Summary of the invention
For solving the problems of the technologies described above; The object of the present invention is to provide a kind of information security coprocessor; It carries out the storage of information through an outside local storage space visible, that comprise configurable safe and dangerous two zones of size is provided, and the information that wherein is stored in the safety zone can not be processed the device outside and obtain.When realizing information privacy, this information security processor can make things convenient for different application requirements and system development.
Correspondingly, the present invention also aims to provide the management method of internal storage space in a kind of above-mentioned information security coprocessor.
For realizing one of foregoing invention purpose, a kind of information security coprocessor of the present invention comprises like lower unit:
The local address space cell: comprise a safe space and a non-safe space, both are all configurable, and the data that are stored in the safe space can not be by direct read-out processor;
Control module: be used for carrying out flow process control through certain steering logic;
Mathematical operation unit: be used to realize mathematical operation;
Cryptographic algorithm engine: be used to carry out cryptographic algorithm, to realize encryption or decipher function.
As further improvement of the present invention, said information security coprocessor comprises that also one is used for being responsible for the DMA engine of data transmission between ahb bus and the local address space cell.
As further improvement of the present invention, said information security coprocessor also comprises a register file.
As further improvement of the present invention, said register file comprises control register and status register.
As further improvement of the present invention, said mathematical operation comprises duplicates or XOR, or above both combination.
For realizing another goal of the invention of the present invention, the management method of internal storage space in a kind of information security coprocessor, said information security coprocessor has an outside visible local address space, and said method comprises the steps:
S1, be a safe space and a non-safe space with said local address spatial division, wherein, the data that are stored in the safe space can not be by direct read-out processor;
The size of S2, the said safe space of initialization and non-safe space;
S3, the said local address of use space are stored in the safe space with security information, dispose the size of said safe space and non-safe space as required;
S4, in said information security coprocessor, carry out data processing; Wherein, When at least one input data is present in the safe space, and import in the time of can being obtained by the output calculation, corresponding output data does not all allow to write non-safe space or external memory space.
As further improvement of the present invention, the mode of said data processing comprises mathematical operation, and wherein, said mathematical operation comprises duplicates or XOR, or above both combination.
As further improvement of the present invention, the step that " disposes the size of said safe space and non-safe space as required " among the said step S3 is specially:
The division of said safe space and non-safe space can be changed, and wherein, the size of safe space can only increase, and the zone that belonged to the safe space originally can not be modified and is non-safe space.
As further improvement of the present invention, this method also comprises through the DMA engine transmits data between ahb bus and local address space.
Compared with prior art, the present invention carries out the storage of security information through configurable, an outside visible safe space is provided, and when having protected significant data, has also made things convenient for the use to coprocessor.Simultaneously, the size of safe space can be changed as required among the present invention, thereby has made things convenient for different application requirements and system development.
Embodiment
Below will combine embodiment shown in the drawings to describe the present invention.But these embodiments do not limit the present invention, and the conversion on the structure that those of ordinary skill in the art makes according to these embodiments, method or the function all is included in protection scope of the present invention.
Please with reference to shown in Figure 1; In the embodiment of the invention; A kind of information security coprocessor; Comprise like lower unit: local address space cell 10, control module 20, mathematical operation unit, cryptographic algorithm engine 40, DMA (Direct Memory Access, direct memory access) engine 50 and register file 60.A coprocessor often needs certain internal storage space, and the important safety related data that leaves in wherein needs strict protection.On the other hand, the storage space of coprocessor also requires certain external visibility to use with convenient.The present invention proposes the Managed Solution of a cover coprocessor internal storage space, when having protected significant data, also made things convenient for use coprocessor.
Wherein, In this embodiment, DMA (Direct Memory Access, direct memory access) engine 50 is used for being responsible for data transmission between ahb bus and the local address space cell; In other embodiments, the DMA engine is replaceable can realize the parts of similar functions for other.Wherein, The present invention adopts two kinds of buses to carry out data transmission: AHB (Advanced High performance Bus) system bus and APB (Advanced Peripheral Bus) peripheral bus, and AHB is mainly used in the connection between the high-performance module (like CPU, DMA and DSP etc.); APB is mainly used in the connection between the peripheral peripheral hardware of low bandwidth, for example UART, 1284 etc.
Register file 60 comprises and is used to control and the control register of the characteristic of the operator scheme of definite processor and current executed task, is used to various status information status registers that embody the present instruction execution result or the like.Register file 60 can carry out data transmission between the APB bus.
Local address space cell 10 comprises a safe space and a non-safe space, and both are all configurable, and the data that are stored in the safe space can not be by direct read-out processor; Coprocessor local address space is outside visible, is divided into safe and dangerous two.In order to prevent that the information that is stored in the safety zone from being leaked; For following two paths: (one) by the local address space through the DMA engine to ahb bus, (two) by local address space "=" (duplicating) in the mathematical operation unit perhaps after " xor " (XOR) computing to the local address space; When the input data are present in the secure address space; Do not allow output data to write non-secure address space or external memory space, solidify by hardware through the rule of depositing of the data of cryptographic algorithm engine.
About the outside non-availability property of data in external visibility and the safety zone, these two contradictions not.Whole local storage is outside visible, but the data of safety zone forbid being read.Same address, when being divided into the safety zone, this address is it is thus clear that but can not be read.When being divided into non-safety zone, this address is visible also can be read.
Control module 20 is used for carrying out flow process control through certain steering logic;
Mathematical operation unit 30 is used to realize mathematical operation, and wherein, in this embodiment, mathematical operation can comprise duplicates or XOR, or above both combination.
Cryptographic algorithm engine 40 is used to carry out cryptographic algorithm, to realize encryption or decipher function.Cryptographic algorithm is the mathematical function that is used for encryption and decryption, and cryptographic algorithm is the basis of cipher protocol.
In the present invention, because outside visible (directly or indirectly) address space of coprocessor is divided into safe and dangerous two kinds.If the data processing of coprocessor inside is used (y1 ..., yM)=f (x1 ... XN), M>0, N>0, expression; When the input parameter of function can be released by the result is counter, if the input parameter xi of function, i=1 ... N, in have at least one all or part of from the secure address space, all function result all can not all or part ofly be present in non-secure address space or the external address space.
Join shown in Figure 2, behind system's hard reset, the beginning secure launch process; In carrying out secure launch process, initialization safe space size is after clean boot finishes; Can adjust the ratio (safe space can only increase) of safe space and non-safe space, bring into use coprocessor.Can increase the safe space ratio as required once more in the process.Behind a hard reset, the secure address space of coprocessor and non-secure address space dividing can be changed, but the size in secure address space can only increase, and the zone that belonged to the secure address space originally can not be modified and is non-secure address space.
Join shown in Figure 3ly, in this embodiment, the local address space is the storage space of 4KB, and for the local address space of 4KB here, place of safety and non-place of safety allow four kinds of configurations as shown in the figure, corresponding respectively four configuration numberings: 0,1,2,3.Behind a hard reset, configuration 0 is used.Have a mark in the register file, when it is changed to 1, the next one that then changes to current numbering is numbered pairing configuration, and with this mark clear 0.
As shown in Figure 4; In an embodiment of the present invention; The management method of internal storage space in a kind of information security coprocessor; This method uses the above-mentioned information security coprocessor of mentioning to realize, said information security coprocessor has visible local address space, an outside, and this method comprises the steps:
S1, be a safe space and a non-safe space with said local address spatial division, wherein, the data that are stored in the safe space can not be by direct read-out processor; Safe space and non-safe space are outside visible, thus more convenient use, and both also are configurable, so also are convenient to do corresponding change according to demand.
About the outside non-availability property of data in external visibility and the safety zone, these two contradictions not.Whole local storage is outside visible, but the data of safety zone forbid being read.Same address, when being divided into the safety zone, this address is it is thus clear that but can not be read.When being divided into non-safety zone, this address is visible also can be read.
The size of S2, the said safe space of initialization and non-safe space; Preferably, come initialization through hard reset, the safe space after the initialization is that [0KB, 0KB), [0KB 4KB), numbers 0 corresponding to configuration in non-safe space.
S3, use said local address space, be stored in the safe space after security information is encrypted through cryptographic algorithm, dispose the size of said safe space and non-safe space as required; Here say to refer to, the safe space can suitably increase the space with adaption demand.
S4, in said information security coprocessor, carry out data processing; Wherein, When at least one input data is present in the safe space, and import in the time of can being obtained by the output calculation, corresponding output data does not all allow to write non-safe space or external memory space.Because outside visible (directly or indirectly) address space of coprocessor is divided into safe and dangerous two kinds.If the data processing of coprocessor inside is used (y1 ..., yM)=f (x1 ... XN), M>0, N>0, expression; When the input parameter of function can be released by the result is counter, if the input parameter xi of function, i=1 ... N, in have at least one all or part of from the secure address space, all function result all can not all or part ofly be present in non-secure address space or the external address space.
Wherein, preferably, the mode of said data processing comprises mathematical operation, and wherein, said mathematical operation comprises duplicates or XOR, or above both combination.
Wherein, preferably, the step that " disposes the size of said safe space and non-safe space as required " among the said step S3 is specially:
The division of said safe space and non-safe space can be changed, and wherein, the size of safe space can only increase, and the zone that belonged to the safe space originally can not be modified and is non-safe space.
Wherein, preferably, this method also comprises through the DMA engine transmits data between ahb bus and local address space.
Compared with prior art, the present invention carries out the storage of security information through configurable, an outside visible safe space is provided, and when having protected significant data, has also made things convenient for the use to coprocessor.Simultaneously, the size of safe space can be changed as required among the present invention, thereby has made things convenient for different application requirements and system development.
Device embodiments described above only is schematic; Wherein said unit as the separating component explanation can or can not be physically to separate also; The parts that show as the unit can be or can not be physical locations also; Promptly can be positioned at a place, perhaps also can be distributed on a plurality of NEs.Can realize the purpose of this embodiment scheme according to the needs selection some or all of module wherein of reality.Those of ordinary skills promptly can understand and implement under the situation of not paying creative work.
For the convenience of describing, be divided into various unit with function when describing above the device and describe respectively.Certainly, when implementing the application, can in same or a plurality of softwares and/or hardware, realize the function of each unit.
Device embodiments described above only is schematic; Wherein said unit as the separating component explanation can or can not be physically to separate also; The parts that show as the unit can be or can not be physical locations also; Promptly can be positioned at a place, perhaps also can be distributed on a plurality of NEs.Can realize the purpose of this embodiment scheme according to the needs selection some or all of module wherein of reality.Those of ordinary skills promptly can understand and implement under the situation of not paying creative work.
The application can describe in the general context of the computer executable instructions of being carried out by computing machine, for example program module.Usually, program module comprises the routine carrying out particular task or realize particular abstract, program, object, assembly, data structure or the like.Also can in DCE, put into practice the application, in these DCEs, by through communication network connected teleprocessing equipment execute the task.In DCE, program module can be arranged in this locality and the remote computer storage medium that comprises memory device.
Be to be understood that; Though this instructions is described according to embodiment; But be not that each embodiment only comprises an independently technical scheme, this narrating mode of instructions only is for clarity sake, and those skilled in the art should make instructions as a whole; Technical scheme in each embodiment also can form other embodiments that it will be appreciated by those skilled in the art that through appropriate combination.
The listed a series of detailed description of preceding text only is specifying to feasibility embodiment of the present invention; They are not in order to restriction protection scope of the present invention, allly do not break away from equivalent embodiment or the change that skill of the present invention spirit done and all should be included within protection scope of the present invention.