CN102521166B - Information safety coprocessor and method for managing internal storage space in information safety coprocessor - Google Patents

Abstract

The present invention provides a method for managing internal storage space in an information security coprocessor, comprising the following steps: dividing the local address space into a safe space and a non-safe space, wherein the safe space is used to store confidential information ; Initialize the size of the secure space and the non-secure space; use the local address space to store confidential information in the secure space, and configure the size of the secure space and the non-secure space as required; in the information security coprocessor Data processing is carried out within, wherein, when at least one input data exists in the secure space, and the input can be calculated from the output, the corresponding output data is not allowed to be written into the non-secure space or the external storage space. While protecting important data, the invention also facilitates the use of coprocessors. At the same time, the size of the safe space in the present invention can be changed as required, thereby facilitating different application requirements and system development.

Description

Information Security Coprocessor and Management Method of Its Internal Storage Space

technical field

The invention relates to the field of information security processing, in particular to an information security coprocessor using cryptographic algorithms and a management method for its internal storage space.

Background technique

With the rapid development of network technology, information security technology has become particularly important at present. For the ever-increasing network traffic, simply using software to encrypt or decrypt the data stream can no longer meet the demand, so the method of building a dedicated cryptographic chip implemented by hardware is called a new trend. Current information security chips include single-function types (such as DES, 3DES, AES, RSA, etc.), multi-function types, high-end chips, SOC, ASIC, etc. In embedded system (Embedded System) applications, chips that provide information security solutions are widely used. In a SOC system, the information security processor will appear in the form of a co-processor.

However, a coprocessor that provides information security protection functions can simply perform some cryptographic algorithms without providing other protection; it can also be a complex subsystem that provides a complete solution and a secure execution environment. The first type of coprocessor is relatively easy to embed in different systems, but the security protection at the system level is difficult and complex. The second type of coprocessor provides a good security solution, but limits the design flexibility of the system that uses it.

Different from the above two types, it is very necessary to provide a new coprocessor with security protection measures, so as to reduce the burden of information protection at the system level while maintaining the flexibility of system design.

Contents of the invention

In order to solve the above-mentioned technical problems, the object of the present invention is to provide an information security coprocessor, which stores information by providing an externally visible local storage space that includes two areas, safe and unsafe, with configurable sizes , where information stored in the secure area is not accessible outside the processor. While realizing information confidentiality, the information security processor can facilitate different application requirements and system development.

Correspondingly, the purpose of the present invention is also to provide a method for managing the internal storage space in the information security coprocessor.

In order to achieve one of the purposes of the above invention, an information security coprocessor of the present invention includes the following units:

Local address space unit: including a safe space and a non-safe space, both of which can be configured, and the data stored in the safe space cannot be directly read out of the processor;

Control unit: used for process control through certain control logic;

Mathematical operation unit: used to realize mathematical operations;

Cryptographic algorithm engine: used to execute cryptographic algorithms to realize encryption or decryption functions.

As a further improvement of the present invention, the information security coprocessor also includes a DMA engine responsible for data transmission between the AHB bus and the local address space unit.

As a further improvement of the present invention, the information security coprocessor further includes a register file.

As a further improvement of the present invention, the register file includes a control register and a status register.

As a further improvement of the present invention, the mathematical operation includes copying, or XOR operation, or a combination of the above two.

In order to achieve another object of the present invention, a method for managing internal storage space in an information security coprocessor, the information security coprocessor has an externally visible local address space, the method includes the following steps:

S1. Dividing the local address space into a secure space and a non-secure space, wherein the data stored in the secure space cannot be directly read out of the processor;

S2. Initialize the size of the safe space and the non-safe space;

S3. Using the local address space, store the confidential information in a secure space, and configure the size of the secure space and the non-secure space as required;

S4. Perform data processing in the information security coprocessor, wherein, when at least one input data exists in the safe space, and the input can be obtained by output calculation, the corresponding output data is not allowed to be written into non-safe space or external storage.

As a further improvement of the present invention, the data processing manner includes mathematical operations, wherein the mathematical operations include copying, or XOR operations, or a combination of the above two.

As a further improvement of the present invention, the step of "configuring the size of the safe space and the non-safe space according to needs" in the step S3 is specifically:

The division of the safe space and the non-safe space can be changed, wherein the size of the safe space can only be increased, and the area originally belonging to the safe space cannot be changed into a non-safe space.

As a further improvement of the present invention, the method also includes transferring data between the AHB bus and the local address space through the DMA engine.

Compared with the prior art, the present invention provides a configurable and externally visible security space for storing confidential information, which not only protects important data, but also facilitates the use of coprocessors. At the same time, the size of the safe space in the present invention can be changed as required, thereby facilitating different application requirements and system development.

Description of drawings

Fig. 1 is a working principle diagram of an information security coprocessor in an embodiment of the present invention;

Fig. 2 is a schematic diagram of the use flow of the security space of the information security processor in an embodiment of the present invention;

FIG. 3 shows four configurations of safe space and non-safe space of an information security processor in an embodiment of the present invention;

Fig. 4 is a working flowchart of the method for managing the internal storage space of the information security coprocessor in an embodiment of the present invention.

Detailed ways

The present invention will be described in detail below in conjunction with specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, method, or functional changes made by those skilled in the art according to these embodiments are included in the protection scope of the present invention.

Please refer to shown in Fig. 1, in a specific embodiment of the present invention, a kind of information security coprocessor comprises following units: local address space unit 10, control unit 20, mathematical operation unit, cryptographic algorithm engine 40, DMA (Direct Memory Access, direct memory access) engine 50 and register file 60. A coprocessor often needs a certain amount of internal storage space, and the important safety-related data stored in it needs strict protection. On the other hand, the memory space of the coprocessor also requires a certain degree of external visibility for ease of use. The invention proposes a set of management schemes for the internal storage space of the coprocessor, which not only protects important data, but also facilitates the use of the coprocessor.

Wherein, in this embodiment, DMA (Direct Memory Access, direct memory access) engine 50 is used for being responsible for the data transmission between AHB bus and local address space unit, in other embodiments, DMA engine can be replaced by other can realize Parts with similar functions. Wherein, the present invention adopts two kinds of buses to carry out data transmission: AHB (Advanced High performance Bus) system bus and APB (Advanced Peripheral Bus) peripheral bus, AHB is mainly used for high-performance modules (such as CPU, DMA and DSP etc.) between Connection; APB is mainly used for connection between low-bandwidth peripherals, such as UART, 1284, etc.

The register file 60 includes control registers for controlling and determining the operating mode of the processor and the characteristics of the currently executing task, various state information status registers for reflecting the execution results of the current instruction, and the like. The register file 60 can perform data transmission between APB buses.

The local address space unit 10 includes a safe space and a non-safe space, both of which are configurable, and the data stored in the safe space cannot be directly read out of the processor; the coprocessor local address space is externally visible and is divided into safe and Unsafe two pieces. In order to prevent the information stored in the security area from being leaked, for the following two paths: (1) from the local address space to the AHB bus via the DMA engine, (2) from the local address space via the "=" (copy) in the mathematical operation unit Or "xor" (exclusive OR) operation to the local address space, when there is input data in the secure address space, the output data is not allowed to be written into the non-secure address space or external storage space, and the data stored by the cryptographic algorithm engine Rules are hardened by hardware.

Regarding external visibility and external unavailability of data in a secure enclave, these two are not contradictory. The entire local memory is externally visible, but data in the secure area is prohibited from being read. The same address, when classified as a security zone, is visible but not readable. When classified as a non-secure area, the address is visible and can be read.

The control unit 20 is used for process control through certain control logic;

The mathematical operation unit 30 is used to implement mathematical operations, wherein, in this embodiment, the mathematical operations may include copying, or XOR operations, or a combination of the above two.

The cryptographic algorithm engine 40 is used to execute cryptographic algorithms to implement encryption or decryption functions. A cryptographic algorithm is a mathematical function used for encryption and decryption, and a cryptographic algorithm is the basis of a cryptographic protocol.

In the present invention, since the externally visible (direct or indirect) address space of the coprocessor is divided into two types: safe and unsafe. If the data processing inside the coprocessor is used (y1, ..., yM) = f(x1, ..., xN), M>0, N>0, it means that when the input parameters of the function can be deduced from the result, As long as at least one of the input parameters xi, i=1,...,N of the function comes from the secure address space in whole or in part, all function results cannot exist in the non-secure address space or the external address space in whole or in part.

As shown in Figure 2, when the system is hard reset, the secure boot process starts. During the secure boot process, the size of the security space is initialized. ), start using the coprocessor. During the process, the safe space ratio can be increased again as needed. After a hard reset, the division of the coprocessor's secure address space and non-secure address space can be changed, but the size of the secure address space can only be increased, and the area originally belonging to the secure address space cannot be changed to a non-secure address space.

As shown in Figure 3, in this embodiment, the local address space is a 4KB storage space. For the 4KB local address space here, the security area and the non-security area allow four configurations as shown in the figure, corresponding to four Configuration number: 0, 1, 2, 3. After a hard reset, configuration 0 is adopted. There is a flag in the register file. When it is set to 1, it will be changed to the configuration corresponding to the next number of the current number, and the flag will be cleared to 0.

As shown in Figure 4, in a specific embodiment of the present invention, a method for managing internal storage space in an information security coprocessor is implemented using the above-mentioned information security coprocessor, and the information security The coprocessor has an externally visible local address space, and the method includes the following steps:

S1. Divide the local address space into a secure space and a non-secure space, wherein the data stored in the secure space cannot be directly read out of the processor; both the secure space and the non-secure space are externally visible, so it is more convenient Use, and both are also configurable, so it is convenient to make corresponding changes according to needs.

Regarding external visibility and external unavailability of data in a secure enclave, these two are not contradictory. The entire local memory is externally visible, but data in the secure area is prohibited from being read. The same address, when classified as a security zone, is visible but not readable. When classified as a non-secure area, the address is visible and can be read.

S2, initialize the size of the safe space and the non-safe space; preferably, initialize by hard reset, the safe space after initialization is [0KB, 0KB), and the non-safe space is [0KB, 4KB), corresponding to configuration number 0.

S3. Using the local address space, encrypt the confidential information through a cryptographic algorithm and store it in the safe space, and configure the size of the safe space and the non-safe space according to the needs; here it means that the space of the safe space can be appropriately increased to suit the needs.

S4. Perform data processing in the information security coprocessor, wherein, when at least one input data exists in the safe space, and the input can be obtained by output calculation, the corresponding output data is not allowed to be written into non-safe space or external storage. Since the externally visible (direct or indirect) address space of the coprocessor is divided into two types, safe and unsafe. If the data processing inside the coprocessor is used (y1, ..., yM) = f(x1, ..., xN), M>0, N>0, it means that when the input parameters of the function can be deduced from the result, As long as at least one of the input parameters xi, i=1,...,N of the function comes from the secure address space in whole or in part, all function results cannot exist in the non-secure address space or the external address space in whole or in part.

Wherein, preferably, the data processing manner includes mathematical operations, wherein the mathematical operations include copying, or XOR operations, or a combination of the above two.

Wherein, preferably, the step of "configuring the size of the safe space and the non-safe space according to needs" in the step S3 is specifically:

The division of the safe space and the non-safe space can be changed, wherein the size of the safe space can only be increased, and the area originally belonging to the safe space cannot be changed into a non-safe space.

Wherein, preferably, the method further includes transferring data between the AHB bus and the local address space through the DMA engine.

Compared with the prior art, the present invention provides a configurable and externally visible security space for storing confidential information, which not only protects important data, but also facilitates the use of coprocessors. At the same time, the size of the safe space in the present invention can be changed as required, thereby facilitating different application requirements and system development.

The device implementations described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without creative effort.

For the convenience of description, when describing the above devices, functions are divided into various units and described separately. Of course, when implementing the present application, the functions of each unit can be implemented in one or more pieces of software and/or hardware.

The device implementations described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without creative effort.

This application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.

It should be understood that although this description is described according to implementation modes, not each implementation mode only contains an independent technical solution, and this description in the description is only for clarity, and those skilled in the art should take the description as a whole, and each The technical solutions in the embodiments can also be properly combined to form other embodiments that can be understood by those skilled in the art.

The series of detailed descriptions listed above are only specific descriptions for feasible implementations of the present invention, and they are not intended to limit the protection scope of the present invention. Any equivalent implementation or implementation that does not depart from the technical spirit of the present invention All changes should be included within the protection scope of the present invention.

Claims (3)

1. A method for managing internal storage space in an information security coprocessor, characterized in that the information security coprocessor has an externally visible local address space, and the method comprises the steps of: S1. Dividing the local address space into a secure space and a non-secure space, wherein the data stored in the secure space cannot be directly read out of the processor; S2. Initialize the size of the safe space and the non-safe space; S3. Using the local address space, store confidential information in a secure space, and configure the size of the secure space and the non-secure space as required; the division of the secure space and the non-secure space can be changed, and the size of the secure space only can be added, and the area originally belonging to the safe space cannot be changed to a non-safe space; S4. Perform data processing in the information security coprocessor, wherein, when at least one input data exists in the safe space, and the input can be obtained by output calculation, the corresponding output data is not allowed to be written into non-safe space or external storage. 2 . The method according to claim 1 , wherein the data processing method includes mathematical operations, wherein the mathematical operations include copying, or XOR operations, or a combination of copying and XOR operations. 3. The method according to claim 1, further comprising transferring data between the AHB bus and the local address space through a DMA engine.