Processing system provided with an anti-interference mechanism

Abstract

This disclosure relates to a processing system with an anti-interference mechanism. The processing system includes multiple master units, multiple slave units, a bus, and multiple slave registers. The processing system assigns a master identifier to each master unit. Each slave register stores a list of permitted master identifiers that allow access to the corresponding slave unit. Each slave unit has protection circuitry configured to allow or prevent access to the slave unit based on the master identifier of the master unit attempting to access it.

Description

Technical Field

[0001] This disclosure relates to processing systems where a specific application or function is spatially divided into multiple domains. In particular, this disclosure relates to processing systems equipped with anti-interference mechanisms or functionalities. Background Technology

[0002] System architectures are evolving to support a variety of applications. For example, in the automotive industry, system architectures typically need to support multiple applications with mixed Automotive Safety Integrity Levels (ASIL) on a single System-on-Chip (SoC). This requires partitioning the SoC space to support mixed ASIL applications and ensure interference immunity.

[0003] Interference immunity (FFI) is a term defined in the ISO 26262 standard, referring to the absence of cascading failures between hardware and software components. It specifies three types of interference: timing and execution of information, and storage and exchange.

[0004] Current spatial FFI (Free Fiber Optic) techniques are limited in supporting spatial partitioning of SoC (System-on-a-Chip) systems with multiple master devices. Software-based methods, such as those using hypervisors (HV), cannot guarantee complete interference immunity. The purpose of this disclosure is to address one or more of the limitations mentioned above. Summary of the Invention

[0005] According to a first aspect of this disclosure, a processing system is provided, comprising: a plurality of master components, wherein the processing system is configured to assign a master identifier to each master component; a plurality of slave components; a bus for communication between the plurality of master components and the plurality of slave components; a plurality of slave registers, each slave register being configured to store a list of permitted master identifiers that allow access to a respective slave component; wherein each slave component has protection circuitry configured to permit or prevent access to the slave component based on the master identifier of the master component to which an attempt is made to access.

[0006] For example, the primary component can be a processor (such as an application processor). The secondary component can be memory. Alternatively or in combination, the secondary memory can include programmable input / output / advanced peripheral devices.

[0007] Optionally, for each slave component, the protection circuit is configured to compare the master identifier with a list of permitted master identifiers for the slave component, and grant access only if the master identifier matches a permitted master identifier.

[0008] Optionally, access to the slave component is limited to one or more specific tasks.

[0009] For example, access can be limited to either read or write tasks.

[0010] Optionally, the primary identifier may include numbers.

[0011] For example, the primary identifier can be an integer (0, 1, 2, 3...).

[0012] Optionally, each slave register is configured to store a binary sequence of zeros and ones for each task to be executed on the slave component, wherein each number (0 or 1) in the binary sequence is associated with a specific master identifier.

[0013] For example, for a specific task, such as a reading task, the binary sequence could be 0001. The number 1 can indicate that the task is permitted, while the number 0 indicates that the task is not permitted.

[0014] Optionally, the processing system includes one or more master registers, each master register being configured to store the master identifier of the corresponding master component.

[0015] Optionally, the processing system includes configuration circuitry adapted to configure multiple master and slave registers.

[0016] For example, the configuration circuitry can be a security core.

[0017] Optionally, each main component includes at least one of a main register, a memory management unit, and an input-output memory management unit.

[0018] Optionally, each master register is configured to store the master identifier of the corresponding master component.

[0019] Optionally, the memory management unit and the system memory management unit each include a translation table, and the main identifier is encoded in the translation table.

[0020] Optionally, the conversion table is configured by the operating system or by user software.

[0021] Optionally, the processing system further includes a verification circuit configured to compare the master identifier with a list of permitted values; and wherein when the master identifier differs from a permitted value, the verification circuit is configured to change the master identifier to a predefined error value or prevent the propagation of the master identifier.

[0022] Optionally, the protection circuit is configured to block access to the slave component when it receives a master identifier with a predefined error value.

[0023] For example, a predefined error value can be any value outside the list of allowed values.

[0024] Optionally, the processing system is spatially divided into multiple domains, wherein for each domain, at least one master component and at least one slave component are assigned to a specific application or function.

[0025] Optionally, the master component serving one application or function cannot access the slave component serving another application or function.

[0026] Optionally, each domain may have different characteristics. For example, these characteristics could be the level of security requirements and / or the software vendor.

[0027] For example, different domains can have different levels of security requirements. For instance, different ASIL levels.

[0028] Optionally, at least one main component includes multiple sub-components, and the processing system is configured to assign a main identifier to each sub-component of the main component.

[0029] For example, multiple sub-parts can be multiple channels or multiple operation instances within a cluster, and the processing system is configured to assign a primary identifier to each channel or each operation instance. An operation instance can be a CPU with its own operating system.

[0030] Optionally, the processing system is implemented as an integrated electronic system. For example, the integrated electronic system may be a system-on-a-chip (SoC) or a microcontroller (MCU).

[0031] According to a second aspect of this disclosure, a method for preventing interference is provided in a processing system comprising multiple master components and multiple slave components, the method comprising:

[0032] Assign the main identifier to the corresponding main component;

[0033] Stores a list of master identifiers that grant access to the corresponding slave components;

[0034] The master component's primary identifier is used to grant or deny access to the slave component.

[0035] For example, it can prevent different types of interference, including execution interference and storage interference.

[0036] Optionally, the steps of granting or preventing access to a slave component include comparing the master identifier with a list of licensed master identifiers for the slave component, and granting access only if there is a match between the master identifier and the licensed master identifier. Attached Figure Description

[0037] The present disclosure is further described in detail below by way of example and with reference to the accompanying drawings, wherein:

[0038] Figure 1 This is a diagram illustrating the interference risks in a multi-core, multi-application processing system;

[0039] Figure 2 This is a diagram of an exemplary processing system with multiple master devices;

[0040] Figure 3 This is a diagram of the anti-interference (FFI) mechanism based on the memory protection unit (MPU);

[0041] Figure 4A and 4B This is a diagram of the FFI mechanism based on the Memory Management Unit (MMU) or Input-Output Memory Management Unit (IOMMU);

[0042] Figure 5A -5C is a diagram illustrating the limitations of the current FFI mechanism based on MMU or IOMMU;

[0043] Figure 6 This is a flowchart of a method for preventing interference in a processing system that includes multiple master components and multiple slave components;

[0044] Figure 7 It is used to implement Figure 6 A diagram of the processing system using the method;

[0045] Figure 8 It is used to implement Figure 6 A diagram of another processing system using the method;

[0046] Figure 9 This is a diagram of an example implementation of the Region ID MPU;

[0047] Figure 10 It is a diagram of a system with a lower Automotive Safety Integrity Level (ASIL) partition, a higher ASIL partition, and a lower ASIL OS / HV.

[0048] Figure 11 It is a diagram of another system that is divided between lower ASIL and higher ASIL;

[0049] Figure 12 This is a diagram of systems with lower ASIL partitions and higher ASIL partitions;

[0050] Figure 13 It is a diagram of a processing system that includes different types of main components. Detailed Implementation

[0051] Figure 1 This diagram illustrates the potential for interference risks in a multi-core, multi-application processing system. The Automotive Safety Integrity Level (ASIL) is a risk classification scheme defined by ISO 26262. There are four ASILs, ordered by the letters A, B, C, and D, with ASIL A having the lowest integrity requirement and ASIL D having the highest. Hazards labeled "Quality Management" (QM) do not specify any safety requirements.

[0052] In many real-world applications, different processes can be like Figure 1 They interact with each other as shown in the diagram. This increases the risk of data and / or processing interference. Such interference can include timing and execution (i.e., blocking, incorrect allocation, incorrect synchronization), storage (data corruption, inconsistent data), and information exchange (duplicates, loss, delays, corruption, etc.).

[0053] Figure 2 This is a diagram of an exemplary processing system with multiple master devices. In this example, the SoC hosts multiple applications from several logical domains labeled domains 1, 2, and 3. In an exemplary implementation in the automotive industry, domains 1, 2, and 3 could be autonomous driving (AD), in-vehicle infotainment (IVI), and vehicle computing processor (VCP), respectively.

[0054] The first domain (e.g., the AD domain) has two applications. For example, the first application could be a front-facing camera, while the second application could be a panoramic camera. The second domain (e.g., the IVI domain) has two applications, such as trunking and infotainment. The third domain (e.g., the VCP domain) has two applications, such as Controller Area Network (CAN) routing and Over-the-Air (OTA) updates. All applications 1-6 and logical domains 1-3 must be isolated from each other. In the first application, there are three functions, such as Path 1, Path 2, and merging. In the third application, there are two functions, such as indicator lights and electronic dashboards. All functions must also be isolated from each other.

[0055] A SoC is partitioned into spaces, with each partition providing functionality or an application. In other words, space partitioning allows the allocation of certain master and slave devices / memory to serve one application or function, and the allocation of other master and slave devices / memory to serve another application.

[0056] To ensure that applications or functions do not spatially interfere with each other, a master device serving one application or function should not interfere with or access slave devices / memory serving another application or function. This is known as spatial immunity (FFI). Figure 2 As shown, FFI should be provided between domains, applications, and functions.

[0057] Space FFI protection for a system can be implemented using a Memory Protection Unit (MPU), a Memory Management Unit (MMU), or an Input / Output Memory Management Unit (IOMMU). An MPU is a computer hardware unit that provides memory protection. It can be implemented using a low-power processor that only requires memory protection. A Memory Management Unit (MMU) is a computer hardware unit configured to inspect memory access operations on the memory bus and translate virtual memory addresses into physical addresses in memory. An Input / Output Memory Management Unit (IOMMU) is a memory management unit (MMU) that connects an I / O bus supporting direct memory access (DMA) to the memory.

[0058] Figure 3 This is a diagram of the FFI mechanism based on the MPU. The MPU is configured for each of Software 1 and Software 2 (e.g., Software 1 and 2 can be implemented as virtual machines (VMs) or processes in the POSIX terminology, or OS applications in the AUTOSAR terminology). Software 1 is allowed to access only the address range of bus slave device / memory 1, and not the address range of bus slave device / memory 2. Similarly, Software 2 is allowed to access only the address range of bus slave device / memory 2, and not the address range of bus slave device / memory 1.

[0059] Figure 4A and 4B This is a diagram of the FFI mechanism based on the MMU or IOMMU. The user configures the MMU / IOMMU to set up bus master device or software ("process" in POSIX terminology) access to bus slave devices / memory.

[0060] MMU hardware and MMU translation tables are typically configured and prepared by the operating system. Some operating systems use users / groups to control access. Bus slave devices / memory (devices) allow access from certain groups. Groups contain users, user-derived processes—access from processes to devices is associated. IOMMU hardware and IOMMU translation tables are typically configured and prepared by the user or user software. The MMU or IOMMU is used to translate virtual addresses (VAs) into physical addresses (PAs).

[0061] The MMU controls each bus master / software (process in POSIX terminology) access to the bus slave / memory pair. Only the translation from bus master / software 1 VA to bus slave / memory 1 PA is prepared, because the following accesses are permitted: bus master / software 1 VA can be translated to bus slave / memory 1 PA, and bus master / software 1 VA can access bus slave / memory 1 PA.

[0062] The bus master / software 1 VA is not prepared for conversion to the bus slave / memory 2 PA because access is not allowed: the bus master / software 1 VA cannot be converted to the bus slave / memory 1 PA, and the bus master / software 1 VA cannot access the bus slave / memory 1 PA.

[0063] Only prepare the conversion from bus master / software 2 VA to bus slave / memory 2 PA, because the following accesses are allowed: bus master / software 2 VA can be converted to bus slave / memory 2 PA, and bus master / software 2 VA can access bus slave / memory 2 PA.

[0064] The bus master / software 2 VA is not to be converted to the bus slave / memory 1 PA because access is not allowed: the bus master / software 2 VA cannot be converted to the bus slave / memory 2 PA, and the bus master / software 2 VA cannot access the bus slave / memory 2 PA.

[0065] Figure 5A -5C is a diagram illustrating the limitations of the current FFI mechanism based on MMU or IOMMU.

[0066] exist Figure 5A In this context, the application processor subsystem must use the highest ASIL operating system (OS) associated with the application or hypervisor (HV) considered on this SoC. Otherwise, a lower ASIL OS or HV may be misconfigured to allow the MMU to access other higher ASIL regions.

[0067] exist Figure 5B In this configuration, if bus master 1 is connected to the IOMMU, the IOMMU allows mapping from bus master 1 to bus slave / memory 1, but not mapping from bus master 1 to bus slave / memory 2. However, if bus master 2 is not connected to the IOMMU, mapping from bus master 2 to both bus slave / memory 2 and bus slave / memory 1 is allowed. Therefore, bus slave / memory 1 may be corrupted by bus master 2.

[0068] exist Figure 5C In this scenario, a lower ASIL OS can incorrectly configure the MMU and access a higher ASIL region. Unauthorized access is not protected in such cases.

[0069] Figure 6 This is a flowchart of a method for preventing interference in a processing system that includes multiple master components and multiple slave components.

[0070] In step 610, a master identifier is assigned to the corresponding master device. The master identifier, also known as the region ID (RGID), can be a unique number assigned to each master device. The region ID can be assigned to each master device at startup. This can be done via the master register. Depending on the master device implementation, a master device can be assigned more than one master identifier (RGID).

[0071] In step 620, a list of master identifiers that grant access to the corresponding slave component is stored. In step 630, based on the master identifier of the master component, the master component is granted access to (or prevented from accessing) the slave component.

[0072] This method prevents interference in processing systems where space is divided into multiple domains for specific applications or functions. In particular, it prevents storage interference and space interference.

[0073] Figure 7 It is used to implement Figure 6 The diagram illustrates a processing system 700. The processing system 700 includes multiple master units and multiple slave units communicating via a bus. In this example, the system includes two master units 711 and 712, two slave units 721 and 722, and a bus 730. The master units can be processors, such as cores or central processing units (CPUs). Examples of CPUs include application processors, real-time processors, system processors, etc. Each master device has several functionalities. These functionalities have intellectual property rights or "master IP". Slave units can be circuitry or memory. Slave memory can include programmable input / output / advanced peripheral devices. Slave devices can also have functionalities that have intellectual property rights or "slave IP".

[0074] The system also includes multiple master registers and multiple slave registers. Master component 711 has master register 741, while master component 712 has master register 742. Similarly, slave component 721 has slave register 751, while slave component 722 has slave register 752.

[0075] Each master register assigns a master identifier, also known as a master region ID (RGID), to the corresponding master component. Each slave register stores a list of master identifiers (region IDs) that grant access to the corresponding slave component.

[0076] Each component is equipped with a protection circuit, also known as an access protector, or simply a protector. Figure 7 In this configuration, two protectors 761 and 762 are provided for slave devices 721 and 722, respectively. Each protector is configured to allow or prevent the master device from accessing the slave device based on the master identifier (region ID) of the master device.

[0077] During operation, master device 711 is assigned RGID 0, while master device 712 is assigned RGID 1. The protection circuit then receives multiple master identifiers (area IDs), compares the master identifiers (area IDs) with a list of permitted master identifiers (area IDs) of the slave devices, and grants access only if the master identifier matches a permitted master identifier. Figure 7 The illustration shows specific examples of master devices 711 and 712 each attempting to access slave devices 721 and 722 to perform various actions (in this case, reading (R) or writing (W) from the slave devices). Read and write access can be granted separately.

[0078] If the master device 711 attempts to access the slave device 721, the protector 761 receives the region ID "0" and compares it with the slave register information for region 0. For RGID 0, a "1" is provided for both read and write functionality, indicating that both read and write are allowed. Therefore, the master device 711 can perform both read and write on the slave device 721.

[0079] If the master device 712 attempts to access the slave device 721, the protector 761 receives the region ID "1" and compares it with the slave register information for region 1. For RGID 1, a "0" is provided for both read and write functionality, indicating that both read and write are not allowed. Therefore, the master device 712 cannot perform either read or write on the slave device 721.

[0080] If master device 711 attempts to access slave device 722, protector 762 receives region ID "0" and compares it with the slave register information for region 0. For RGID 0, a "0" is provided for reading R and a "1" is provided for writing W. Therefore, master device 711 can write to slave device 722, but cannot read from 722.

[0081] If the master device 712 attempts to access the slave device 722, the protector 762 receives the region ID "1" and compares it with the slave register information for region 1. For RGID 1, a "1" is provided for both read and write functionality. Therefore, the master device 712 can perform both read and write on the slave device 722.

[0082] Using the system described above, any unauthorized access is blocked, and errors are flagged or reported to another part of the system. Access to the region ID configuration register can also be protected by the region ID mechanism.

[0083] The system can be expanded to many (more than 2) master components, each associated with its own RGID.

[0084] To further improve the FFI mechanism, the system can also include one or more additional verification circuits configured to compare the master identifier with a list of permitted values. When the master identifier differs from a permitted value, the verification circuit changes the master identifier to a predefined error value. When the protection circuit receives a master identifier with a predefined error value, the protection circuit prevents access to the slave component. Alternatively, the verification circuit can directly prevent the master identifier from propagating to the slave component.

[0085] Protection circuitry can be implemented in different ways. For example, protection circuitry may include one or more comparators. For instance, protection circuitry may include two comparators. The first comparator compares the master identifier with a list of permitted master identifiers for performing a specific task on the slave component, such as a read task. The second comparator compares the master identifier with the list of permitted master identifiers for performing another specific task on the slave component, such as a write task. For each comparator, a multiplexer may be provided to grant access only when the master identifier matches a permitted master identifier.

[0086] Figure 8 This is a diagram of a processing system with two verification circuits. The processing system includes two application (AP) cores, one real-time (RT) core, and two verification circuits called RegionID MPUs or RGID MPUs, as they are used to protect the memory.

[0087] Each AP core has a CPU and an MMU. The RT core has a CPU, MPU, IOMMU, and several hardware functionalities called IP. Additional IOMMUs can be provided for other non-CPU master devices within the SOC. Additionally, several master devices are configured with supplementary RegionID MPUs, also known as RGID MPUs. In this example, two RegionID MPUs are provided.

[0088] As explained above, the master device RGID can be configured by a dedicated register for each master device. Alternatively, the RGID can be encoded in an MMU / IOMMU Stage 2 translation table entry. The MMU or IOMMU translation table comprises a set of tables that map virtual addresses to physical addresses and provide access attributes. For example, the region ID can be encoded in the high x bits of the physical address, such as the most significant bit (MSB) of the physical address.

[0089] The RegionID MPU is configured to check if the master device's RGID is in a pre-configured list. If the master device's RGID is an allowed value, it is propagated to the protector. Otherwise, the RegionID MPU directly blocks the propagation of the master device's RGID, or alternatively, changes the master device's RGID to a pre-configured error value, also known as a false value "F". When the protector receives the master device with a pre-configured error value, it prevents access to the slave device.

[0090] On the slave device side, the slave register is configured for each slave device. The nth bit indicates whether the master device RGID n can access this slave device.

[0091] Figure 9 This is a diagram of an example implementation of the verification circuitry or RegionID MPU. The RegionID MPU 900 includes a check circuitry 910 and a multiplexer 920, also known as a data selector. The check circuitry 910 has a decoder for decoding the region ID, a register storing a list of predefined accepted RGID values, and a comparator configured to compare the decoded RGID with accepted or permissible RGID values. The multiplexer 910 has two inputs (channel 1 and channel 2) for receiving the RGID from the master device and a predefined region ID "F" to be blocked by a protector labeled as a fixed NG region ID.

[0092] During operation, the comparator output controls the selection signal of the multiplexer 920's output. When RGID is within the list of accepted RGID values, the selection signal selects channel 1, and RGID is set at the multiplexer's output. When RGID is outside the list of accepted RGID values, the selection signal selects channel 2, and NG RGID is set at the multiplexer's output.

[0093] Figure 10 This is a diagram of a system with a lower ASIL partition (partition 1), a higher ASIL partition (partition 2), and a lower ASIL OS / HV. The lower ASIL partition and the lower ASIL OS / HV share a common MMU and a common RegionID MPU (RGID MPU). In partition 2, the master device RGID is stored in the master register.

[0094] During operation, the lower ASIL OS / HV configuration partition 1 uses the master device RGID. The master device RGID is encoded in the MMU stage 2 translation table entry. When RGID master = A, the protector on bus / slave memory 1 only allows access to slave device 1; otherwise, access is blocked. When RGID master = R, the protector on bus / slave memory 2 only allows access to slave device 2; otherwise, access is blocked.

[0095] If the MMU is not configured correctly, it may fail to prevent mapping from the application processor to the bus slave device / memory2. However, in this case, the RegionID MPU is used to block access. If a lower ASIL OS / HV incorrectly configures the master device RGID as anything other than RGID A (e.g., RGID R), the RegionID MPU will perform a sanity check and block access. The RegionID MPU checks the RGID master value. If the value is not in the permitted list (here, value A), it replaces the RGID value with a predefined value (e.g., faulty RGID F), which will be blocked by an access protector also known as a slave device RGID protector. Alternatively, the RegionID MPU can directly block access by preventing further communication with the slave device. The RegionID MPU is configured by the highest ASIL element, so it is assumed to be configured correctly. Figure 10 In the system, partition 2 is configured with a RegionID MPU. For example, the real-time processor in partition 2 can be configured with a RegionID MPU in partition 1.

[0096] In this example, the application processor subsystem does not need to use the highest ASIL OS or HV. This is because the RegionID MPU can be used to block access from application processor subsystems with lower ASIL OS or HV to other higher ASIL regions.

[0097] Figure 11 This is a diagram of another system divided between the lower and higher ASIL domains. Master device 1 stores master device RGID=M1 in its master register. Similarly, master device 2 stores master device RGID=M2 in its master register. The operation is similar to... Figure 7 The system operates as follows. Master devices 1 and 2 do not need to be connected to the IOMMU. Instead, the RGID protector on the bus / slave memory side checks the master device RGID of a transaction. If the RGID is not allowed, access to the bus slave device / memory is blocked.

[0098] Figure 12This is a diagram of a system with a lower ASIL partition (partition 1) and a higher ASIL partition (partition 2). The lower ASIL partition and the higher ASIL partition have separate MMUs and separate RegionID MPUs.

[0099] In this implementation, the partition 1 master device RGID is configured as A1 by the lower AISL OS, while the partition 2 master device RGID is configured as A2 by the higher AISL OS. The master device RGID can be encoded in the MMU stage 2 translation table entry.

[0100] When RGID master = A1, the protector on bus / slave memory 1 only allows access to slave memory 1; otherwise, access is blocked. When RGID master = A2, the protector on bus / slave memory 2 only allows access to slave device 2; otherwise, access is blocked.

[0101] If the MMU on partition 1 (lower ASIL) is not configured correctly, it may be unable to prevent mapping from the application processor to the bus slave device / memory 2. However, in this case, RegionID MPU 1 is used to block access. If the lower ASIL incorrectly configures the master device RGID to anything other than A1 (e.g., RGID R), RegionID MPU 1 will perform a sanity check and block access.

[0102] RGID MPU 1 checks the RGID master device value. If the value is not in the permitted list (here, value A1), it replaces the RGID value with a predefined value (e.g., faulty RGID F), which will be blocked by the protector. Alternatively, RegionID MPU 1 can directly block access by preventing further communication with the slave device.

[0103] Figure 13 This is a diagram of a processing system that includes different types of master components. The processing system 1300 includes three master components. Each master device is provided with a master port coupled to a bus.

[0104] The first master component 1310, referred to as a single master device, is assigned a single master identifier.

[0105] The second main unit 1320, referred to as Direct Memory Access (DMA), has multiple channels of number N, of which only two channels are represented. A DMA channel is a component that manages memory access requests from one or more peripheral devices. In this case, a specific master identifier is assigned to each channel.

[0106] The third master unit 1330, referred to as the application processor cluster, has multiple CPUs of number N, of which only two CPUs are represented. In this case, a specific master identifier is assigned to each CPU. In this example, each cluster contains separate CPUs with their own operating system (OS).

[0107] Therefore, depending on the implementation of the main component, more than one main identifier can be assigned to the main component. It will also be understood that, depending on the application, each domain in the partitioned system may not necessarily have a different security level. For example, each domain can be separated due to different software vendors or security requirements, to name just a few examples.

[0108] Therefore, those skilled in the art will appreciate that variations of the disclosed arrangement are possible without departing from this disclosure. Thus, the above description of specific embodiments is by way of example only and not for limiting purposes. Those skilled in the art will understand that minor modifications can be made without significantly altering the operation.

Claims

1. A processing system, comprising: Multiple master components, wherein the processing system is configured to assign a master identifier to each master component; Multiple components; A bus for communication between the plurality of master components and the plurality of slave components; Multiple slave registers, each configured to store a list of license master identifiers that allow access to the corresponding slave component; Each slave component has a protection circuit configured to allow or prevent access to the slave component based on the master component's master identifier that is being attempted to access.

2. The processing system of claim 1, wherein for each slave component, the protection circuit is configured to compare a master identifier with a list of permitted master identifiers for the slave component, and to grant access only if the master identifier matches a permitted master identifier.

3. The processing system of claim 2, wherein access to the slave component is limited to one or more specific tasks.

4. The processing system according to claim 3, wherein the main identifier includes a number.

5. The processing system of claim 4, wherein each slave register is configured to store a binary sequence of zeros and ones for each task to be executed on the slave component, and wherein each number (0 or 1) in the binary sequence is associated with a specific master identifier.

6. The processing system according to claim 1, comprising one or more main registers, each main register being configured to store the main identifier of the corresponding main component.

7. The processing system of claim 1, wherein each main component includes at least one of the following: a main register, a memory management unit, and an input-output memory management unit.

8. The processing system of claim 7, wherein each master register is configured to store the master identifier of the corresponding master component.

9. The processing system of claim 7, wherein the memory management unit and the system memory management unit each include a translation table, and wherein the main identifier is encoded in the translation table.

10. The processing system of claim 8, further comprising a configuration circuit adapted to configure a plurality of master registers and slave registers.

11. The processing system of claim 9, wherein the conversion table is configured by an operating system or by user software.

12. The processing system of claim 1, further comprising a verification circuit configured to compare the master identifier with a list of permitted values; and wherein when the master identifier is identified as different from a permitted value, the verification circuit is configured to change the master identifier to a predefined error value or prevent the propagation of the master identifier.

13. The processing system of claim 12, wherein when the protection circuit receives a master identifier having the predefined error value, the protection circuit is configured to block access to the slave component.

14. The processing system of claim 1, wherein the processing system is spatially divided into multiple domains, wherein for each domain, at least one master component and at least one slave component are assigned to a specific application or function.

15. The processing system of claim 14, wherein a master component serving one application or function cannot access a slave component serving another application or function.

16. The processing system of claim 14, wherein each domain has different characteristics.

17. The processing system of claim 1, wherein at least one main component comprises a plurality of sub-parts, and wherein the processing system is configured to assign a main identifier to each sub-part of the main component.

18. The processing system of claim 1, wherein the processing system is implemented as an integrated electronic system.

19. A method for preventing interference in a processing system, the processing system comprising a plurality of master components and a plurality of slave components, the method comprising: Assign the main identifier to the corresponding main component; Store a list of master license identifiers, which allow access to the corresponding slave components; The master component is authorized or prevented from accessing the slave component based on its master identifier.

20. The method of claim 19, wherein the step of permitting or preventing access to the component comprises: The master identifier is compared with a list of licensed master identifiers for the slave component, and access is granted only if the master identifier matches the licensed master identifier.

Images