Storage controller, memory access control method of memory and chip

Abstract

Embodiments of the present application disclose a storage controller, a memory access control method and a chip. The storage controller comprises a command channel module and a data channel module, the data channel module comprises a plurality of data buses; wherein the command channel module is configured to receive an operation command sent by an operation unit; the data channel module is configured to determine function data and mask data corresponding to the operation command; and transmit the function data and the mask data through the plurality of data buses, so as to write the function data and the mask data into a storage unit, or return the function data and the mask data to the operation unit; the mask data is random data for mask protection of the function data.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of post-quantum computing technology, and in particular to a memory controller, a memory access control method, and a chip. Background Technology

[0002] In post-quantum cryptography hardware implementations, cryptographic acceleration chips simultaneously generate functional data and mask data when executing core algorithms such as polynomial operations, modular arithmetic, and hashing. The actual key and sensitive intermediate values ​​are decomposed into multiple shares, including functional data and mask data, neither of which individually reflects the actual sensitive information.

[0003] After the two types of data are generated inside the chip, they are written to their respective storage areas. During subsequent cryptographic operations, the chip will synchronously read the functional data and mask data from the storage, pair them up and send them into the computing path to perform cryptographic operations protected by the mask.

[0004] In related technologies, functional data and mask data are typically stored separately. During the reading phase, the original sensitive data is recovered in advance through merging logic at the memory interface and then sent to the processing unit in unmasked form. This exposes the original sensitive data in unmasked form along part of the transmission path, causing a break in the mask protection at that point. This allows attackers to extract power leakage along that path through differential power analysis, thereby breaching the protection. Summary of the Invention

[0005] This application provides at least one storage controller, a memory access control method, and a chip.

[0006] The technical solution of this application embodiment is implemented as follows: In a first aspect, embodiments of this application provide a storage controller, which includes a command channel module and a data channel module. The data channel module includes multiple data buses. The command channel module is used to receive operation commands sent by a processing unit. The data channel module is used to determine the functional data and mask data corresponding to the operation command. The functional data and mask data are transmitted through the multiple data buses to write the functional data and mask data into the storage unit or to send the functional data and mask data back to the processing unit. The mask data is random data that masks and protects the functional data.

[0007] Secondly, embodiments of this application provide a memory access control method. The method is applied to a memory controller, which includes a command channel module and a data channel module. The data channel module includes multiple data buses. The method includes: receiving an operation command sent by a processing unit through the command channel module; determining functional data and mask data corresponding to the operation command through the data channel module; wherein the mask data is random data that masks and protects the functional data; and transmitting the functional data and mask data through the multiple data buses in the data channel module to write the functional data and mask data into a memory unit or to send the functional data and mask data back to the processing unit.

[0008] Thirdly, embodiments of this application provide a chip, which includes the memory controller provided in embodiments of this application.

[0009] In this embodiment, the command channel module is responsible for parsing the operation commands sent by the arithmetic unit, while the data channel module, based on the command type, uses multiple data buses to carry functional data and mask data respectively, writing them in parallel to the storage unit or transmitting them back to the arithmetic unit in parallel. The mask data serves as a randomized protection component for the functional data and is never merged with the functional data on the transmission path. This avoids the risk of exposing the original data due to premature merging at the memory interface, resists side-channel attacks such as differential power analysis, improves the attack resistance of the cryptographic hardware, and ensures the continuity of mask protection for sensitive data throughout the entire transmission path.

[0010] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this application. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the structure of a storage controller provided in an embodiment of this application; Figure 2 This is a schematic flowchart of a memory access control method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a post-quantum algorithm chip provided in an embodiment of this application; Figure 4 This is a block diagram of the internal architecture of a storage controller provided in an embodiment of this application.

[0012] It should be noted that the terms "first" and "second" mentioned above are only used to distinguish between different options and do not represent the degree of superiority or inferiority of the options or their priority in the implementation process. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0014] In the following description, references to "some embodiments" refer to a subset of all possible embodiments. It is understood that "some embodiments" may be the same or different subsets of all possible embodiments and may be combined with each other without conflict. The terms "first / second / third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0015] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. The terminology used herein is for descriptive purposes only and is not intended to limit the scope of this application.

[0016] Currently, in the hardware implementation of post-quantum cryptography, cryptographic acceleration chips generate functional data and mask data simultaneously when executing core algorithms such as polynomial operations, modular arithmetic, and hashing. The actual key and sensitive intermediate values ​​are decomposed into multiple shares, including functional data and mask data, neither of which individually reflects the actual sensitive information.

[0017] Specifically, taking a first-order Boolean mask as an example, the original sensitive data It can be broken down into functional shares and mask share ,satisfy Individual observation or When considering the power consumption characteristics, they all exhibit random values, unlike the actual values. No statistical correlation.

[0018] After these two types of data are generated inside the chip, they can be written to their respective storage areas (such as functional RAM and mask RAM), and they can remain isolated at the physical storage level. During subsequent cryptographic operations, the chip synchronously reads the functional data and mask data from the storage, pairs them, and sends them into the computing path to perform cryptographic operations protected by the mask.

[0019] In related technologies, during the reading phase, the original sensitive data is recovered in advance through merging logic at the memory interface and then sent to the arithmetic unit in unmasked form. This results in the transmission of completely unmasked raw sensitive data along the physical path from the output of the merging logic to the input of the arithmetic unit. This creates a breakpoint in the masking protection at this point, allowing attackers to extract power leakage along this path through differential power analysis, thereby breaching the protection.

[0020] To address the aforementioned issues, this application proposes a memory controller, a memory access control method, and a chip.

[0021] The command channel module parses the operation commands sent by the arithmetic unit, while the data channel module, based on the command type, uses multiple data buses to carry functional data and mask data respectively. These are then written to the storage unit in parallel or transmitted back to the arithmetic unit in parallel. The mask data serves as a randomized protection component for the functional data and is never merged with the functional data during transmission. This avoids the risk of exposing the original data due to premature merging at the memory interface, protects against side-channel attacks such as differential power analysis, improves the attack resistance of the cryptographic hardware, and ensures the continuity of mask protection for sensitive data throughout the entire transmission path.

[0022] Figure 1 This is a schematic diagram of the structure of a storage controller provided in an embodiment of this application, as shown below. Figure 1 As shown, the storage controller 100 includes a command channel module 101 and a data channel module 102, and the data channel module 102 includes multiple data buses 103.

[0023] The storage controller 100 can be located inside a post-quantum cryptography hardware accelerator or a secure SoC (System on Chip) to connect with upper-layer computing units and lower-layer storage units, so as to perform separate read and write scheduling of functional data and mask data stored in the storage unit according to the memory access request initiated by the computing unit.

[0024] In this embodiment, the command channel module 101 can be used to receive operation commands sent by the arithmetic unit.

[0025] The operation commands sent by the arithmetic unit may include, but are not limited to, write commands and read commands.

[0026] Specifically, for a write command, after generating new functional data and mask data, the arithmetic unit can send a write command to the storage controller 100 to instruct the storage controller 100 to write the functional data into the functional RAM (random-access memory) via one data bus 103 in the data channel module 102, and simultaneously write the mask data into the mask RAM via another data bus 103 in the data channel module 102. The write command can carry the base address, data length, and data type identifier to ensure that the functional data and mask data are written in the storage unit according to the corresponding relationship.

[0027] For read commands, when the arithmetic unit needs to access sensitive data for the next step of computation, it can also send a read command to the storage controller 100 to instruct the storage controller 100 to synchronously read the paired functional data and mask data from the functional RAM and mask RAM, and then transmit them back to the arithmetic unit in parallel via different data buses 103. The read command can also carry the base address, data length, and data type identifier to ensure synchronized and paired data return.

[0028] In this embodiment, the data channel module 102 can be used to determine the functional data and mask data corresponding to the operation command; and transmit the functional data and mask data through multiple data buses 103 to write the functional data and mask data into the storage unit, or to send the functional data and mask data back to the computing unit.

[0029] Among them, mask data is random data that is used to mask and protect functional data.

[0030] Specifically, when the arithmetic unit sends a write command, the functional data is the sensitive intermediate value (i.e., functional share) newly generated by the arithmetic unit during the execution of core algorithms such as polynomial operations, modular arithmetic, or hashing. For example, the polynomial coefficients after a certain round of NTT transformation in the Kyber algorithm, the intermediate state of hash operation, etc.; the mask data is the randomized protection data (i.e., mask share) generated by pairing with the functional share. The result of the algebraic operation between the functional data and the mask data is the newly generated sensitive data. The specific algebraic operation used is consistent with the existing technology, and the specific steps will not be described in detail here.

[0031] Similarly, when the arithmetic unit sends a read command, the function data is the function share stored in the storage unit (data stored in the function RAM), and the mask data is the mask share stored in the storage unit that is paired with the function share (data stored in the mask RAM).

[0032] In this embodiment, after the command channel module 101 receives the operation command sent by the arithmetic unit, the data channel module 102 can determine the function data and mask data corresponding to the operation command.

[0033] Specifically, after receiving the operation command sent by the arithmetic unit, the command channel module 101 can first parse the operation command and extract the operation type (e.g., read or write), access address, data type identifier, and transmission length, etc., corresponding to the operation command. Then, the data channel module 102 can determine the functional data and mask data corresponding to the operation command based on the scheduling control information extracted by the command channel module 101.

[0034] In actual execution, when the operation type is identified as a write operation, the data channel module 102 can determine that the functional data originates from the functional data output port of the arithmetic unit, and the mask data originates from the mask data output port of the arithmetic unit. Based on the write base address carried in the operation command, the data channel module 102 can directionally transmit the functional data sent by the arithmetic unit to the functional RAM area of ​​the storage unit via one data bus 103, and simultaneously directionally transmit the mask data sent by the arithmetic unit to the mask RAM area of ​​the storage unit via another data bus 103. The two data streams are transmitted in parallel on their respective dedicated buses, maintaining physical separation throughout the transmission process and are not merged within the storage controller 100.

[0035] When an operation of type read is extracted, the data channel module 102 can locate and read the functional data from the functional RAM of the storage unit according to the read base address carried in the operation command and the predefined address mapping rules. Simultaneously, it can locate and read the mask data stored in the mask RAM that is paired with the functional data. Subsequently, the data channel module 102 can transmit the read functional data back to the functional data input port of the arithmetic unit via one data bus 103, and transmit the read mask data back to the mask data input port of the arithmetic unit via another data bus 103. The functional data and mask data are transmitted synchronously on their respective independent dedicated buses, remaining separate until they reach the arithmetic unit.

[0036] The above technical solution involves a command channel module 101 that parses operation commands sent from the arithmetic unit, and a data channel module 102 that, based on the command type, uses multiple data buses 103 to carry functional data and mask data respectively, writing them in parallel to the storage unit or transmitting them back to the arithmetic unit in parallel. The mask data serves as a randomized protection component for the functional data and is never merged with the functional data on the transmission path. This avoids the risk of exposing the original data due to premature merging at the memory interface, resists side-channel attacks such as differential power analysis, improves the attack resistance of cryptographic hardware, and ensures the continuity of mask protection for sensitive data throughout the entire transmission path.

[0037] In some embodiments, the operation command includes a read command; the command channel module 101 includes a read command channel module; and the data channel module 102 includes a read data channel module.

[0038] In this embodiment, the read command channel module can be used to receive read commands sent by the arithmetic unit. The read command includes a first address field and a first mask control field. When receiving a read command from the arithmetic unit, the read command channel module can also generate a read address based on the first address field and the first mask control field.

[0039] The read data channel module is used to read functional data and mask data from the storage unit according to the read address; and to send the functional data and mask data to the arithmetic unit through multiple data buses 103 according to the first mask control field, or to send the functional data to the arithmetic unit through the data bus 103 corresponding to the functional data.

[0040] The first address field includes, but is not limited to, address fields such as function address, mask address, and read length.

[0041] The first mask control field is used to indicate the reading strategy for mask data in this read operation.

[0042] In one possible implementation, the first mask control field includes a mask enable signal. The mask enable signal indicates whether the data bus 103 corresponding to the mask data is enabled. When the mask enable signal is valid, the read data channel module simultaneously reads functional data and mask data from the storage unit and transmits them back to the arithmetic unit in parallel via multiple data buses 103, achieving full-process mask protection. When the mask enable signal is invalid, the read data channel module only reads functional data; the mask data channel is not operational, and the mask address is invalid or not provided, thereby reducing unnecessary dynamic power consumption.

[0043] In actual execution, when the read command channel module receives a read command from the processing unit, it can parse the read command and extract the first address field and the first mask control field. After extracting the first address field, the read command channel module can generate a read address based on the first mask control field, function address, mask address, read length, and other fields; the read address can include the read function address to be read and the read mask address to be read.

[0044] Specifically, the read command channel module determines the generation of the read function address and the read mask address based on the mask enable signal in the first mask control field.

[0045] In one possible implementation, when the mask enable of the first mask control field is valid, the read command channel module uses the function address in the first address field as the base address for reading function data and the mask address as the base address for reading mask data. Based on the read length, it generates a pair of read function addresses and read mask addresses. If the read length is 1, only a single read function address and a single read mask address are generated. The read function address is used to locate the function data to be read from the function RAM of the storage unit, and the read mask address is used to locate the mask data to be read from the mask RAM of the storage unit. When the mask enable of the first mask control field is invalid, the read command channel module only uses the function address in the first address field as the base address to generate a single read function address; the mask address does not participate in address generation, and the read mask address is empty.

[0046] In some embodiments, the first address field may further include a step size and a parallelism parameter to support batch reading of multiple data entries. In this case, after parsing the first address field, the read command channel module can generate a continuous sequence of read addresses based on the function address, mask address, read length, step size, and parallelism.

[0047] Specifically, when the mask enable of the first mask control field is valid, the read command channel module uses the function address as the base address and the mask address as the base address, and combines the jump step size S and parallelism N to generate the read function address sequence and the read mask address sequence according to the following rules: For the j-th path (j=0,1,...,N-1) of the i-th batch (i=0,1,...,ceil(read length / N)-1): Read function address = function base address + (i × N + j) × S; Read function address = function base address + (i × N + j) × S; Among them, the read length determines the total number of data entries to be read, the parallelism N determines the number of parallel addresses output by a single address generation action, and the jump step size S determines the address interval between two adjacent read addresses.

[0048] When the mask enable of the first mask control field is invalid, the read command channel module generates a read function address sequence based solely on the function address, combined with the read length, jump step size, and parallelism. The mask address does not participate in address generation, and the read mask address sequence is empty.

[0049] Although the read command channel module only provides the read function address and not the read mask address when the mask enable of the first mask control field is invalid, the data bus 103 is composed of physical components such as a driver circuit, a clock gating unit, and a buffer. Even if the mask address is not provided, if the driver circuit of the data bus 103 transmitting the mask is still active, its clock tree flipping, signal line charging and discharging, and other behaviors will still generate dynamic power consumption. Without explicit inactivity state control, the data bus 103 transmitting the mask will be in an idle but charged floating or residual level state, and the expected power reduction effect cannot be achieved.

[0050] Therefore, in this embodiment, after the read data channel module reads the functional data and mask data from the storage unit according to the read address, it can send the functional data and mask data to the arithmetic unit through multiple data buses 103 according to the first mask control field, or send the functional data to the arithmetic unit through the data bus 103 corresponding to the functional data.

[0051] In one possible implementation, after receiving the read address from the read command channel module, the read data channel module first reads the corresponding data from the storage unit according to the read address. When the read address contains both the read function address and the read mask address, the read data channel module can read the function data and the mask data from the function RAM and the mask RAM respectively; when the read address only contains the read function address, the read data channel module only reads the function data from the function RAM.

[0052] Subsequently, the data channel module can control the activation status and data transmission behavior of multiple data buses 103 according to the mask enable signal in the first mask control field.

[0053] Specifically, when the mask enable of the first mask control field is valid, the read data channel module can operate multiple data buses 103 simultaneously. Functional data is transmitted from the storage unit to the function data input port of the arithmetic unit via the data bus 103 corresponding to the function data, and mask data is transmitted from the storage unit to the mask data input port of the arithmetic unit via the data bus 103 corresponding to the mask data. The two data buses 103 remain physically independent throughout the transmission process. The functional data and mask data are not merged within the read data channel module; controlled mask calculations are performed only within the arithmetic unit, thereby ensuring the continuity of mask protection on the read path and effectively resisting differential power analysis attacks.

[0054] When the mask enable of the first mask control field is invalid, the read data channel module can drive only the function data bus 103 to operate, and transmit the read function data back to the arithmetic unit via the data bus 103 corresponding to the function data; at the same time, the read data channel module puts the data bus 103 corresponding to the mask data into an inactive state. The operation of putting the data bus 103 into an inactive state includes, but is not limited to: turning off the clock gating of the mask data bus, disconnecting the drive circuit of the mask data bus, and putting the mask data bus into a high impedance state.

[0055] Through the above explicit inactive state control, even if the mask address is not provided, the mask data bus drive circuit will not generate clock toggles or signal line charging and discharging behavior, thereby eliminating this part of dynamic power consumption and achieving the power management effect of shutting down the mask channel on demand.

[0056] By adopting the above technical solution, the read command channel module can decide whether to generate and provide a mask address based on the indication of the first mask control field; the read data channel module can decide whether to activate the bus corresponding to the mask data based on the indication of the first mask control field. In this way, when the mask is enabled, the read command channel module can provide both the function address and the mask address, and the read data channel module can drive the function data bus and the mask data bus to work simultaneously, ensuring that the function data and mask data remain physically separated throughout the transmission process and are only controlled to be merged within the processing unit. This eliminates the mask protection breakpoint during the reading phase, effectively resists side-channel attacks such as differential power analysis, and ensures the security of cryptographic operations. When the mask is disabled, the read command channel module only provides the function address, the read data channel module only drives the function data bus to work, and explicitly puts the mask data bus in an inactive state, thereby cutting off the dynamic power consumption source of the mask data path, reducing unnecessary energy consumption, and meeting the low power consumption requirements of IoT and automotive-grade chips.

[0057] In some embodiments, the plurality of data buses 103 include a functional data bus and a mask data bus; the read data channel module includes a read data selection unit and a temporary storage unit. The storage unit is connected to the read data selection unit via the temporary storage unit, and the read data selection unit is connected to the arithmetic unit via the functional data bus and the mask data bus.

[0058] In this embodiment, the temporary storage unit can read and store functional data and mask data from the storage unit according to the read address. The read data selection unit can send functional data back to the arithmetic unit via the functional data bus and send mask data back to the arithmetic unit via the mask data bus when the first mask control field is enabled; and send functional data back to the arithmetic unit via the functional data bus when the first mask control field is not enabled.

[0059] In actual execution, after receiving the read address from the read command channel module, the read data channel module's internal temporary storage unit can read the corresponding data from the storage unit according to the read address. Specifically, when the read address contains both a read function address and a read mask address, the temporary storage unit can read the function data from the function RAM and the mask data from the mask RAM respectively, and temporarily store both in its internal register or cache. When the read address only contains the read function address, the temporary storage unit only reads the function data from the function RAM and temporarily stores it.

[0060] Subsequently, the data selection unit can detect the mask enable signal in the first mask control field and control the data output path according to the detection result.

[0061] Specifically, when the first mask control field is enabled, the read data selection unit can transmit the functional data stored in the temporary storage unit back to the arithmetic unit via the functional data bus, and simultaneously transmit the mask data stored in the temporary storage unit back to the arithmetic unit via the mask data bus. The functional data and mask data are carried separately via independent data buses 103 throughout the transmission process. They are not merged within the read data channel module; controlled mask calculations are performed only within the arithmetic unit, thus ensuring the continuity of mask protection along the read path.

[0062] When the first mask control field is detected to be disabled, the read data selection unit can only send the function data stored in the temporary storage unit back to the arithmetic unit through the function data bus; at the same time, the read data selection unit can put the mask data bus into an inactive state.

[0063] By employing the aforementioned technical means, the read data channel module can achieve full separation and back transmission of functional data and mask data when the mask is enabled to ensure security, and explicitly shut down the mask data bus when the mask is disabled to reduce power consumption, thus achieving a dynamic balance between security and power consumption.

[0064] In some embodiments, the operation command includes a write command; the command channel module 101 includes a write command channel module; and the data channel module 102 includes a write data channel module.

[0065] In this embodiment, the write command channel module can receive write commands sent by the arithmetic unit. The write command includes a second address field and a second mask control field.

[0066] The write data channel module can be used to write functional data and mask data into the storage unit through multiple data buses 103 according to the second address field and the second mask control field, or to write functional data into the storage unit through the data bus 103 corresponding to the functional data.

[0067] The second address field includes, but is not limited to, address fields such as function address, mask address, and write length. The second mask control field is used to indicate the write strategy of the mask data in this read operation.

[0068] In actual implementation, after receiving a write command from the arithmetic unit, the write command channel module first parses the write command and extracts the second address field and the second mask control field. Once the second address field is extracted, the write command channel module can generate a write address based on the second mask control field, function address, mask address, write length, and other fields. The write address can include the write function address to be written and the write mask address to be written.

[0069] The functional data and mask data to be written are newly generated by the arithmetic unit during the cryptographic operation and are sent from the arithmetic unit to the storage controller 100 through multiple data buses 103 corresponding to the write data channel module.

[0070] It should be noted that the steps used to generate the write address can be found in the steps used to generate the read address; the specific implementation will not be repeated here.

[0071] Specifically, the write data channel module controls the data writing behavior based on the parsed second mask control field.

[0072] When the second mask control field indicates that the mask is enabled, the write data channel module can simultaneously receive functional data and mask data sent by the arithmetic unit through different data buses 103. Subsequently, the write data channel module can write functional data into the functional RAM area of ​​the storage unit according to the functional address in the second address field; and write mask data into the mask RAM area of ​​the storage unit according to the mask address in the second address field.

[0073] In this process, the functional data and the mask data are carried separately via independent data buses 103 throughout the writing process. The two are not merged within the storage controller 100, thereby ensuring the continuity of mask protection on the writing path.

[0074] When the second mask control field indicates that the mask enable is invalid, the write data channel module only receives the functional data sent by the arithmetic unit through the data bus 103 corresponding to the functional data, and writes it into the functional RAM area of ​​the storage unit according to the functional address in the second address field; the bus corresponding to the mask data does not participate in the write operation, and the write data channel module can put the mask data bus into an inactive state, thereby eliminating the dynamic power consumption of the mask data path and realizing the power management effect of shutting down the mask channel on demand. At this time, the mask address in the second address field is invalid or does not participate in addressing.

[0075] By adopting the above technical solution, the write data channel module, according to the indication of the second mask control field, can ensure the complete separation of functional data and mask data during the writing process to guarantee security when the mask enable is active, and explicitly shut down the mask data bus to reduce power consumption when the mask enable is inactive, thus achieving a dynamic balance between security and power consumption on the write path. This write path and the aforementioned read path form a symmetrical dual-track transmission architecture, jointly ensuring the continuity of mask protection throughout the entire path between the storage controller 100 and the storage unit.

[0076] In some embodiments, the plurality of data buses 103 include a functional data bus and a mask data bus; the write data channel module includes a first buffer for storing functional data and a second buffer for storing mask data. The first buffer is connected to the functional data bus, and the second buffer is connected to the mask data bus.

[0077] In this embodiment, the first buffer can store the functional data sent by the arithmetic unit, and when the write command channel module confirms that the write operation is ready, the functional data is written into the storage unit through the functional data bus; the second buffer can store the mask data sent by the arithmetic unit, and when the write operation is confirmed to be ready and the second mask control field is enabled, the mask data is written into the storage unit through the mask data bus.

[0078] In actual execution, after the arithmetic unit generates new functional data and mask data during cryptographic operations, it can send the functional data to the first buffer of the write data channel module for temporary storage, and send the mask data to the second buffer of the write data channel module for temporary storage. In this case, if the write command channel module confirms that the write operation is ready, it can write the functional data stored in the first buffer into the functional RAM area of ​​the storage unit through the functional data bus.

[0079] In one possible implementation, the write command channel module can confirm that the write operation is ready if the following conditions are met.

[0080] Condition 1: The write command channel module and the arithmetic unit adopt a valid (sender) / ready (receiver) two-way handshake mechanism. The write command is successfully latched only when the valid signal sent by the arithmetic unit is valid and the ready signal of the write command channel module responds.

[0081] Condition 2: After parsing the write command, the write command channel module confirms that the function address in the second address field is valid and points to a writable area in the storage unit. A writable area in the storage unit can mean that the area in the storage unit is not busy or has not experienced a write conflict.

[0082] Condition 3: The write command channel module confirms through an internal handshake signal with the write data channel module that the first buffer has successfully received and temporarily stored the functional data sent by the arithmetic unit.

[0083] In this embodiment, the arithmetic unit can also send a write command through the write command channel module. The write command channel module parses the write command and extracts the second address field and the second mask control field. When the second address field is extracted, the command channel module 101 can generate a write address based on fields such as the second mask control field, function address, mask address, and write length. The write address may include the write function address to be written and the write mask address to be written.

[0084] Specifically, when the write command channel module confirms that the write operation is ready, the write data channel module can write the function data temporarily stored in the first buffer into the function RAM area of ​​the storage unit through the function data bus according to the write function address.

[0085] When the write command channel module confirms that the write operation is ready and the second mask control field indicates that the mask is enabled, the write data channel module can write the mask data temporarily stored in the second buffer into the mask RAM area of ​​the storage unit through the mask data bus according to the write mask address. Among them, the functional data and the mask data are carried through independent data buses throughout the entire writing process, and the two are not merged within the write data channel module 102.

[0086] When the write command channel module confirms that the write operation is ready and the second mask control field indicates that the mask enable is invalid, the write command channel module only generates the write function address based on the function address in the second address field; the mask address does not participate in address generation. The second buffer does not participate in the write operation, and the mask data bus is placed in an inactive state, thereby eliminating dynamic power consumption of the mask data path.

[0087] It should be noted that in a hardware system, generating data, parsing commands, and receiving data often operate on different clock cycles. For example, on the arithmetic unit side, calculations such as polynomial operations and modular arithmetic require multiple clock cycles, and there is an inherent time interval between the production of functional data and mask data. Calculating the address when parsing commands also requires clock cycles, and RAM writing also requires a specific timing window.

[0088] Therefore, without a buffer, the arithmetic unit must strictly follow the order from command parsing completion to storage unit readiness, which can easily lead to write failures due to timing misalignment. By setting up a first / second buffer, the arithmetic unit can send data to the first / second buffer for temporary storage according to its own timing, without waiting for command parsing completion or storage unit readiness. Once the write command channel module confirms that the write operation is ready, the buffer then writes the data according to the timing required by the storage unit. In this way, timing decoupling is achieved on each device side through buffers, allowing each device to work independently according to its own timing.

[0089] In some embodiments, the command channel module 101 further includes an address generation unit.

[0090] In this embodiment, the address generation unit can receive operation commands sent by the arithmetic unit. These operation commands include an address field, a step size field, a data parallelism field, and a mask control field. The operation commands include the read and write commands described in the previous embodiments. The address field includes the first address field and the second address field described in the previous embodiments, and the mask control field includes the first mask control field and the second mask control field described in the previous embodiments.

[0091] After parsing the operation command, the address generation unit can generate a functional data address sequence and a mask data address sequence that match the current operation based on the address field, step size field, data parallelism field, and mask control field. The functional data address sequence is used to characterize the access address of the functional data in the storage unit; the mask data address sequence is used to characterize the access address of the mask data in the storage unit.

[0092] In actual execution, after receiving the operation command sent by the arithmetic unit, the address generation unit first parses the operation command and extracts the address field, step field, data parallelism field, and mask control field. The address field includes the functional base address and the mask base address (when the mask is enabled); the step field indicates the address increment interval for continuous access; the data parallelism field indicates the number of parallel addresses output in a single address generation operation; and the mask control field contains the mask enable signal.

[0093] When the mask enable signal is active, the address generation unit can generate a functional data address sequence and a mask data address sequence based on the functional base address and mask base address in the address field, combined with the step size in the step size field and the parallelism in the data parallelism field. The generated functional data address sequence and mask data address sequence are strictly one-to-one corresponding in sequence number to ensure the pairing relationship between functional data and mask data in the memory unit.

[0094] When the mask enable signal is disabled, the address generation unit generates only the functional data address sequence, starting from the functional base address in the address field and combining the step size field and the data parallelism field; the mask address does not participate in address generation, and the mask data address sequence is empty. The address generation unit transmits the functional data address sequence to the data channel module 102, and simultaneously notifies the data channel module 102 of the mask enable invalid signal.

[0095] Using the above technical solution, the address generation unit can flexibly generate functional data address sequences and mask data address sequences that match the current operation based on the address field, step size field, data parallelism field and mask control field in the operation command, providing accurate addressing basis for the separate parallel access of the data channel module 102. At the same time, dynamic mask management at the address generation level is realized through the control of the mask enable signal.

[0096] In some embodiments, the operation command further includes a mode selection field.

[0097] In this embodiment, the address generation unit can also determine the addressing mode used when executing the operation command based on the mode selection field, and generate a functional data address sequence and a mask data address sequence that match the current operation based on the address field, step size field, and data parallelism field.

[0098] The mode selection field indicates the addressing mode used by the address generation unit when executing the current operation command. Different addressing modes correspond to different address generation rules; the addressing modes include one of the following: byte stream addressing mode, polynomial dual-address parallel addressing mode, and polynomial single-address addressing mode.

[0099] Specifically, the address generation unit can determine one of the following addressing modes based on the value of the mode selection field, and generate a functional data address sequence and a mask data address sequence based on the selected mode.

[0100] Mode 1: Byte stream addressing mode.

[0101] In this mode, the address generation unit generates an address sequence in a continuously increasing manner. Functional data addresses start from the functional base address and continuously increase at intervals equal to the step size in the step field; mask data addresses start from the mask base address and continuously increase at the same step size. This mode is suitable for scenarios involving sequential access to contiguous storage areas within a storage unit, such as the continuous reading and writing of intermediate results from hash operations.

[0102] Mode 2: Polynomial dual-address parallel addressing mode.

[0103] In this mode, the address generation unit simultaneously generates two independent address sequences, each corresponding to a different set of polynomial coefficients. For example, in the NTT (Number Theoretic Transform) of the Kyber algorithm (CRYSTALS-Kyber, a lattice-based key encapsulation mechanism algorithm), data needs to be read from two different polynomial coefficient arrays simultaneously for butterfly operations. The address generation unit generates two sets of address sequences in parallel based on the first and second functional base addresses (or a variant of functional base address and mask base address) in the address field, combined with the step size field and the data parallelism field. The two sets of address sequences are output synchronously in time to meet the requirements of parallel operations on two operands.

[0104] Mode 3: Polynomial single-address addressing mode.

[0105] In this mode, the address generation unit generates only one set of address sequences for accessing a single polynomial coefficient array. The function data address starts from the function base address and increments by the step size specified in the step field. When the mask is enabled, the mask data address starts from the mask base address, increments by the same step size, and corresponds one-to-one with the function data address. This mode is suitable for scenarios requiring sequential traversal or step-size-based access to single polynomial coefficients, such as polynomial coefficient scanning in the Dilithium algorithm (CRYSTALS-Dilithium, a post-quantum digital signature algorithm based on modular lattice cryptography).

[0106] It should be noted that, regardless of the addressing mode used, the address generation unit determines whether to generate a mask data address sequence based on the mask enable signal in the mask control field. When the mask enable is active, both the functional data address sequence and the mask data address sequence are generated simultaneously in the selected addressing mode; when the mask enable is inactive, only the functional data address sequence is generated, and the mask data address sequence is empty.

[0107] By adopting the above technical solution and introducing a mode selection field, the address generation unit can flexibly switch addressing modes according to the memory access characteristics of different post-quantum cryptography algorithms. Under a unified address generation architecture, it supports various memory access scenarios such as byte stream, polynomial dual-address parallel, and polynomial single-address, which can improve the versatility and adaptability of the storage controller 100.

[0108] In some embodiments, the command channel module 101 further includes a reordering unit. The reordering unit can apply the same random offset to each address in the function data address sequence and mask data address sequence generated by the address generation unit to obtain the offset function data address sequence and the offset mask data address sequence.

[0109] When the offset access address reaches the upper limit of the preset address, the subsequent access address is looped back to the initial functional data address and the initial mask data address to generate the final offset address sequence. The data channel module 102 then accesses the storage unit incrementally according to the final offset address sequence until all memory access operations are completed.

[0110] In this embodiment, the out-of-order unit can perform synchronous out-of-order processing on the functional data address sequence and mask data address sequence output by the address generation unit, so as to increase the unpredictability of the actual access address of the memory unit without destroying the pairing relationship between functional data and mask data, thereby enhancing the resistance to side-channel attacks such as differential power analysis.

[0111] Specifically, the out-of-order unit can perform synchronous out-of-order processing on the functional data address sequence and mask data address sequence output by the address generation unit through the following steps.

[0112] S1. Get the random offset.

[0113] The out-of-order unit can obtain a random offset from a random source device. This random offset can remain constant during a single memory access operation or the processing of a batch of address sequences to ensure the synchronous offset between the functional data address and the mask data address.

[0114] S2. Apply the same random offset to obtain the address after offset.

[0115] The out-of-order unit applies the same random offset to each functional data address in the functional data address sequence and its corresponding mask data address in the mask data address sequence to obtain the offset address. Each element in the offset functional data address sequence and the offset mask data address sequence still maintains a strict one-to-one correspondence, and the pairing relationship between functional data and mask data is completely preserved after the offset.

[0116] Having obtained the offset functional data address sequence and the offset mask data address sequence, the data channel module 102 can access memory units sequentially according to the offset address sequence. During access, the data channel module 102 reads or writes functional data from the memory location indicated by the offset functional data address sequence via the functional data bus; when the mask is enabled, the data channel module 102 simultaneously reads or writes mask data from the memory location indicated by the offset mask data address sequence via the mask data bus. The functional data and mask data are carried separately via independent data buses throughout the transmission process, and the two are not merged.

[0117] Since the elements in the offset functional data address sequence and the offset mask data address sequence are strictly one-to-one, the data channel module 102 synchronously accesses the paired functional data address and mask data address through two data buses in each memory access operation, ensuring that the pairing relationship between functional data and mask data in the storage unit can still be correctly matched after the out-of-order offset.

[0118] During the process of data channel module 102 accessing data in ascending order of the address sequence after offset, the out-of-order unit can monitor in real time whether the current access address has reached the preset address upper bound. The preset address upper bound can be determined by the address space range of the storage unit and the offset, ensuring that the offset address does not access data areas in the storage unit that do not belong to the current operation.

[0119] When the access address reaches or exceeds the preset upper bound, the out-of-order unit loops the subsequent access address back to the initial functional data address and the initial mask data address (i.e., the base address before offset), and continues to execute the remaining memory access operations. Specifically, if the current offset functional data address exceeds the upper bound, the next access address loops back to the initial functional data address; at the same time, the corresponding offset mask data address also loops back to the initial mask data address; after looping back, a random offset is applied again (or a new random offset is obtained by the out-of-order unit in the next memory access operation), and access continues according to the offset address sequence.

[0120] The data channel module 102 can repeat the above process until all memory access operations corresponding to the current operation command are completed (i.e., all data entries to be accessed have been processed).

[0121] By employing the above technical solution, the out-of-order unit and data channel module 102 can further achieve synchronous out-of-order reordering of dual-track addresses based on the paired address sequence generated by the address generation unit, using the same random offset. This ensures both the paired access relationship of functional data and mask data in the storage unit and makes the actual physical access address exhibit randomized characteristics, increasing the difficulty of side-channel attacks. Simultaneously, through preset address upper bound checks and loopback mechanisms, it is ensured that out-of-order access will not exceed the bounds, guaranteeing the security and correctness of storage access.

[0122] In some embodiments, the command channel module 101 includes a counter unit; the counter unit includes an increment counter, a decrement counter, and a comparator.

[0123] In this embodiment, for each batch of address access operations completed in the functional data address sequence and the mask data address sequence, the increment counter can increase the count value according to the parallelism field in the current operation command; the decrement counter can set the initial value of the count value to the length field in the operation command, and decrease the count value according to the parallelism field after each batch of address access operations is completed; and at the end of the operation command execution, the count values ​​of the increment counter and the decrement counter are compared by a comparator, and an alarm message is output according to the comparison result.

[0124] The alarm information is used to instruct the security monitoring unit to perform at least one of the following protective measures: erasing the key, resetting the operation, or reporting the abnormal status.

[0125] In actual implementation, when the command channel module 101 receives an operation command sent by the arithmetic unit, the counter unit can obtain the length field, which represents the total number of data entries to be accessed in this operation, and the parallelism field, which represents the number of parallel addresses processed in each batch of address access operations. The decrement counter can set the initial value of the count value to the value of the length field; and the increment counter can be cleared to zero.

[0126] During the process of the address generation unit generating the address sequence and the data channel module 102 performing memory access, whenever the data channel module 102 completes a batch of address access operations, that is, completes a set of parallel address accesses according to the number of parallelism fields, the counter unit triggers a count update.

[0127] Specifically, the increment counter increases the count value according to the parallelism field in the current operation command, recording the total number of address accesses that have been completed; the decrement counter decreases the count value according to the parallelism field, recording the total number of address accesses that remain to be completed.

[0128] After the data channel module 102 completes all memory access operations corresponding to this operation command, the comparator compares the current count values ​​of the increment counter and the decrement counter. If the count value of the increment counter is equal to the initial value of the decrement counter (i.e., the value of the length field), and the count value of the decrement counter is zero, it indicates that all the planned address accesses in this operation have been completed as expected, without any omissions or duplicate accesses, and the comparator outputs a normal status signal. If the count value of the increment counter does not match the initial value of the decrement counter, or the decrement counter is not zero, it indicates that an anomaly occurred during the execution of this operation, such as an address access omission, duplicate access, premature termination, or being subjected to a fault injection attack. In this case, the comparator can output an alarm message.

[0129] Alarm information can be sent to the security monitoring unit. Upon receiving the alarm information, the security monitoring unit will execute at least one of the following protective measures: Key erasure: Clears sensitive key data stored in the storage unit to prevent key leakage; Reset operation: Performs a reset operation on the cryptographic operation acceleration chip or related modules to terminate the current abnormal operation process; Reporting abnormal status: Report abnormal events to the host or security management system outside the chip and record fault logs.

[0130] The incrementing counter, decrementing counter, and comparator in the counter unit enable real-time monitoring and integrity verification of the memory access operation's progress. When the operation executes normally, the comparison results of the incrementing and decrementing counters are consistent, indicating that the address access was completed as expected. When the operation is subjected to a fault injection attack or an unexpected interruption occurs, the comparison results are inconsistent, triggering an alarm and executing security protection measures to enhance the storage controller's ability to detect and protect against fault injection attacks.

[0131] Based on the foregoing embodiments, this application provides a memory access control method, which can be applied to the memory controller of any of the foregoing embodiments, such as... Figure 2 As shown, the storage controller includes a command channel module and a data channel module, and the data channel module includes multiple data buses; the method includes the following steps.

[0132] Step S101: Receive operation commands sent by the arithmetic unit through the command channel module; Step S102: Determine the function data and mask data corresponding to the operation command through the data channel module; wherein, the mask data is random data that is masked to protect the function data; In step S103, functional data and mask data are transmitted through multiple data buses in the data channel module to write functional data and mask data into the storage unit or to send functional data and mask data back to the processing unit.

[0133] In some embodiments, the operation command includes a read command, which includes a first address field and a first mask control field; step S102 may include: reading functional data and mask data from the storage unit according to the first address field; step S103 may include: sending functional data and mask data to the arithmetic unit through multiple data buses according to the first mask control field, or sending functional data to the arithmetic unit through a data bus corresponding to the functional data.

[0134] In some embodiments, the plurality of data buses include a function data bus and a mask data bus; step S103 may include: when the first mask control field is detected to be enabled, transmitting function data back to the arithmetic unit via the function data bus and transmitting mask data back to the arithmetic unit via the mask data bus; when the first mask control field is detected to be disabled, transmitting function data back to the arithmetic unit via the function data bus.

[0135] In some embodiments, the operation command includes a write command; the write command includes a second address field and a second mask control field; the plurality of data buses include a function data bus and a mask data bus; step S103 may include: when the write operation is valid and the second mask control field is not enabled, writing function data to the storage unit via the function data bus according to the second address field; when the write operation is valid and the second mask control field is enabled, writing function data to the storage unit via the function data bus according to the second address field, and writing mask data to the storage unit via the mask data bus.

[0136] In some embodiments, the operation command includes a read command, which further includes a step size field and a data parallelism field; step S102 may include: generating a functional data address sequence and a mask data address sequence that match the current operation based on the first address field, the step size field, and the data parallelism field; reading functional data from each functional data address in the functional data address sequence; and reading mask data from each mask data address in the mask data address sequence.

[0137] In some embodiments, the operation command further includes a mode selection field, and step S102 may include: determining the addressing mode used when executing the operation command according to the mode selection field; wherein the addressing mode includes one of byte stream addressing mode, polynomial dual-address parallel addressing mode, and polynomial single-address addressing mode; and generating a functional data address sequence and a mask data address sequence that match the current operation based on the addressing mode used, according to the address field, step field, and data parallelism field.

[0138] The following describes the application of the storage controller provided in the embodiments of this application in a real-world scenario, mainly involving a post-quantum cryptographic storage controller that supports multi-mode memory access and runtime security protection.

[0139] In post-quantum cryptography hardware implementations, cryptographic acceleration chips simultaneously generate functional data and mask data when executing core algorithms such as polynomial operations, modular arithmetic, and hashing. The real key and sensitive intermediate values ​​are decomposed into multiple shares, including functional data and mask data, neither of which reflects the actual sensitive information individually. After being generated internally, these two types of data are written to their respective storage areas. During subsequent cryptographic operations, the chip synchronously reads the functional data and mask data from storage, pairs them, and sends them into the computation path to perform mask-protected cryptographic operations.

[0140] Currently, several hardware acceleration schemes for post-quantum cryptography have been proposed. One implementation employs a unified memory design containing dedicated arithmetic logic units, which can accelerate polynomial operations in the Kyber and Dilithium algorithms. Its memory system uses a generic address generation method and improves data throughput through a ping-pong buffer mechanism. However, this scheme lacks hardware-level masking protection for memory accesses and does not integrate address reordering or fault injection detection mechanisms.

[0141] In another implementation, a dual physically isolated memory architecture can be used, with data access controlled by memory selection instructions within the instruction set architecture. In this approach, the two memories are primarily used for functional and performance partitioning, rather than for separating functional data from mask data for mask security purposes. Furthermore, this approach lacks a configurable multi-mode addressing mechanism at the memory controller level, making it difficult to flexibly adapt to the diverse memory access mode requirements of different post-quantum cryptography algorithms.

[0142] In summary, existing post-quantum cryptography hardware solutions have a single memory access mode, which cannot flexibly adapt to the needs of multi-stage algorithms; mask protection has breakpoints at the storage and transportation levels; address reordering schemes have not been adapted for lightweight cryptographic operations and have not guaranteed consistency between read / write and function / mask linkage; fault injection detection schemes have high hardware overhead and are not suitable for embedded post-quantum cryptography scenarios; and there is a lack of a solution that integrates diverse memory access methods with multi-layered security protection.

[0143] To address the aforementioned technical problems, this application proposes a post-quantum cryptography storage controller that supports multi-mode memory access and runtime security protection. This storage controller can flexibly adapt to the heterogeneous memory access requirements of each stage of post-quantum cryptography with unified hardware; it can achieve end-to-end hardware-level separation of functional / mask data from storage to computation, and dynamically control the working state of the mask channel through the mask enable field; it provides real-time detection of address out-of-order side-channeling and fault injection with lightweight circuitry; and it can organically integrate multi-mode architecture and multi-layered security mechanisms within a single controller.

[0144] The following describes the application scenarios of the storage controller proposed in the embodiments of this application.

[0145] Application Scenario 1: Financial security terminal equipment.

[0146] In devices such as financial POS machines, ATMs, and hardware wallets, the storage controller proposed in this application can serve as the core storage control unit of a post-quantum cryptography coprocessor. During the key generation phase, the pseudo-random number sequence output by the sampler is efficiently accessed through a byte stream mode, and the private key generation process is protected by a masked channel separation. During the signature / decryption operation phase, a polynomial dual-address mode provides conflict-free parallel access to the two operands for NTT butterfly operations, and an address reordering mechanism prevents side-channel attacks. Dual counters are used for real-time fault injection detection. During insecure operation phases, the masked data channel is disabled through a mask enable field, reducing power consumption during standby or non-sensitive operations.

[0147] Application Scenario 2: 5G / 6G communication base station security gateway.

[0148] Communication base stations need to handle massive amounts of authentication and key negotiation requests from terminal devices, placing extremely high demands on the throughput and security of cryptographic operations. The storage controller proposed in this application achieves unified scheduling across different algorithm stages such as sampling, NTT transformation, and polynomial multiplication through a multi-mode addressing mechanism, avoiding the need for multiple independent controllers. By separating functional data and mask data throughout the transmission process, it ensures that the base station can resist side-channel attacks even in physically uncontrolled deployment scenarios. Furthermore, a dual-counter verification mechanism detects fault injection attacks in real time, ensuring the security of the communication network.

[0149] Application Scenario 3: Vehicle-to-Everything (V2X) security chips.

[0150] The onboard communication unit of intelligent connected vehicles needs to execute V2X digital signatures. Given the long lifespan of vehicles, resistance to quantum computing attacks must be considered during the design phase. The storage controller proposed in this application covers the memory access requirements of all post-quantum cryptographic algorithms with a unified single-controller architecture, reducing chip area and lowering the manufacturing cost of automotive-grade chips. It dynamically disables the mask channel through a mask enable field, reducing standby power consumption. Furthermore, by integrating address reordering, fault injection detection, and end-to-end mask separation protection, it achieves multi-dimensional security protection within a limited area.

[0151] In this embodiment, the storage controller can be implemented inside a post-quantum cryptography hardware accelerator or a secure SoC chip, serving as a dedicated storage control module connecting upper-layer polynomial operation units (such as butterfly operators, samplers, coefficient multipliers) and lower-layer physical storage (such as static random access memory, block random access memory).

[0152] like Figure 3As shown, the post-quantum algorithm chip may include a central processing unit core 301, direct memory 302, a post-quantum cryptography accelerator 303, physical memory banks 304 (block static random access memory 0 and block static random access memory 1), and a memory controller 100 as proposed in this embodiment. The post-quantum cryptography accelerator is connected to the memory controller via read channels (including read command channels and read data channels) and write channels (including write command channels and write data channels). The memory controller is connected to the two physical memory banks via an address bus and a data bus.

[0153] like Figure 4 As shown, Figure 4 This is a block diagram of the internal architecture of a storage controller provided in an embodiment of this application. It consists of a read command channel, a write command channel, a read data channel, a write data channel, and various internal sub-modules.

[0154] The storage controller proposed in this application embodiment can achieve flexible switching of multiple memory access modes through a unified hardware architecture and a configurable command interface, and realize hardware-level isolation transmission of functional data and mask data at the data channel level. It can also optionally integrate runtime security mechanisms such as address reordering and fault injection detection.

[0155] In this embodiment, the read command channel is used by the arithmetic unit to initiate a read operation request to the memory controller. This channel employs a valid / ready bidirectional handshake mechanism to transmit control information such as read length, addressing mode, step size, parallelism, and mask enable, as well as the function address and mask address. When mask enable is valid, both the function address and mask address are provided; when mask enable is invalid, only the function address is valid.

[0156] The relevant signals for reading commands can be represented by Table 1 below.

[0157] Table 1 Read Command Signal Table

[0158] In this embodiment, the read command channel is used by the arithmetic unit to initiate a write operation request to the memory controller. The relevant signals for the write command can be represented by Table 2 below.

[0159] Table 2 Write Command Signal Table

[0160] In this embodiment, the read data channel is used by the storage controller to return read data to the upper-layer processing unit. This channel includes two physically independent data buses: a function data bus (o_rdata) and a mask data bus (o_rdata_mask). When the mask is enabled, both buses operate simultaneously, outputting function data and mask data in parallel; when the mask is disabled, only the function data bus operates, and the mask data bus is inactive. The channel employs a valid / ready / last handshake mechanism, where o_rdata_last identifies the end of a read transfer.

[0161] The relevant signals for the read data channel can be represented by Table 3 below.

[0162] Table 3 Data Reading Signal Table

[0163] In this embodiment, the data channel is used by the upper-layer processing unit to send data to be written to the storage controller. This channel is symmetrical to the read data channel and includes two physically independent data buses: a functional data bus (i_wdata) and a mask data bus (i_wdata_mask). When the mask is enabled, both buses operate simultaneously, with functional data and mask data input in parallel; when the mask is disabled, only the functional data bus operates, and the mask data bus input is ignored. The channel employs a valid / ready / last handshake mechanism, with i_wdata_last used to identify the end of a write transfer.

[0164] The relevant signals for writing data channels can be represented by Table 4 below.

[0165] Table 4 Write Data Signal Table

[0166] In this embodiment, it also includes an address reordering enable signal, which enables lightweight address reordering when set to 1; and a fault injection alarm signal, which is pulled high when the dual counter verification is abnormal.

[0167] The read / write command channel in this embodiment also includes an address generation unit. The address generation unit can switch between three different address generation methods online according to the mode selection field (i_rctrl_mode / i_wctrl_mode).

[0168] Mode 0 is a byte stream addressing mode, used for scenarios requiring linear, continuous access, such as SHAKE sampling and key packaging. Its address generation rule starts from address addr0 and increments by the interval each time, continuously generating an address sequence corresponding to length len. In insecure mode, only addr0 is used to generate the functional address sequence; in secure mode, two sets of address sequences are generated simultaneously: a functional address sequence starting from addr0 and a mask address sequence starting from addr0_mask, with the offsets of the two sets of address sequences always remaining consistent.

[0169] Mode 1 is a polynomial dual-address parallel addressing mode, used in scenarios such as NTT butterfly operations that require simultaneous reading of two operands. In non-secure mode, two independent addresses, addr0 and addr1, are generated simultaneously in each clock cycle. These two addresses are guaranteed to be mapped to two different physical memory banks through a Hamming weight parity mapping mechanism, achieving conflict-free parallel access. In secure mode, a time-domain time-division multiplexing strategy is adopted: the first clock cycle generates a functional address pair (addr0, addr1), which is mapped to two different memory banks, and two functional data are written or read simultaneously; the second clock cycle generates a mask address pair (addr0_mask, addr1_mask), which is mapped to two different memory banks, and two mask data are written or read simultaneously. The functional data pair and the mask data pair are input or output from independent physical channels in a time-division multiplexing manner, ensuring that they never appear on the internal data path at the same time.

[0170] Mode 2 is a polynomial single-address addressing mode, used for coefficient-wise operations such as modular multiplication, modular addition, and coefficient scaling, which require only a single operand. In non-safe mode, a function address addr0 is generated each cycle; in safe mode, both function address addr0 and mask address addr0_mask are generated each cycle. Both are also mapped to different memory banks through Hamming weight parity mapping and are read in parallel within the same cycle.

[0171] The address generation unit also receives a parallelism configuration signal to control the amount of data transferred in parallel within a single clock cycle, enabling flexible and configurable batch memory access. The data interface bus width determines the maximum parallelism supported by the hardware. In this embodiment, the data bus width is OSR_PQC_RAM_DATA_WD × 2, meaning that a maximum of 4 operands can be accommodated per cycle. The parallelism configuration value must not exceed this hardware limit. The behavior of parallelism differs across modes: In byte stream mode, the parallelism configuration value determines the number of words read or written in a single cycle. For example, with a parallelism of 4, a cycle simultaneously moves four words (addr0, addr0+1, addr0+2, and addr0+3) starting from address addr0. In safe mode, the mask address addr0_mask performs the same batch movement with the same parallelism. In polynomial dual-address mode, the parallelism configuration value determines the number of operand pairs moved in parallel within a single cycle. For example, with a parallelism of 2, a cycle moves two consecutive operands each for addr0 and addr1, totaling four operands. In polynomial single-address mode, the parallelism configuration value determines the number of operands moved in a single cycle. For example, with a parallelism of 4, a cycle moves four consecutive operands starting from addr0. In safe mode, the mask address addr0_mask performs the same movement with the same parallelism.

[0172] When the parallelism is greater than 1 and the step size is configured, multiple operands within the same cycle are moved sequentially by address, while the starting address of the next cycle jumps by the step size. For example, in polynomial dual-address mode, with a parallelism of 2 and a step size of 4, in the first cycle, addr0 channel moves operands 0 and 1, and addr1 channel moves operands 0 and 1; in the second cycle, addr0 channel moves operands 4 and 5, and addr1 channel moves operands 4 and 5. This combination configuration allows the controller to flexibly adapt to the access requirements of different butterfly distance stages of NTT, enabling parallel movement of batch data with a single command, significantly reducing command overhead and access latency.

[0173] In this embodiment, the read data channel and the write data channel respectively implement dynamic enable control of the mask channel, ensuring that the functional data and the mask data are always transmitted through their own independent physical channels throughout the entire storage and transportation chain, without any merging operation inside the storage controller, thereby eliminating mask protection breakpoints.

[0174] The read data channel includes a shift_reg_fifo (i.e., the temporary storage unit in the above embodiment), a read data selection module, and a read function data bus and a read mask data bus. The shift_reg_fifo is used to temporarily store data read from the two RAMs. The read data selection module, based on the current addressing mode and the read data channel's mask enable signal Rd_mask_en, splits the data and sends it to the read function data bus and read mask data bus respectively. When Rd_mask_en is 1, the read function data bus and read mask data bus operate simultaneously. The function data and mask data read from the memory are output to the upstream computing unit in parallel via o_rdata and o_rdata_mask, respectively. Their handshake signals valid / ready remain synchronized, ensuring that the function data and mask data arrive at the downstream computing unit at the same time. When Rd_mask_en is 0, only the read function data bus operates, and the read mask data bus is inactive, with its output always being 0.

[0175] The write data channel includes a write function data bus, a write mask data bus, a write function data buffer (i.e., the first buffer in the above embodiment), and a write mask data buffer (i.e., the second buffer in the above embodiment). The write function data buffer and the write mask data buffer are used to temporarily store data on the write function data bus and the write mask data bus, respectively, and then send them into memory. When Wr_mask_en is 1, the write function data bus and the write mask data bus work simultaneously. The upstream arithmetic unit inputs the function data and mask data in parallel through i_wdata and i_wdata_mask, respectively, and the controller writes them into the function address and mask address of the memory, respectively. When Wr_mask_en is 0, only the write function data bus works, and the mask data bus input is ignored.

[0176] Through the above technical solution, functional data and mask data, after being read from the physical storage, are transmitted through their respective independent physical channels until they reach the upper-layer polynomial arithmetic unit. No merging operation is performed within the storage controller, ensuring an uninterrupted mask protection chain throughout the entire storage and transport process. Simultaneously, the mask_en field enables dynamic hardware-level control of the mask channels. Dual channels are activated to ensure security when mask protection is needed, and the mask channels are deactivated to reduce power consumption when mask protection is not required, thus balancing security and flexibility.

[0177] In this embodiment, the read / write address reordering module (i.e., the reordering unit in the above embodiment) can be used as one of the optional integrated runtime security protection mechanisms to combat side-channel attacks that observe the address access sequence. The module's outordering function is enabled by the external input port shuffle_lite_en: when shuffle_lite_en is 1, the reordering function is enabled; when shuffle_lite_en is 0, the address is directly passed through without reordering.

[0178] The out-of-order execution process is as follows: First, each time the shuffle_lite_en signal changes from 0 to 1 (i.e., a new out-of-order memory access batch is initiated), the module obtains a random number R from the hardware random number generator. Then, the original starting address addr0 provided by the operator is added to the random number R to obtain the actual starting address after offset, addr_start = addr0 + R. For function addresses and mask addresses, the same random offset is applied, i.e., the offset starting address of addr0_mask = addr0_mask + R. Next, starting from the actual starting address after offset, the subsequent addresses are generated sequentially according to the jump step size and parallelism determined by the address generation unit, and data read and write operations are performed normally. When the address increment reaches the upper bound (the upper bound is calculated based on the original starting address addr0 and the length len), the address generator automatically loops back to the original starting address addr0, and continues to increment the access from addr0 until all memory access operations specified by the length len are completed.

[0179] To ensure data integrity, for the same batch of data, read and write operations are subject to the exact same random offset R, ensuring that the address sequence during writing and the address sequence during reading maintain a one-to-one relative order even after being out of order. When both function addresses and mask addresses exist, they are both subject to the exact same random offset R, preserving the correspondence between function data and mask data after being out of order.

[0180] With the above technical solution, even if an attacker can observe the access address sequence of the physical memory, the starting offset R of each memory access batch is random, and the observed address sequence loses its predictable correspondence with the actual operation order within the algorithm, making it impossible to deduce the operation pattern from the address sequence. This solution only requires one adder and one comparator for upper bound judgment, with minimal hardware cost, making it a lightweight protection mechanism against side-channel attacks.

[0181] In this embodiment, the dual-counter verification module (i.e., the counter unit in the above embodiment) serves as an optional integrated runtime security protection mechanism, used to detect abnormal memory access operation counts caused by fault injection attacks (such as clock glitches and voltage glitches) in real time. The module contains two counters: an increment counter (inc_cnt) and a decrement counter (dec_cnt). The increment counter is initially set to 0 and increases the parallelism (parallel) after each valid data transfer operation. The decrement counter is initially set to the length (len) of the current memory access command and decreases the parallelism (parallel) after each valid data transfer operation.

[0182] The workflow is as follows: Upon receiving a new memory access command, the length information `len` is sent to the dual-counter verification module. The module resets the increment counter to zero and sets the decrement counter to `len`, at which point the sum of the two equals `len`. During memory access, each time the read or write data channel completes a valid data transfer (i.e., a successful valid / ready handshake), it sends an operation completion pulse to the dual-counter verification module. The increment counter increments `paralle` upon receiving the pulse, and the decrement counter decrements `paralle` upon receiving the pulse. The hardware calculates the sum of `inc_cnt` and `dec_cnt` in real time and compares it with `len`. Under normal circumstances, `inc_cnt` is incremented by `paralle` and `dec_cnt` is decremented by `paralle` in each operation, and their sum always equals `len`, without triggering an alarm. If an attacker injects a clock glitch that causes a data transfer to be skipped, `inc_cnt` will be incremented by `paralle` less than expected, while `dec_cnt` will still be decremented normally. In this case, the sum of `inc_cnt` and `dec_cnt` will be less than `len`, triggering an alarm. If an attacker injects a bug that causes a data transmission to be executed repeatedly, then `inc_cnt` will have `paralle` added while `dec_cnt` will only have `paralle` subtracted. In this case, the sum of the two will exceed `len`, triggering an alarm. When the module detects that the sum deviates from `len`, it will pull the alarm signal high and output it to the chip's security monitoring unit. The security monitoring unit can then take protective measures based on the alarm, such as erasing the key, resetting the operation, or reporting the abnormal state.

[0183] This scheme requires only two counters and one comparator, with minimal hardware overhead, yet it can achieve real-time integrity verification for every memory access operation. Any fault injection attack that attempts to change the number of operations through clock or voltage glitches will be detected immediately.

[0184] Compared with the prior art, the storage controller proposed in this application has the following advantages: At the hardware architecture level, the storage controller proposed in this application enables the same set of storage controller hardware to switch online between byte stream addressing mode, polynomial dual-address parallel addressing mode, and polynomial single-address addressing mode through a mode selection field in a single command interface, covering all memory access scenarios of post-quantum cryptography algorithms from sampling and transformation to coefficient operation. Compared with the existing technology that requires multiple independent storage controllers or DMA modules to handle different operation stages separately, the storage controller proposed in this application does not require the deployment of multiple independent controllers for different algorithm stages, significantly reducing chip area and simplifying system integration complexity.

[0185] Regarding mask protection, the storage controller proposed in this application sets up physically independent functional data buses and mask data buses in the read data channel and write data channel, respectively. When the mask is enabled, the functional data and mask data are read from the physical storage and transmitted in parallel through their respective independent physical channels until they reach the upper-layer polynomial operation unit, without any merging operation within the storage controller. Compared to the prior art where functional values ​​and mask values ​​are usually merged within the storage controller or at the interface, the mask protection chain of the storage controller proposed in this application has no breaks in the entire storage and transportation chain, effectively improving the resistance to side-channel attacks. Based on this, the storage controller proposed in this application implements hardware-level dynamic enable control of the mask channel through the mask enable field: in secure mode, the functional data channel and mask data channel work simultaneously to ensure the integrity of mask protection; in insecure mode, the mask data channel is inactive, and only the functional data channel works, effectively reducing dynamic power consumption in insecure operation scenarios. This mechanism enables the controller to flexibly adjust power consumption strategies based on the security level of the computation content, making it particularly suitable for power-sensitive IoT terminals and automotive-grade chip applications.

[0186] Regarding memory access flexibility, the storage controller proposed in this application introduces a configurable parallelism parameter, allowing upper-layer operators to flexibly configure the number of operands moved per cycle within the upper limit of the hardware bus width, based on the computational parallelism of the current operation stage. Semantic adaptation of parallelism is automatic in different modes: a maximum of 4 operands per cycle is supported in byte stream mode and single-address mode, while a maximum of 8 operands per cycle is supported for both channels in dual-address mode. Parallelism and step size work together, enabling the controller to initiate the skip-type transfer of batch data with a single command, significantly reducing command overhead and improving bus bandwidth utilization.

[0187] Regarding security mechanisms, the storage controller proposed in this application provides an optional lightweight address reordering mechanism. This mechanism scrambles the memory access sequence by randomly offsetting the starting address, incrementing to the upper address bound, and then looping back. This scheme requires only one adder and one comparator, resulting in minimal hardware overhead. Simultaneously, by ensuring that read and write operations apply the same offset, and that the function address and mask address apply the same offset, the data correspondence is preserved while the address sequence is scrambled. Each memory access batch uses a different random offset, preventing attackers from deducing internal operational patterns by observing the physical address sequence. Furthermore, the storage controller proposed in this application also provides an optional dual-counter verification mechanism. Requiring only two counters and one comparator, it enables real-time integrity verification of each memory access operation. By setting the initial sum of the incrementing and decrementing counters to equal the memory access length, incrementing and decrementing the counters after each operation, and monitoring in real-time whether the sum deviates from the length value, any single operation loss or duplication caused by clock or voltage glitches can be detected immediately and trigger an alarm. This approach minimizes hardware overhead and is suitable for resource-constrained embedded post-quantum cryptography applications.

[0188] Finally, the storage controller proposed in this application integrates a multi-mode memory access architecture, separate transmission channels for functional data and mask data, dynamic enable control of mask channels, address out-of-order anti-side-channel mechanism, and dual-counter fault injection detection mechanism into a single storage controller. Each security mechanism shares command parsing and memory access control logic, resulting in minimal hardware overhead. Furthermore, it allows for flexible enabling or disabling of functional modules based on the security level of the application scenario, providing multi-layered, in-depth protection capabilities from the architecture layer to runtime.

[0189] This application also proposes a chip that includes the memory controller described in the above embodiments.

[0190] It should be noted that the descriptions of the various embodiments above tend to emphasize the differences between them, while their similarities or commonalities can be referred to interchangeably. The descriptions of the above embodiments of the device, storage medium, computer program, and computer program product are similar to the descriptions of the above method embodiments and have similar beneficial effects. For technical details not disclosed in the embodiments of the device, storage medium, computer program, and computer program product of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0191] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above steps / processes do not imply a sequential order of execution; the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above embodiments of this application are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0192] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0193] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0194] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0195] Furthermore, in the various embodiments of this application, all functional units can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units. Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0196] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, magnetic disks, or optical disks.

[0197] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A storage controller, characterized in that, The storage controller includes a command channel module and a data channel module. The data channel module includes a functional data bus and a mask data bus. The command channel module is used to receive operation commands sent by the computing unit; The data channel module is used to determine the functional data and mask data corresponding to the operation command; and to transmit the functional data through the functional data bus and the mask data through the mask data bus, so as to write the functional data and the mask data into the storage unit, or to send the functional data and the mask data back to the computing unit; the mask data is random data that masks and protects the functional data. The operation command includes a read command; the command channel module includes a read command channel module; the data channel module includes a read data channel module; the read data channel module includes a read data selection unit and a temporary storage unit; the storage unit is connected to the read data selection unit through the temporary storage unit; and the read data selection unit is connected to the arithmetic unit through the functional data bus and the mask data bus. The read command channel module is used to receive the read command sent by the arithmetic unit, the read command including a first address field and a first mask control field; and to generate a read address based on the first address field and the first mask control field; The temporary storage unit is used to read the functional data and the mask data from the storage unit according to the read address and store them. The read data selection unit is configured to, when the first mask control field is detected to be enabled, transmit the functional data back to the arithmetic unit via the functional data bus, and transmit the mask data back to the arithmetic unit via the mask data bus; and when the first mask control field is detected to be disabled, transmit the functional data back to the arithmetic unit via the functional data bus.

2. The storage controller according to claim 1, characterized in that, The operation commands include write commands; the command channel module includes a write command channel module; the data channel module includes a write data channel module; wherein... The write command channel module is used to receive the write command sent by the arithmetic unit, and the write command includes a second address field and a second mask control field. The write data channel module is used to write the functional data into the storage unit through the functional data bus according to the second address field and the second mask control field, and to write the mask data into the storage unit through the mask data bus, or to write the functional data into the storage unit through the functional data bus.

3. The storage controller according to claim 2, characterized in that, The write data channel module includes a first buffer for storing the functional data and a second buffer for storing the mask data; wherein, The first buffer is connected to the functional data bus and is used to store the functional data sent by the arithmetic unit. When the write command channel module confirms that the write operation is ready, the functional data is written to the storage unit through the functional data bus. The second buffer is connected to the mask data bus and is used to store the mask data sent by the arithmetic unit. When the write operation is confirmed to be ready and the second mask control field is enabled, the mask data is written to the storage unit through the mask data bus.

4. The storage controller according to any one of claims 1-3, characterized in that... The command channel module further includes an address generation unit; wherein the address generation unit is used for: Receives operation commands sent by the arithmetic unit; the operation commands include an address field, a step size field, a data parallelism field, and a mask control field. Based on the address field, the step size field, the data parallelism field, and the mask control field, a functional data address sequence and a mask data address sequence matching the current operation are generated; the functional data address sequence is used to characterize the access address of the functional data in the storage unit; the mask data address sequence is used to characterize the access address of the mask data in the storage unit.

5. The storage controller according to claim 4, characterized in that, The operation command also includes a mode selection field; The address generation unit is further configured to determine the addressing mode used when executing the operation command according to the mode selection field, and generate the function data address sequence and the mask data address sequence that match the current operation based on the addressing mode used, according to the address field, the step size field, and the data parallelism field. The addressing mode includes one of the following: byte stream addressing mode, polynomial dual-address parallel addressing mode, and polynomial single-address addressing mode.

6. The storage controller according to claim 4, characterized in that, The command channel module further includes a reordering unit; the reordering unit is used for: For each address in the functional data address sequence and the mask data address sequence generated by the address generation unit, apply the same random offset to obtain the offset functional data address sequence and the offset mask data address sequence; Specifically, when the access address after offset reaches the upper limit of the preset address, the subsequent access addresses are looped back to the initial functional data address and the initial mask data address to generate the final offset address sequence. The data channel module then accesses the storage unit incrementally according to this final offset address sequence until all memory access operations are completed.

7. The storage controller according to claim 4, characterized in that... The command channel module includes a counter unit; the counter unit includes an increment counter, a decrement counter, and a comparator; wherein, The incrementing counter is used to increment the counter value according to the parallelism field in the current operation command for each batch of address access operations completed in the functional data address sequence and the mask data address sequence. The decrementing counter is used to set the initial value of the count value to the length field in the operation command, and to decrement the count value according to the parallelism field after each batch of address access operations is completed. The comparator is used to determine whether the sum of the count values ​​of the increment counter and the decrement counter deviates from the length field when the operation command is executed; and to output an alarm message when the deviation occurs. The alarm message is used to instruct the security monitoring unit to perform at least one of the following protective measures: erasing the key, resetting the operation, or reporting the abnormal state.

8. A memory access control method, characterized in that, The method is applied to a storage controller according to any one of claims 1-7, the storage controller comprising a command channel module and a data channel module, the data channel module comprising a functional data bus and a mask data bus; the method comprises: The command channel module receives operation commands sent by the arithmetic unit. The data channel module determines the functional data and mask data corresponding to the operation command; wherein, the mask data is random data that is masked to protect the functional data; The functional data is transmitted via the functional data bus, and the mask data is transmitted via the mask data bus, so as to write the functional data and the mask data into the storage unit or to send the functional data and the mask data back to the computing unit. The operation command includes a read command, which includes a first address field and a first mask control field; the step of determining the function data and mask data corresponding to the operation command through the data channel module includes: Based on the first address field, the functional data and the mask data are read from the storage unit; When the first mask control field is detected to be enabled, the function data is transmitted back to the arithmetic unit via the function data bus, and the mask data is transmitted back to the arithmetic unit via the mask data bus. If the first mask control field is not enabled, the function data is transmitted back to the arithmetic unit via the function data bus.

9. The method according to claim 8, characterized in that, The operation command includes a write command; the write command includes a second address field and a second mask control field; The transmission of functional data via the functional data bus and the transmission of mask data via the mask data bus include: If the write operation is valid and the second mask control field is not enabled, the functional data is written to the storage unit through the functional data bus according to the second address field. When the write operation is valid and the second mask control field is enabled, the function data is written to the storage unit via the function data bus according to the second address field, and the mask data is written to the storage unit via the mask data bus.

10. The method according to claim 8, characterized in that, The operation command includes a read command, which further includes a step size field and a data parallelism field; determining the functional data and mask data corresponding to the operation command through the data channel module includes: Based on the first address field, the step size field, and the data parallelism field, generate a functional data address sequence and a mask data address sequence that match the current operation; Read the functional data from each functional data address in the functional data address sequence; The mask data is read from each mask data address in the mask data address sequence.

11. The method according to claim 10, characterized in that, The operation command further includes a mode selection field. The step of generating a functional data address sequence and a mask data address sequence matching the current operation based on the first address field, the step size field, and the data parallelism field includes: Based on the mode selection field, the addressing mode used when executing the operation command is determined; wherein, the addressing mode includes one of byte stream addressing mode, polynomial dual-address parallel addressing mode, and polynomial single-address addressing mode; Based on the addressing mode adopted, the function data address sequence and the mask data address sequence that match the current operation are generated according to the address field, the step size field, and the data parallelism field.

Images