Semantics-aware secure processor for verifiable instruction execution

Abstract

The application discloses a semantic-aware secure processor for verifiable instruction execution, comprising an instruction acquisition unit for reading instructions to be executed; an instruction decoding unit for decoding the instructions to generate operation representations; a semantic analysis unit for generating semantic summaries corresponding to the instructions based on the operation representations; a policy execution unit for performing policy matching in an internal policy table based on the semantic summaries and generating policy verification results; an execution gating unit for performing instruction validity judgment, semantic summary validity judgment, policy verification result validity judgment, matching judgment of context constraints required by the instructions and a current context identifier, and generating an execution enable signal or a blocking signal; and an execution unit for executing the instructions when the execution gating unit outputs the execution enable signal, and not executing the instructions when the execution gating unit outputs the blocking signal. The application can solve the technical problem of insufficient credibility of instructions generated by a large language model.

Description

Technical Field

[0001] The embodiments of the present invention relate to the fields of processor architecture, integrated circuit design and trusted computing technology, and in particular to a semantically aware secure processor for verifiable instruction execution. Background Technology

[0002] Current general-purpose processors primarily perform syntax-level parsing of instructions based on their instruction set architecture, and combine privilege-level control and memory access control mechanisms to constrain the execution process. However, these control mechanisms only address instruction format and resource access legality; they cannot characterize the semantic intent of instructions, nor can they determine whether instructions satisfy system policies or are of trustworthy origin.

[0003] With the development of automated and intelligent agent systems driven by large language models, instruction generation is increasingly being handled by the models themselves, with output typically consisting of high-level semantically driven operation requests. Although instructions can be parsed and security-checked at the software layer, once an instruction enters the processor's execution path, its execution is no longer subject to semantic constraints. This can lead to the following problems: instructions may be replaced or tampered with during execution; instructions that do not meet system policies may still be executed; the processor may lack awareness of these issues; and execution results may lack verifiability.

[0004] Existing solutions based on trusted execution environments or security modules typically place security mechanisms outside the execution path, without altering the execution logic of the processor pipeline itself. Therefore, these solutions cannot enforce constraints on execution behavior at the hardware level, nor can they provide reliable proof of execution results.

[0005] Therefore, there is currently a lack of technical solutions to implement semantic constraints and execution verifiability mechanisms at the processor microarchitecture level, so that instruction execution can satisfy both semantic and policy constraints and be verifiable.

[0006] The background section described above is merely a description made by the inventor based on their understanding, and the above content should not be regarded as evidence of prior art disclosed before the filing date of this application. Summary of the Invention

[0007] This invention provides a semantically aware secure processor for verifiable instruction execution, which implements a technical solution for semantic constraints and execution verifiable mechanisms at the processor microarchitecture level, enabling instruction execution to satisfy both semantic and policy constraints and possess verifiability, including: The instruction fetching unit is used to read the instructions to be executed. The instruction decoding unit is used to decode instructions and generate operation representations; A semantic parsing unit is used to generate a semantic summary corresponding to the instruction based on the operation representation; The policy execution unit is used to perform policy matching in the internal policy table based on semantic digest and generate policy verification results; The execution gating unit is used to perform instruction validity judgment, semantic digest validity judgment, policy verification result validity judgment, context constraint required by the instruction and current context identifier matching judgment, and generate execution enable signal or blocking signal; An execution unit is configured to execute the instruction when the execution gating unit outputs an execution enable signal, and not execute the instruction when the execution gating unit outputs a blocking signal.

[0008] In this embodiment of the invention, by introducing a semantic parsing unit and a policy execution unit into the pipeline, security judgment is elevated from whether the instruction format is correct to the semantic level of whether the instruction intent is permissible. This ensures that any instruction that does not conform to the system policy is identified before execution, and blocked by an execution gating unit, thus achieving semantic-level mandatory constraints on execution behavior at the hardware level. Unlike traditional solutions that place security mechanisms outside the execution path, this invention embeds the execution gating unit into the core pipeline path, allowing its output to directly control the startup of the execution unit. This gating mechanism does not rely on the operating system or application software and does not provide any software-programmable bypass paths, thereby ensuring at the physical level that any instruction that has not undergone semantic and policy verification cannot enter the execution stage, significantly improving the defense against attacks such as instruction injection and tampering. By completing semantic parsing, policy matching, and execution authorization of instructions within the processor, this invention makes it possible to record and trace at the hardware level whether an instruction meets security constraints and is actually executed. The execution enable or block signals generated by the gating unit serve as native evidence of execution behavior, supporting subsequent execution result verification and security auditing, thus enhancing the overall trustworthiness of the processor. For automated systems driven by large language models, the generated instructions naturally possess high-level semantic attributes. The semantic-aware architecture of this invention can directly parse the intent of such instructions and manage them according to policies, incorporating the behavior of external intelligent agents into the processor's hardware security constraint domain. This effectively solves the security and controllability problem of intelligent agent systems at the execution level and expands the application security boundaries of the processor. This invention directly integrates security logic into the original stages of the processor pipeline (decoding, execution, etc.), with semantic parsing and policy matching operations running in parallel with inherent pipeline operations. The entire security check path does not introduce additional long pipeline cycles or complex software interactions, thereby maintaining the processor's high-performance execution efficiency while providing strong security attributes. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 This is a schematic diagram of the structure of a semantically aware security processor for verifiable instruction execution in an embodiment of the present invention; Figure 2 This is a schematic diagram of a semantically aware security processor for verifiable instruction execution in an embodiment of the present invention; Figure 3 This is a timing diagram illustrating instruction execution in an embodiment of the present invention; Figure 4 This is a schematic diagram of the gating unit in an embodiment of the present invention; Figure 5 This is another structural schematic diagram of the gating unit in an embodiment of the present invention; Figure 6 This is a timing diagram of the transitions of the five states of the state-maintaining submodule in an embodiment of the present invention; Figure 7 This is another schematic diagram of the semantically aware security processor for verifiable instruction execution in an embodiment of the present invention. Detailed Implementation

[0010] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0011] Figure 1 This is a schematic diagram of the structure of a semantically aware security processor for verifiable instruction execution in an embodiment of the present invention, as shown below. Figure 1 As shown, it includes: Instruction acquisition unit 10 is used to read instructions to be executed; Instruction decoding unit 20 is used to decode instructions and generate operation representations; Semantic parsing unit 30 is used to generate a semantic summary corresponding to the instruction based on the operation representation; The policy execution unit 40 is used to perform policy matching in the internal policy table based on semantic digest and generate policy verification results; The execution gating unit 50 is used to perform instruction validity judgment, semantic digest validity judgment, policy verification result validity judgment, context constraint required by the instruction and current context identifier matching judgment, and generate execution enable signal or blocking signal; The execution unit 60 is configured to execute the instruction when the execution gating unit outputs an execution enable signal, and not execute the instruction when the execution gating unit outputs a blocking signal.

[0012] Depend on Figure 1 As illustrated in the flowchart, by introducing a semantic parsing unit and a policy execution unit into the pipeline, security judgment is elevated from the correctness of instruction format to the semantic level of whether the instruction intent is permissible. This ensures that any instruction that does not conform to the system policy is identified before execution, thereby achieving semantic-level mandatory constraints on execution behavior at the hardware level. Combined with the blocking effect of the execution gating unit, unlike traditional solutions that place security mechanisms outside the execution path, this invention embeds the execution gating unit into the core path of the pipeline, allowing its output to directly control the startup of the execution unit. This gating mechanism does not rely on the operating system or application software and does not provide any software-programmable bypass paths, thus ensuring at the physical level that any instruction that has not undergone semantic and policy verification cannot enter the execution stage, significantly improving the defense against attacks such as instruction injection and tampering. By completing semantic parsing, policy matching, and execution authorization of instructions within the processor, this invention makes it possible to record and trace at the hardware level whether an instruction meets security constraints and is actually executed. The execution enable or block signals generated by the gating unit serve as native evidence of execution behavior, supporting subsequent execution result verification and security auditing, thus enhancing the overall trustworthiness of the processor. For automated systems driven by large language models, the generated instructions naturally possess high-level semantic attributes. The semantic-aware architecture of this invention can directly parse the intent of such instructions and manage them according to policies, incorporating the behavior of external intelligent agents into the processor's hardware security constraint domain. This effectively solves the security and controllability problem of intelligent agent systems at the execution level and expands the application security boundaries of the processor. This invention directly integrates security logic into the original stages of the processor pipeline (decoding, execution, etc.), with semantic parsing and policy matching operations running in parallel with inherent pipeline operations. The entire security check path does not introduce additional long pipeline cycles or complex software interactions, thereby maintaining the processor's high-performance execution efficiency while providing strong security attributes.

[0013] In this embodiment of the invention, a semantically aware security processor execution pipeline for verifiable instruction execution introduces semantic parsing, policy verification, execution gating, and execution authentication mechanisms, enabling the instruction execution process to simultaneously satisfy the two objectives of controlled and verifiable execution. All units are connected in pipeline sequence. Instructions, semantic summaries, and control signals are transmitted between units through on-chip data paths, and dependencies are formed through control paths, making the execution of subsequent units dependent on the verification results of preceding units.

[0014] Figure 2This is a schematic diagram of a semantically aware security processor for verifiable instruction execution in an embodiment of the present invention. Unlike existing general-purpose CPUs, the processor proposed in this embodiment can be integrated inside a CPU. See [link / reference]. Figure 2 (1) in the diagram can also be located outside the CPU, see [link to diagram]. Figure 2(2) forms a customized CPU. The core mechanism of semantic awareness implemented by this semantic-aware security processor for verifiable instruction execution can be summarized as follows: elevating the instruction from the operation level to the intent level for understanding, and making hardware-level mandatory security decisions based on the intent. Specifically, it is achieved through the following key steps: First, the conversion from instruction to semantic digest. The starting point of semantic awareness is the semantic parsing unit. It is not satisfied with the traditional processor only recognizing the operation format of the instruction, but receives the operation representation generated by the instruction decoding unit. This representation includes the operation type (such as addition, jump), operand position and execution control information. Through hardware mapping logic or microcode mechanism, these underlying operation representations are mapped into a unified semantic digest. The semantic digest directly depicts the execution intent of the instruction (for example: whether the intent of this instruction is to modify the critical system configuration or to read user data), becoming the core basis for subsequent security judgment. Second, policy matching based on intent. Traditional processors only check whether the instruction is legal, while this processor performs semantic-level policy matching. The policy execution unit receives the semantic digest and searches for a match in the policy table fixed inside the processor. The policy judgment is not whether the instruction format is correct, but whether the instruction intent is allowed. For example, a correctly formatted memory write instruction might be deemed a violation if its semantic intent is to write data to a protected kernel code segment. Third, a semantically aware execution gating unit performs hardware-enforcement authorization. Located before the execution unit, this unit is an unavoidable hardware control point. It comprehensively judges four factors: instruction validity, semantic validity, policy verification results, and context matching. Only when all four pass will the gating unit generate an "execution enable signal," allowing the instruction to enter the execution unit. If any factor is not satisfied, a blocking signal is immediately generated, physically preventing instruction execution. The entire process is independent of the operating system or software and has no bypass paths. Fourth, semantic adaptation to external agents (such as large language models) is crucial. The processor's semantic awareness capability is specifically optimized for external intelligent agents like large language models. The instruction acquisition unit can recognize instructions from external systems and convert them into internal format. Since instructions generated by large models inherently possess high-level semantic attributes, the processor's semantic parsing unit can directly understand their intent and incorporate them into the hardware security constraint domain. This means that even if an external agent issues a malicious instruction, it will be blocked at the hardware level because its "semantic intent" violates the policy. Through the above design, this processor implements a closed-loop constraint from instruction semantics to hardware actions. Traditional processors identify what operation to perform (such as addition or memory read), while this processor understands the intended purpose of performing the operation (such as attempting to tamper with security policies) and decides whether to allow it based on the purpose. This architecture makes security decisions no longer dependent on the surface format of instructions, but rather delve into the execution intent of the instructions, achieving true semantic-aware hardware security.

[0015] Figure 3This is a timing diagram illustrating instruction execution in an embodiment of the present invention. See [link / reference] Figure 3 The instruction is read by the Instruction Fetch Unit (IFU), decoded by the Instruction Decode Unit (IDU), and then sent to the Semantic Parsing Unit (SPU) to generate a semantic digest. Subsequently, policy matching is performed in the Policy Enforcement Unit (PEU). The Execution Gate Unit (EGU) determines whether to allow execution based on the semantic digest, policy verification results, and context identifier. If execution is allowed, the Execution Unit (EXU) completes the instruction execution. After execution, the Attestation Generation Unit (ATU) generates an execution authentication token.

[0016] In one embodiment, the instruction acquisition unit is used for: If the instruction originates from the instruction cache, main memory, or external unit, the instruction is directly sent to the instruction decoding unit. If the instruction originates from an external system or intelligent agent, it is converted into an internal instruction form and then sent to the instruction decoding unit.

[0017] This embodiment specifically defines two processing paths for the instruction acquisition unit 10 for different instruction sources.

[0018] The first path: When the instruction to be executed comes from the processor's internal instruction cache or main memory, the instruction fetching unit considers these instructions to be in a standard format that the processor can directly recognize. Therefore, no additional processing is required, and the instruction is directly sent to the next level instruction decoding unit (20).

[0019] The second approach: When the instructions to be executed originate from an external system or intelligent agent (e.g., instructions generated by an automated system driven by a large language model), the format of these instructions may differ from the processor's native instruction format. Therefore, the instruction fetching unit first performs a conversion operation, transforming these external instructions into an internal instruction form that the processor can understand. After the conversion is complete, the converted instructions are sent to the instruction decoding unit 20 for further processing. This demonstrates the processor's compatibility and adaptation capabilities to external intelligent agent instructions.

[0020] In one embodiment, the operation representation includes at least the operation type, operand position, and execution control information.

[0021] The semantic parsing unit can map different types of instructions into a unified semantic digest. The generated semantic digest is used to characterize the execution intent of the instruction and serves as the core basis for subsequent security judgments.

[0022] Operation type: Specifies what kind of operation this instruction should perform, such as addition, subtraction, multiplication, data loading, jump, etc.

[0023] Operand location: Specifies where the data involved in the operation (operands) is stored, such as in which register or at which memory address.

[0024] Execution control information: contains control signals or attributes related to execution, such as instruction priority, whether interrupts are allowed, memory access permissions, etc.

[0025] This definition ensures that the operation representation contains enough information so that the subsequent semantic parsing unit can understand the intent of the instruction.

[0026] In one embodiment, the semantic parsing unit is implemented through hardware mapping logic or a microcode mechanism.

[0027] This embodiment illustrates two specific hardware implementation schemes for the semantic parsing unit 30.

[0028] Option 1: Hardware-mapped logic. This means implementing the mapping from operation representation to semantic summary using purely combinational or sequential logic circuits. This method is fast, typically completing within one clock cycle, but it has lower flexibility; if the mapping rules need to be modified, the hardware must be redesigned.

[0029] Option 2: Microcode Mechanism. This means that the rules for converting operation representations to semantic digests are stored as microinstructions in a read-only memory within the processor. The semantic parsing unit generates the corresponding semantic digest by looking up the microcode table. This method is highly flexible, as the mapping rules can be modified by updating the microcode, but it may be slightly slower than pure hardware logic.

[0030] Both approaches have their advantages and disadvantages, and designers can choose based on specific requirements such as performance, flexibility, and power consumption.

[0031] The policy execution unit needs to use policies in the processor's internal policy table, which are stored in the form of rules.

[0032] The execution gating unit is located before the execution unit and is a key control node in the processor's execution path.

[0033] In one embodiment, the processor further includes a plurality of pipelined registers, the pipelined registers including: A fetch-stage pipeline register located between the instruction fetch unit and the instruction decode unit is used to store the instruction valid bit. A semantic-level pipelined register located between the semantic parsing unit and the policy execution unit is used to store semantic summaries and semantically valid bits; A policy-level pipeline register located between the policy execution unit and the execution gating unit is used to store policy verification results; An execution-level pipeline register located between the execution gating unit and the execution unit is used to write the instruction and operation representation when the execution enable signal is true.

[0034] Figure 4 This is a schematic diagram of the structure of the gating unit in an embodiment of the present invention. In one embodiment, the gating unit includes: The input latch submodule 301 is used to receive the instruction valid bit, semantic digest, semantic valid signal, policy verification result, and obtain the current context identifier and the context constraints required by the instruction from the output of the front-end pipeline register, and latch them into the corresponding gated input latch registers under the drive of the clock signal. The verification and comparison submodule 302 is used to perform combinational logic judgments on instruction validity, semantic validity, policy validity and context matching based on the values ​​of each gate input latch register, and generate a gate synthesis pass flag; The gating control submodule 303 is used to generate an execution enable signal or a blocking signal through the gating synthesis flag.

[0035] Based on the processor architecture described above, instructions are processed in the following order: instruction fetch → instruction decoding → semantic parsing → policy verification → execution gating → instruction execution → authentication generation.

[0036] In this embodiment of the invention, the pre-stage pipeline inputs of the gating unit include: The instruction validity bit instr_valid_in indicates that the current input instruction to the preceding pipeline register is valid and is latched into the instruction validity register r_instr_valid. Semantic digest sem_digest_in, latched into semantic digest register r_sem_digest; The policy verification result, policy_ok_in, is latched into the policy result register r_policy_ok; The semantically valid bit `semantic_valid_in` is latched into the semantically valid bit register `r_semantic_valid`. The context identifier `context_id_in` is latched into the context identifier register `r_context_id`. The pipeline flush input signal flush_in is used for flush control; In addition to the inputs from the preceding pipeline, the inputs to the gating unit also include: The clock signal clk represents the clock signal; The reset signal rst_n indicates a low-active reset signal; The context constraint required_context_in represents the context constraints required by the current instruction and is stored in the required context register r_required_context. The output of the gating unit includes: The execute enable signal exec_enable_out indicates that execution of the execution unit is enabled; The instruction valid signal instr_valid_out, output to the execution level, indicates that the instruction output to the execution level is valid; The block_out signal indicates that the current instruction has been blocked by the gating unit; The trap_out signal indicates that the current instruction has triggered exception handling. The security alarm signal alert_out indicates that the current command triggered a security alarm; The current state of the gate control unit, gate_status_out, is stored in the gate control status register r_gate_state; The failure reason code, fail_code_out, is stored in the failure reason register r_fail_code.

[0037] In one embodiment, the gated input latch register includes an instruction valid bit register, a semantic digest register, a semantic valid bit register, a policy pass register, a required context register, and a context identifier register; The input latch submodule is used for: When the reset signal is invalid and the pipeline clear input signal is invalid, the instruction valid bit, semantic digest, semantic valid signal, and policy verification result are received from the output of the previous pipeline register, and the context constraints required by the instruction and the current context identifier are obtained. Driven by the clock signal, the instruction valid bit, semantic digest, semantic valid signal, policy verification result, context constraint, and current context identifier are latched into the instruction valid bit register, semantic digest register, semantic valid bit register, policy pass register, required context register, and context identifier register, respectively.

[0038] This embodiment is a further refinement of the above-described input latch submodule.

[0039] First, it lists the six registers specifically included in the gated input latch register: instruction valid bit register, semantic digest register, semantic valid bit register, policy pass register, required context register, and context flag register.

[0040] Secondly, it clarifies the prerequisites for the input latch submodule to operate: two conditions must be met simultaneously: the reset signal is invalid (i.e., the chip is not in a reset state) and the pipeline clear input signal is invalid (i.e., no clear pipeline command has been received). It will only receive new data when the pipeline is progressing normally.

[0041] Finally, it describes the specific data reception and latching operations: under the control of the clock signal, the six types of data received (instruction valid bit, semantic digest, semantic valid signal, policy verification result, context constraint, and current context identifier) ​​are latched one-to-one into the corresponding six registers.

[0042] In one embodiment, the input latch submodule is used for: When the reset signal is valid, the instruction valid bit register, semantic summary register, semantic valid bit register, policy pass register, context identifier register, and required context register are cleared.

[0043] When the reset signal is invalid and the pipeline clear input signal is valid, the instruction valid bit register, semantic valid bit register, and policy are cleared to zero through the registers.

[0044] This embodiment further describes the behavior of the input latch submodule under two abnormal or control scenarios and defines the register clearing strategy.

[0045] Scenario 1: Reset signal valid. This is the highest priority operation. When the entire processor is reset, in order to ensure that it starts from a known clean state, the input latch submodule clears all six critical registers (instruction valid bit, semantic digest, semantic valid bit, policy pass, context flag, and required context) to 0.

[0046] Scenario 2: Pipeline Clear. When the reset signal is invalid (normal operation), but a pipeline clear input signal is received (e.g., due to a prediction error jump requiring clearing of erroneous instructions in the pipeline), the module performs a more refined clearing operation. It only clears the registers indicating validity and results, specifically: the instruction valid bit register, the semantic valid bit register, and the policy pass register. The semantic digest, context flag, and required context data can remain uncleared because their corresponding valid bits have already been cleared, and subsequent logic will ignore them.

[0047] In one embodiment, the verification comparison submodule is used for: Set the semantic validity to the value of the semantic validity bit register via a flag; Set the policy verification pass flag to the value of the policy pass register; Calculate the logical value to determine whether the value of the context identifier register is equal to the value of the required context register, and set the context match to the logical value via a flag; The logical AND operation is performed on the following conditions: the value of the instruction valid bit register is true, the value of the semantic valid bit register is true, the policy verification pass flag is true, and the context matching pass flag is true. The logical AND result is obtained by setting the gating synthesis pass flag to the logical AND result.

[0048] This embodiment fully reveals the internal judgment logic of the verification and comparison submodule, which is the core algorithm of the execution gating unit.

[0049] First, generate three independent pass flags.

[0050] Semantic validity is determined by a flag: this flag is very simple, it is directly equal to the value of the semantic validity bit register. If the register indicates validity, the flag is true.

[0051] Policy verification pass flag: Similarly, it is directly equal to the value of the policy pass register.

[0052] Context matching is achieved through a flag: this flag is obtained through a comparison operation. The module calculates whether the value of the context flag register is equal to the value of the required context register. If they are equal, the flag is true (match); otherwise, it is false (no match).

[0053] Secondly, generate the final gated integration pass flag.

[0054] The module will then perform a logical AND operation. There are four conditions involved in the operation: The instruction validity register is true (the instruction exists and is valid). The semantic validity register is true (semantic resolution was successful and valid); The policy validation pass flag is true (policy matching successful); Context matching is achieved when the flag is true (the context environment meets the instruction requirements).

[0055] The result of the logical AND operation is true only when all four conditions above are true. This result is the gated synthesis pass flag.

[0056] In one embodiment, the gating control submodule is used for: Set the execution enable signal to the value of the gated synthesis pass flag; the execution enable signal is directly connected to the write enable terminal of the execution stage pipeline register; When the execution enable signal is true, the instruction and operation representation are written to the execution stage pipeline register; When the execution enable signal is false, the execution stage pipeline register retains its original value or is written with a no-operation instruction. The instruction valid bit register is set to true and the gate synthesis passes the logical AND with the flag set to false to obtain the blocking value. The blocking signal is then set to the blocking value.

[0057] In the above embodiments, the verification and comparison submodule only allows the execution gating unit to allow the instruction and operation representation to enter the execution unit when the instruction validity bit register is true, the semantic validity pass flag is true, the policy verification pass flag is true, and the context matching pass flag is true. Its preset control logic can be: assign exec_enable_out = gate_pass assign instr_valid_out = gate_pass gate_pass = instr_valid policy_ok semantic_ok context_match_ok Here, `exec_enable_out` is the execution enable signal; `instr_valid_out` is the instruction validation signal output to the execution level; `instr_valid` indicates that the instruction validation bit register is true; `semantic_ok` is the semantic validation pass flag; `policy_ok` is the policy validation pass flag; `context_match_ok` is the context matching pass flag; and `gate_pass` is the gate synthesis pass flag. Where context_match_ok = (r_context_id == r_required_context), r_required_context is the required context register; r_context_id is the context identifier register; In other words, if any of the above conditions are not met, the gating unit will block the execution path and subsequently trigger exception handling or a security alarm.

[0058] When exec_enable_out is high, the execution level register is written with the current instruction and operation representation; When exec_enable_out is low, the execution level register retains its original value or is written with a no-operation instruction.

[0059] The aforementioned instructions and operation representations can be placed into the instruction register and operand register respectively, depending on the actual situation. The execution gating unit can also directly control the execution unit input multiplexer, forcing the selection of a no-operation path when gating fails.

[0060] This invention incorporates an anti-bypass mechanism. To ensure the execution gating unit cannot be bypassed, its output signals do not pass through the software-writable control register, nor are bypass multiplexing paths provided. The write enable condition of the execution-level pipeline register includes a hard-connected `exec_enable_out`, and the input selection logic of the execution unit is also directly controlled by `exec_enable_out`. If the processor's internal chip detects an illegal direct write to `exec_enable_out` or an abnormal modification of the gating control path, a hardware error state is triggered, and the current pipeline is blocked.

[0061] In this embodiment of the invention, the Execution Gating Unit (EGU) is located after the Policy Execution Unit and before the Execution Unit. It is used to perform hardware-level execution authorization judgment on the instruction to be executed at the register transfer level. The EGU does not rely on software control. Its output directly controls the write execution enable signal of the execution level pipeline register, thereby constituting the only hardware authorization entry point in the processor execution path.

[0062] Figure 5 This is another structural schematic diagram of the gating unit in an embodiment of the present invention. In one embodiment, the gating unit further includes an exception control submodule 304, used for: The instruction valid bit register is set to true; the gated synthesis performs a logical AND operation on the false flag and the trap enable bit, and obtains the exception value; the output trap exception signal is then set to the exception value. The instruction validity register is set to true, and the gated synthesis performs a logical AND operation with the flag set to false and the alarm enable bit set to true to obtain the warning value; the output safety alarm signal is then set to the warning value.

[0063] The logic for an outlier can be represented as: assign block_out = r_instr_valid & ~gate_pass; assign trap_out= r_instr_valid & ~gate_pass & trap_en; assign alert_out = r_instr_valid & ~gate_pass & alert_en; Among them, trap_en and alert_en are configuration bits or hardwire enable bits implemented during the implementation.

[0064] In one embodiment, the execution gating unit further includes a failure reason register; The input latch submodule is used to: set the failure reason register to a no-failure state when the reset signal is valid; and set the failure reason register to a cleared failure state when the reset signal is invalid and the pipeline clear input signal is valid. The exception control submodule is used for: When the value of the instruction valid bit register is false, the failure reason is determined to be "no instruction failure". When the value of the instruction valid bit register is true and the value of the semantic valid bit register is false, the failure reason is determined to be a semantically invalid failure. When the value of the instruction valid bit register is true, the value of the semantic valid bit register is true, and the value of the policy pass register is false, the failure reason is determined to be policy failure. When the instruction valid bit register is true, the semantic valid bit register is true, the policy pass register is true, and the value of the context identifier register is not equal to the value of the required context register, the failure reason is determined and encoded as context mismatch failure. Otherwise, the failure reason code is determined as "no failure"; The failure reason code is stored in the failure reason register at the clock edge.

[0065] This embodiment introduces a failure reason register and a complete set of failure reason encoding logic, enabling the reasons for security check failures to be accurately recorded and queried.

[0066] Register management: The input latch submodule is responsible for setting it to no failure upon reset and to clear failure upon pipeline cleanup, in order to initialize the state.

[0067] Failure reason coding logic (executed by the exception control submodule): This is a multi-level decision tree.

[0068] First, check the instruction validity bit. If it is false (no valid instruction), then it is encoded as no instruction failure.

[0069] If the instruction is valid, then check the semantic validity bit. If it is false, the encoding is considered semantically invalid and fails (indicating a problem with the semantic parsing itself).

[0070] If the semantics are also valid, then check the policy pass register. If it is false, it is encoded as a policy failure (the instruction intent violated the security policy).

[0071] If the strategy also passes, the final check is to see if the context matches (compare the context identifier with the required context). If they are not equal, the error is encoded as a context mismatch failure (incorrect instruction execution environment).

[0072] If all checks pass, it is coded as no failure.

[0073] Result storage: At each clock edge, the failure reason code determined according to the above logic is stored in the failure reason register. Software or hardware debuggers can subsequently read this register to understand the specific reason for the previous blocked instruction, which is invaluable for security auditing and problem diagnosis.

[0074] In one embodiment, the gating unit further includes a gating status register; The gating unit also includes a state holding submodule 305, used for: When the reset signal is valid, the value of the gate status register is set to the gate idle state; When the reset signal is invalid and the current state of the finite state machine is the gated idle state, if the value of the input instruction valid signal is true, the value of the gated state register is updated to the gated check state; otherwise, the gated idle state is maintained. When the reset signal is invalid and the current state is the gate check state, if the gate integration pass flag is true, the value of the gate status register is updated to the gate release state; if the gate integration pass flag is false and the trap enable bit is true, the value of the gate status register is updated to the gate trap state; if the gate integration pass flag is false and the trap enable bit is false, the value of the gate status register is updated to the gate block state. When the reset signal is invalid and the current state is gate release state, gate blocking state, or gate trapped state, the value of the gate status register is updated to the gate idle state. When the reset signal is invalid and the current state is an undefined state of the finite state machine, the value of the gated state register is updated to the gated idle state.

[0075] In this embodiment of the invention, the state maintenance submodule includes at least the following five states: GATE_IDLE (gating idle state), indicating that there is currently no instruction being processed; GATE_CHECK (gating check state), indicating that gating judgment is being performed on the current instruction; GATE_ALLOW (gating release state), indicating that the current instruction has been authorized to pass; GATE_BLOCK (gating block state), indicating that the current instruction has been blocked; and GATE_TRAP (gating trap state), indicating that the current instruction has triggered exception handling.

[0076] This embodiment introduces a gating state register and a state holding submodule, using a finite state machine to accurately describe the operational phase of the gating unit in each clock cycle.

[0077] Defined states include: gate idle, gate check, gate open, gate blocked, and gate trapped.

[0078] Figure 6 This is a timing diagram showing the transitions of the five states of the state-maintaining submodule in this embodiment of the invention. See [link / reference]. Figure 6 State transition rules: During reset: Regardless of the current state, a valid reset signal will force the state to be set to gated idle.

[0079] Gating Idle -> Gating Check: In the idle state, if the input command is found to be valid, the process jumps to the gating check state to begin verifying the current command.

[0080] Gating Check -> Other: In check mode, proceed based on the verification result: If the gate control pass flag is true (verification passed), the process will proceed to the gate control release state.

[0081] If verification fails and the trap enable bit is true, jump to the gated trap state and prepare to trigger an exception.

[0082] If the verification fails and the enable bit is false, it jumps to the gating blocking state, indicating that it is simply blocking.

[0083] Complete -> Gated Idle: In the three complete states of gate release, gate block, or gate trap, regardless of the specific state, the next clock cycle will unconditionally jump back to the gate idle state to prepare for processing the next instruction.

[0084] Fault tolerance: If the state machine accidentally enters any undefined state, it will be immediately corrected back to the gated idle state, improving the robustness of the processor.

[0085] Through the above embodiments, the execution gating unit is no longer an optional checking module located in the software layer, but becomes a hardware-enforced control point in the processor execution pipeline. It can verify the semantic validity, policy satisfaction, and context matching of the current instruction at the cycle level, and directly control the execution-level registers or execution unit inputs, thus preventing unauthorized instructions from entering the execution stage at the hardware level. This design not only significantly improves the execution security of large language model-driven systems, but also provides a clear engineering implementation path for subsequent chip implementation, FPGA prototyping, and SoC integration.

[0086] Figure 7 This is another schematic diagram of a semantically aware security processor for verifiable instruction execution in an embodiment of the present invention. In one embodiment, the processor further includes an authentication generation unit 70, used for: A summary of the execution results is generated after the instruction is executed; Based on quantum-resistant signatures, an authentication token is generated according to the semantic digest, policy verification result, current context identifier, and execution result digest.

[0087] The authentication generation unit is located after the execution unit and is used to generate authentication tokens after the instructions are executed.

[0088] The authentication mark is generated in the following way:

[0089] Where S represents semantic digest, P represents policy verification result, C represents context identifier, R represents execution result digest, and K_chip represents quantum-resistant signature.

[0090] The authentication token is used to prove that the instruction has been genuinely executed while satisfying semantic and policy constraints.

[0091] By generating an authentication token after execution, the execution behavior becomes verifiable.

[0092] The processor proposed in this embodiment of the invention has the following beneficial effects: First, by introducing an execution gating unit into the execution path, instruction execution must meet semantic and policy constraints, thereby ensuring that the execution path cannot be bypassed.

[0093] Secondly, by embedding security control mechanisms inside the processor, execution control becomes independent of the operating system or application software, thereby improving the overall security of the processor.

[0094] Furthermore, by generating an authentication token after execution, the execution behavior becomes verifiable.

[0095] Furthermore, this invention enables the processor to adapt to intelligent systems driven by large language models through a semantically driven execution control mechanism, thereby improving the system's security and controllability.

[0096] In summary, the semantically aware security processor for verifiable instruction execution proposed in this embodiment of the invention has the following beneficial effects: By introducing a semantic parsing unit and a policy execution unit into the pipeline, security judgment is elevated from the correctness of instruction format to the semantic level of whether the instruction intent is permissible. This ensures that any instruction that does not conform to the system policy is identified before execution, and blocked by an execution gating unit, thus achieving semantic-level mandatory constraints on execution behavior at the hardware level. Unlike traditional solutions that place security mechanisms outside the execution path, this invention embeds the execution gating unit into the core pipeline path, allowing its output to directly control the startup of the execution unit. This gating mechanism does not rely on the operating system or application software and does not provide any software-programmable bypass paths, thus ensuring at the physical level that any instruction that has not undergone semantic and policy verification cannot enter the execution stage, significantly improving the defense against attacks such as instruction injection and tampering. This invention, by completing semantic parsing, policy matching, and execution authorization of instructions within the processor, makes it possible to record and trace whether an instruction meets security constraints and is actually executed at the hardware level. The execution enable or block signals generated by the execution gating unit can serve as original evidence of execution behavior, supporting subsequent execution result verification and security auditing, enhancing the overall trustworthiness of the processor. For automated systems driven by large language models, the generated instructions naturally possess high-level semantic attributes. The semantic-aware architecture of this invention can directly parse the intent of such instructions and control them according to policies, incorporating the behavior of external intelligent agents into the processor's hardware security constraints. This effectively solves the security and controllability issues of intelligent agent systems at the execution level and expands the application security boundaries of the processor. This invention directly integrates security logic into the existing stages of the processor pipeline (decoding, execution, etc.), with semantic parsing and policy matching operations running in parallel with inherent pipeline operations. The entire security check path does not introduce additional long pipeline cycles or complex software interactions, thus maintaining high-performance execution efficiency of the processor while providing strong security attributes.

[0097] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A semantically aware security processor for verifiable instruction execution, characterized in that, include: The instruction fetching unit is used to read the instructions to be executed. The instruction decoding unit is used to decode instructions and generate operation representations; A semantic parsing unit is used to generate a semantic summary corresponding to the instruction based on the operation representation; The policy execution unit is used to perform policy matching in the internal policy table based on semantic digest and generate policy verification results; The execution gating unit is used to perform instruction validity judgment, semantic digest validity judgment, policy verification result validity judgment, context constraint required by the instruction and current context identifier matching judgment, and generate execution enable signal or blocking signal; An execution unit is configured to execute the instruction when the execution gating unit outputs an execution enable signal, and not execute the instruction when the execution gating unit outputs a blocking signal.

2. The semantically aware security processor for verifiable instruction execution as described in claim 1, characterized in that, The instruction fetching unit is used for: If the instruction originates from the instruction cache, main memory, or external unit, the instruction is directly sent to the instruction decoding unit. If the instruction originates from an external system or intelligent agent, it is converted into an internal instruction form and then sent to the instruction decoding unit.

3. The semantically aware security processor for verifiable instruction execution as described in claim 1, characterized in that, The operation representation includes at least the operation type, operand position, and execution control information.

4. The semantically aware security processor for verifiable instruction execution as described in claim 1, characterized in that, The semantic parsing unit is implemented through hardware mapping logic or microcode mechanism.

5. The semantically aware security processor for verifiable instruction execution as described in claim 1, characterized in that, It also includes multiple pipeline registers, which include: A fetch-stage pipeline register located between the instruction fetch unit and the instruction decode unit is used to store the instruction valid bit. A semantic-level pipelined register located between the semantic parsing unit and the policy execution unit is used to store semantic summaries and semantically valid bits; A policy-level pipeline register located between the policy execution unit and the execution gating unit is used to store policy verification results; An execution-level pipeline register located between the execution gating unit and the execution unit is used to write the instruction and operation representation when the execution enable signal is true.

6. The semantically aware security processor for verifiable instruction execution as described in claim 5, characterized in that, The gating unit includes: The input latch submodule is used to receive the instruction valid bit, semantic digest, semantic valid signal, policy verification result, and obtain the current context identifier and the context constraints required by the instruction from the output of the previous pipeline register, and latch them into the corresponding gated input latch registers under the drive of the clock signal. The verification and comparison submodule is used to perform combinational logic judgments on instruction validity, semantic validity, policy validity, and context matching based on the values ​​of each gate input latch register, and generate a gate synthesis pass flag; The gating control submodule is used to generate enable or block signals through gating synthesis using flags.

7. The semantically aware security processor for verifiable instruction execution as described in claim 6, characterized in that, The gated input latch register includes an instruction valid bit register, a semantic digest register, a semantic valid bit register, a policy pass register, a required context register, and a context identifier register; The input latch submodule is used for: When the reset signal is invalid and the pipeline clear input signal is invalid, the instruction valid bit, semantic digest, semantic valid signal, and policy verification result are received from the output of the previous pipeline register, and the context constraints required by the instruction and the current context identifier are obtained. Driven by the clock signal, the instruction valid bit, semantic digest, semantic valid signal, policy verification result, context constraint, and current context identifier are latched into the instruction valid bit register, semantic digest register, semantic valid bit register, policy pass register, required context register, and context identifier register, respectively.

8. The semantically aware security processor for verifiable instruction execution as described in claim 7, characterized in that, The input latch submodule is used for: When the reset signal is valid, the instruction valid bit register, semantic summary register, semantic valid bit register, policy pass register, context flag register, and required context register are cleared to zero; When the reset signal is invalid and the pipeline clear input signal is valid, the instruction valid bit register, semantic valid bit register, and policy are cleared to zero through the registers.

9. The semantically aware security processor for verifiable instruction execution as described in claim 7, characterized in that, The verification and comparison submodule is used for: Set the semantic validity to the value of the semantic validity bit register via a flag; Set the policy verification pass flag to the value of the policy pass register; Calculate the logical value to determine whether the value of the context identifier register is equal to the value of the required context register, and set the context match to the logical value via a flag; The result is obtained by performing a logical AND operation on the following conditions: the instruction validity register value is true, the semantic validity flag is true, the policy verification flag is true, and the context matching flag is true. Set the gated synthesis pass flag to the logic AND result.

10. The semantically aware security processor for verifiable instruction execution as described in claim 7, characterized in that, The gating control submodule is used for: Set the execution enable signal to the value of the gated synthesis pass flag; the execution enable signal is directly connected to the write enable terminal of the execution stage pipeline register; When the execution enable signal is true, the instruction and operation representation are written to the execution stage pipeline register; When the execution enable signal is false, the execution stage pipeline register retains its original value or is written with a no-operation instruction. The instruction valid bit register is set to true and the gate synthesis passes the logical AND with the flag set to false to obtain the blocking value. The blocking signal is then set to the blocking value.

11. The semantically aware security processor for verifiable instruction execution as described in claim 7, characterized in that, The execution gating unit also includes an exception control submodule, used for: The instruction valid bit register is set to true; the gated synthesis performs a logical AND operation on the false flag and the trap enable bit, and obtains the exception value; the output trap exception signal is then set to the exception value. The instruction validity register is set to true, and the gated synthesis performs a logical AND operation with the flag set to false and the alarm enable bit set to true to obtain the warning value; the output safety alarm signal is then set to the warning value.

12. The semantically aware security processor for verifiable instruction execution as described in claim 11, characterized in that, The execution gating unit also includes a failure reason register; The input latch submodule is used to: set the failure reason register to a no-failure state when the reset signal is valid; and set the failure reason register to a cleared failure state when the reset signal is invalid and the pipeline clear input signal is valid. The exception control submodule is used for: When the value of the instruction valid bit register is false, the failure reason is determined to be "no instruction failure". When the value of the instruction valid bit register is true and the value of the semantic valid bit register is false, the failure reason is determined to be a semantically invalid failure. When the value of the instruction valid bit register is true, the value of the semantic valid bit register is true, and the value of the policy pass register is false, the failure reason is determined to be policy failure. When the instruction valid bit register is true, the semantic valid bit register is true, the policy pass register is true, and the value of the context identifier register is not equal to the value of the required context register, the failure reason is determined and encoded as context mismatch failure. Otherwise, the failure reason code is determined as "no failure"; The failure reason code is stored in the failure reason register at the clock edge.

13. The semantically aware security processor for verifiable instruction execution as described in claim 7, characterized in that, The gating unit also includes a gating status register; The execution gating unit also includes a state holding submodule, used for: When the reset signal is valid, the value of the gate status register is set to the gate idle state; When the reset signal is invalid and the current state of the finite state machine is the gated idle state, if the value of the input instruction valid signal is true, the value of the gated state register is updated to the gated check state; otherwise, the gated idle state is maintained. When the reset signal is invalid and the current state is the gate control check state, if the gate control integration pass flag is true, the value of the gate control status register will be updated to the gate control release state. If the gating synthesis pass flag is false and the trap enable bit is true, then the value of the gating status register is updated to the gating trap state; if the gating synthesis pass flag is false and the trap enable bit is false, then the value of the gating status register is updated to the gating block state. When the reset signal is invalid and the current state is gate release state, gate blocking state, or gate trapped state, the value of the gate status register is updated to the gate idle state. When the reset signal is invalid and the current state is an undefined state of the finite state machine, the value of the gated state register is updated to the gated idle state.

14. The semantically aware security processor for verifiable instruction execution as described in claim 1, characterized in that, It also includes an authentication generation unit, used for: A summary of the execution results is generated after the instruction is executed; Based on quantum-resistant signatures, an authentication token is generated according to the semantic digest, policy verification result, current context identifier, and execution result digest.

Images