored in the ROM or RAM of the hardware security module (i.e., the hardware security module is configured to boot in HSM-ROM / RAM mode), the hardware security module will execute a pre-configured code validity verification program to verify the validity of the corresponding instructions to be executed by the hardware security module stored in the non-volatile memory. If the verification is successful, the hardware security module will read and execute the corresponding instructions to be executed by the hardware security module stored in the non-volatile memory via at least one external bus and the main system bus serially connected to at least one external bus; if the verification fails, the hardware security module will perform different operations according to the configured information.

[0028] In this specific implementation, if the boot instructions of the hardware security module are not stored in the ROM or RAM of the hardware security module, but are stored in the instruction area of ​​non-volatile memory (i.e., the hardware security module is configured for HSM-NVM boot mode), the central processing unit in the hardware security module directly reads and executes the corresponding instructions to be executed by the hardware security module stored in the instruction area of ​​non-volatile memory via the non-volatile memory instruction bus. This HSM-NVM boot mode of the hardware security module boots directly from the main system's non-volatile memory without going through the main system bus, making the process simpler and the boot speed faster compared to the HSM-ROM / RAM boot mode. Both the HSM-NVM and HSM-ROM / RAM boot modes of the hardware security module can meet the actual boot requirements of the hardware security module, achieving high-efficiency booting for various boot needs.

[0029] Figure 2 This is a schematic diagram of the overall system structure of a bus system including the hardware security module of this application, according to a specific embodiment.

[0030] exist Figure 2 In one specific embodiment shown, the system includes a bus system containing the hardware security module of this application, and also includes a hardware security module 201, a main system bus 203, registers 206 of the main system external devices, a non-volatile memory 208, and other modules 204.

[0031] In this specific embodiment, the bus system of the hardware security module of this application includes two parallel external buses 202. One of the two parallel external buses 202 can handle reading instructions and data, while the other handles writing instructions and data; alternatively, they can allocate read and write tasks independently to improve transmission efficiency. Compared to a hardware security module that reads and writes on the same external bus, a hardware security module 201 with two parallel external buses 202 provides faster response speed and higher processing efficiency. The main system bus 203 is serially connected to the two parallel external buses 202. The hardware security module 201 can access other modules 204 and non-volatile memory 208 of the main system through the two parallel external buses 202 and the main system bus 203. The two parallel external buses 202 reduce the time spent on data transmission between the hardware security module 201 and the main system bus, thereby improving the interaction efficiency between the hardware security module 201 and the main system.

[0032] In this specific embodiment, when the pre-configured boot instructions of the hardware security module 201 are stored in the ROM or RAM of the hardware security module 201, the hardware security module 201 reads and executes the corresponding instructions to be executed by the hardware security module stored in the non-volatile memory 208 in parallel through two parallel external buses 202 and the main system bus 203. The two parallel external buses 202 enable parallel instruction reading operations, improving the throughput of instruction reading by the hardware security module. The two parallel external buses 202 provide the hardware security module 201 with faster response speed and higher processing efficiency.

[0033] In this specific embodiment, the bus system of the hardware security module of this application includes a non-volatile memory instruction bus 207. The hardware security module 201 can directly access the instruction area of ​​the non-volatile memory 208 through the non-volatile memory instruction bus 207. The non-volatile memory instruction bus 207 enables the hardware security module 201 to directly access the main system non-volatile memory 208, thereby reducing the latency of instruction transmission and improving the efficiency of instruction reading when the hardware security module reads instructions stored in the main system non-volatile memory.

[0034] In this specific embodiment, when the boot instructions pre-configured in the hardware security module 201 are not stored in the ROM or RAM of the hardware security module 201, the hardware security module directly reads and executes the corresponding instructions to be executed by the hardware security module stored in the instruction area of ​​the main system's non-volatile memory via the non-volatile memory instruction bus 207. The non-volatile memory instruction bus 207 enables the hardware security module 201 to boot directly from the main system's non-volatile memory 208 without going through the main system bus 203, making the hardware security module boot mode more flexible and the boot efficiency higher.

[0035] In this specific embodiment, the two parallel external buses 202 are not responsible for accessing the boot instruction code in the non-volatile memory 208, which is directly started from the non-volatile memory by the hardware security module. Compared with the traditional hardware security module that accesses all instructions and addresses through the external bus, the efficiency of the hardware security module 201 in reading instructions can be greatly improved.

[0036] In this specific embodiment, the bus system of the hardware security module of this application further includes a peripheral bus 205. The hardware security module 201 can directly access the registers 206 of the external devices of the main system via the peripheral bus 205. The registers 206 of the external devices of the main system include control registers, status registers, and data registers. The hardware security module 201 can directly read the device status and input data of the external devices of the main system and write control instructions via the peripheral bus 205, reducing data transmission latency. The peripheral bus 205 enables the hardware security module 201 to have higher access efficiency to the registers 206 of the external devices of the main system, improves the processing efficiency of the central processing unit of the hardware security module, and reduces the data throughput of the main system bus.

[0037] In this specific example, when the hardware security module 201 accesses instructions in the instruction area of ​​the main system non-volatile memory 208, it accesses the instruction area of ​​the main system non-volatile memory 208 directly through the non-volatile memory instruction bus 207; when the hardware security module 201 accesses data in the data area of ​​the main system non-volatile memory 208, it accesses the data area of ​​the main system non-volatile memory 208 through two parallel external buses 202 and the main system bus 203; when the hardware security module 201 accesses the device status in the register 206 of the main system external device, it accesses the status register of the main system external device directly through the peripheral bus 205.

[0038] In this specific example, the hardware security module 201 has the ability to customize the access method according to the data type to be accessed. When the hardware security module 201 transmits data with the main system, the time spent on the main system bus and bus matrix is ​​short, and the addressing efficiency is high.

[0039] Figure 3 This is a schematic diagram of the overall structure of the hardware security module in a specific embodiment of a bus system that includes the hardware security module of this application.

[0040] exist Figure 3In one specific embodiment shown, the hardware security module internally includes a central processing unit (including internal random access memory) 301, a read-only memory (ROM) 309, a random access memory (RAM) 302, an algorithm module group 310, external device registers 311, a direct memory access (DMA) 303, an HSM bus 305, and an AXI5 protocol bus 304. The external device registers 311, the DMA 303, and the algorithm module group 310 are common modules in general hardware security module systems.

[0041] In this specific example, the central processing unit 301 accesses all modules within the hardware security module via the AXI5 protocol bus 304 and the HSM bus 305. The AXI5 protocol bus 304 can be decomposed into five independent channels, including a read address channel, a read data channel, a write address channel, a write data channel, and a write corresponding channel, which can process read instructions, read addresses, write instructions, and write addresses in parallel. The AXI5 protocol bus 304 improves the data interaction efficiency between the central processing unit 301 and other modules within the hardware security module, thereby improving the processing efficiency of the central processing unit 301.

[0042] In this specific embodiment, the central processing unit (CPU) inside the hardware security module can directly access the instruction area of ​​the main system's non-volatile memory via the non-volatile memory instruction bus 306 to read the corresponding instructions to be executed by the hardware security module, without needing to go through the AXI5 protocol bus 304 and the HSM bus 305. The CPU can also directly access the registers of external devices in the main system via the peripheral bus 307, performing data read, status read, data write, and status write operations without needing to go through the AXI5 protocol bus 304 and the HSM bus 305. The non-volatile memory instruction bus 306 and the peripheral bus 307 are directly connected to the CPU 301 inside the hardware security module, improving the CPU's efficiency in reading instructions and data, as well as its instruction execution efficiency, while reducing the data throughput of the AXI5 protocol bus 304 and the HSM bus 305.

[0043] In this specific example, after receiving a boot command, the CPU 301 in the hardware security module parses the command and verifies whether its address falls within the address space of the ROM 309 or RAM 302 within the hardware security module, thus determining whether the boot command is stored in those memory locations. Different boot command addresses trigger different boot methods from the CPU 301. These multiple boot methods allow the hardware security module to handle various boot requirements.

[0044] In this specific embodiment, if the boot instruction is stored in the ROM 309 or RAM 302 of the hardware security module, i.e., the hardware security module is configured to boot in HSM-ROM / RAM mode, the central processing unit 301 will execute a pre-configured code validity verification program to verify the validity of the corresponding instructions to be executed by the hardware security module stored in the non-volatile memory. If the verification is successful, the central processing unit 301 of the hardware security module will sequentially read and execute the corresponding instructions to be executed by the hardware security module stored in the non-volatile memory via the AXI5 protocol bus 304, the HSM bus 305, two parallel external buses 308, and the main system bus.

[0045] In this specific embodiment, if the boot instruction is not stored in the ROM 309 or RAM 302 of the hardware security module, but in the instruction area of ​​the non-volatile memory, i.e., the hardware security module is configured in HSM-NVM boot mode, the central processing unit 301 directly reads and executes the corresponding instructions to be executed by the hardware security module stored in the instruction area of ​​the non-volatile memory via the non-volatile memory instruction bus 306. This HSM-NVM boot mode of the hardware security module boots directly from the main system non-volatile memory without going through the AXI5 protocol bus 304, HSM bus 305, two parallel external buses 308 and the main system bus. Compared with the HSM-ROM / RAM boot mode, the process is relatively simple, the boot speed is faster, and the processing efficiency of the central processing unit 301 in the hardware security module is improved.

[0046] Figure 4 This is a schematic diagram of the hardware security module startup process of a specific embodiment of a bus system including the hardware security module of this application.

[0047] exist Figure 4 In one specific embodiment shown, the hardware security module first checks the address of the boot instruction upon startup; different addresses result in different boot processes. After receiving the boot instruction, the HSM's central processing unit parses the boot instruction and determines whether the address of the boot instruction falls within the address space of the HSM's ROM or RAM, thereby determining whether the boot instruction is stored in the HSM's ROM or RAM.

[0048] In this specific embodiment, if the address of the boot instruction is not within the address space of the HSM's ROM / RAM, i.e., the hardware security module is configured for HSM-NVM boot mode, then the HSM-NVM code is started. The HSM's central processing unit directly reads and executes the instruction code to be executed by the HSM stored in the main system's non-volatile memory via the non-volatile memory instruction bus. The HSM-NVM boot mode of the hardware security module does not go through the main system bus, simplifying the boot process and speeding up the response speed of the hardware security module.

[0049] In this specific embodiment, if the address of the boot instruction is within the address space of the HSM's ROM / RAM, i.e., the hardware security module is configured for HSM-ROM / RAM boot mode, then the HSM-ROM / RAM code is started. The HSM calls a pre-configured code validity verification program in the ROM / RAM to verify the validity of the HSM-NVM code. If the verification is successful, the HSM-NVM code is started. The HSM sequentially reads and executes the instruction code to be executed by the HSM stored in the main system's non-volatile memory via at least one external bus and the main system bus. If the verification fails, the HSM performs the corresponding operation according to the configured information. The HSM-NVM boot mode of the hardware security module is relatively simpler and faster than the HSM-ROM / RAM boot mode. Both the HSM-NVM and HSM-ROM / RAM boot modes of the hardware security module can meet the actual boot requirements of the hardware security module, achieving high-efficiency booting for the hardware security module to handle various boot needs.

[0050] In this specific embodiment, the hardware security module includes an HSM-NVM boot mode that boots directly from the main system's non-volatile memory without going through the main system bus, and an HSM-ROM / RAM boot mode that goes through the main system bus. These different boot modes allow the hardware security module to handle various boot requirements, improving its operational efficiency.

[0051] In this application, by introducing at least one external bus into the bus system of the hardware security module, the hardware security module can access the main system for data interaction via at least one external bus and a main system bus serial to at least one external bus. This increases the ways in which the hardware security module can access the main system, reduces the time spent on the main system bus and bus matrix when transmitting data, and improves transmission efficiency. By introducing a non-volatile memory instruction bus, the hardware security module has the ability to directly access the main system's non-volatile memory, thereby improving the efficiency of reading instructions when the hardware security module reads instructions stored in the main system's non-volatile memory.

[0052] In one specific embodiment of this application, a chip includes a bus system of the hardware security module described in the above embodiments, the hardware security module, and a non-volatile memory.

[0053] In one specific embodiment of this application, a chip system includes the chip described in the above embodiments.

[0054] In one specific embodiment of this application, a computer system includes the chip system described in the above embodiments.

[0055] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0056] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0057] The above description is merely an embodiment of this application and does not limit the patent scope of this application. Any equivalent structural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A bus system for a hardware security module, characterized in that, include: At least one external bus, wherein, when the boot instructions pre-configured by the hardware security module are stored in the ROM or RAM of the hardware security module, the hardware security module reads and executes the corresponding instructions to be executed by the hardware security module stored in the non-volatile memory via the at least one external bus and the main system bus serial with the at least one external bus; A non-volatile memory instruction bus, wherein, when the startup instruction of the hardware security module is not stored in the ROM or RAM of the hardware security module, the hardware security module directly reads and executes the corresponding instruction to be executed by the hardware security module stored in the instruction area of ​​the non-volatile memory via the non-volatile memory instruction bus.

2. The bus system of the hardware security module according to claim 1, characterized in that, The at least one external bus is multiple parallel external buses, and, The hardware security module reads and executes corresponding instructions stored in non-volatile memory via the at least one external bus and the main system bus serially connected to the at least one external bus, including: The hardware security module reads and executes the corresponding instructions to be executed by the hardware security module stored in the non-volatile memory in parallel via the multiple parallel external buses and the main system bus serial with at least one of the external buses.

3. The bus system of the hardware security module according to claim 1, characterized in that, The hardware security module directly reads and executes the corresponding instructions to be executed by the hardware security module stored in the instruction area of ​​the non-volatile memory via the non-volatile memory instruction bus, including: The central processing unit in the hardware security module directly reads and executes the corresponding instructions to be executed by the hardware security module stored in the instruction area of ​​the non-volatile memory via the non-volatile memory instruction bus.

4. The bus system of the hardware security module according to claim 1, characterized in that, Also includes: Peripheral bus, wherein the hardware security module interacts directly with the registers of external devices of the main system via the peripheral bus.

5. The bus system of the hardware security module according to claim 4, characterized in that, The hardware security module interacts directly with the registers of external devices in the main system via the peripheral bus, including: The central processing unit in the hardware security module interacts directly with the registers of external devices in the main system via the peripheral bus.

6. The bus system of the hardware security module according to claim 1, characterized in that, After receiving the boot instruction, the central processing unit in the hardware security module parses the boot instruction and verifies whether the address of the boot instruction falls within the address space of the ROM or RAM of the hardware security module, thereby determining whether the boot instruction is stored in the ROM or RAM of the hardware security module.

7. The bus system of the hardware security module according to claim 6, characterized in that, The hardware security module reads and executes corresponding instructions stored in non-volatile memory via the at least one external bus and the main system bus serially connected to the at least one external bus, including: The hardware security module uses a pre-configured code validity verification program to verify the validity of the corresponding instructions to be executed by the hardware security module stored in the non-volatile memory. If the verification is successful, the hardware security module reads and executes the corresponding instructions to be executed by the hardware security module stored in the non-volatile memory via the at least one external bus and the main system bus serial with the at least one external bus.

8. A chip comprising a bus system of a hardware security module according to any one of claims 1-7, the hardware security module, and the non-volatile memory.

9. A chip system comprising the chip according to claim 8.

10. A computer system comprising the chip system according to claim 9.

Images