CN106155940A - The System on Chip/SoC of code and the code protection method of System on Chip/SoC can be protected - Google Patents
The System on Chip/SoC of code and the code protection method of System on Chip/SoC can be protected Download PDFInfo
- Publication number
- CN106155940A CN106155940A CN201510183908.5A CN201510183908A CN106155940A CN 106155940 A CN106155940 A CN 106155940A CN 201510183908 A CN201510183908 A CN 201510183908A CN 106155940 A CN106155940 A CN 106155940A
- Authority
- CN
- China
- Prior art keywords
- code
- request
- instruction
- chip
- block
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Abstract
A kind of System on Chip/SoC protecting code and the code protection method of System on Chip/SoC.This System on Chip/SoC includes memorizer, safe processor and the first bridgt circuit.Memorizer includes main storage block and safe storage block, and the code protection block of safe storage block stores advanced security level code.Safe processor sends access request to access memorizer, to perform advanced security level code.First bridgt circuit is coupled between safe processor and memorizer.If access request extracts request for instruction, the first bridgt circuit checks that this instruction is extracted the instruction corresponding to request and extracted whether address is positioned in code protection block.Not being positioned in code protection block if address is extracted in instruction, the first bridgt circuit passback null value or error message are to safe processor.
Description
Technical field
The invention relates to a kind of information security technology, and in particular to a kind of System on Chip/SoC protecting code
Code protection method with System on Chip/SoC.
Background technology
Recently, various digital contents are provided to user's set the most widely, such as many matchmakers such as TV, computer and Set Top Boxes
Volume data processing means.Digital content can include video file, audio file, various application program etc..Along with number
How the positive supply of word content, protect the intellectual property of digital content also for important problem.In general, user
The digital information received by apparatus for processing multimedia data through encryption, and multimedia-data procession dress
Put and key must be utilized to decipher.Additionally, in order to obtain the digital content with intellectual property, user generally also needs
There is provided or set the personal information such as account or password, allowing media provider can provide digital content according to user right.
It is apparent that the System on Chip/SoC of apparatus for processing multimedia data not only must handle many high confidential datas, in addition it is also necessary to
Perform many advanced security level code and guarantee information security.Therefore, apparatus for processing multimedia data now is
System chip generally is equipped with exclusive safe processor, to provide safe content to pass under reliable hardware environment
Defeated.But, rogue program or hacker still can order about safe processor through the leak in programming and perform non-
Intended instruction, and further result in high confidential data and be exposed to advanced security level code and to be stolen and to be tampered
Among risk.Therefore, how to guarantee these high confidential datas and advanced security level code will not be stolen mala fide or
Distort actually those skilled in the art subject under discussion of interest.
Summary of the invention
In view of this, the present invention provides a kind of System on Chip/SoC protecting code and the code protection method of System on Chip/SoC,
Can promote advanced security level code in run time safety, thus avoid the advanced security grade generation of System on Chip/SoC
Code is tampered or steals.
The present invention proposes a kind of System on Chip/SoC protecting code, this System on Chip/SoC include memorizer, safe processor with
And first bridgt circuit.Memorizer includes main storage block and safe storage block, and safe storage block
Code protection block stores advanced security level code.Safe processor sends access request to access memorizer, with
Perform advanced security level code.First bridgt circuit is coupled between safe processor and memorizer.If access request
Extracting request for instruction, the first bridgt circuit checks that this instruction is extracted the instruction corresponding to request and extracted whether address is positioned at
In code protection block.It is not positioned in code protection block if address is extracted in instruction, the first bridgt circuit passback null value (null)
Or error message is to safe processor.
In one embodiment of this invention, through the first bridgt circuit, memorizer is sent this when above-mentioned safe processor
Access request, the first bridgt circuit judges that access request extracts request or reading and writing data request as instruction.
In one embodiment of this invention, it is positioned in code protection block if address is extracted in above-mentioned instruction, the first bridge joint
Circuit extracts request according to instruction and extracts the instruction of advanced security level code from memorizer and perform the operation of correspondence, and
Address is extracted for instruction in the address that instruction is stored in memorizer.
In one embodiment of this invention, if above-mentioned access request is reading and writing data request, the first bridgt circuit judges
Whether reading and writing data request is the illegal write request writing data into code protection block.If reading and writing data request is for non-
Method write request, reading and writing data request ignored by the first bridgt circuit.
In one embodiment of this invention, if above-mentioned reading and writing data request is not illegal write request, the first bridge joint electricity
Road is according to reading and writing data request read-write safe storage block or main storage block.
In one embodiment of this invention, above-mentioned System on Chip/SoC further includes primary processor and the second bridgt circuit.The
Two bridgt circuits are coupled between primary processor and memorizer, primary processor have accessing main memory block authority but
Not there is the authority of access safe storage block.
In one embodiment of this invention, above-mentioned System on Chip/SoC includes that read only memory and safe processor include checking
Unit.Read only memory stores protected data, and authentication unit is decrypted program to protected data and obtains height
Level security level code, and advanced security level code is write to safe storage block.
In one embodiment of this invention, above-mentioned authentication unit more carries out signature verification inspection to advanced security level code
Look into.When advanced security level code is checked by signature verification, safe processor sets the memorizer of code protection block
Position.
In one embodiment of this invention, above-mentioned System on Chip/SoC further includes buffer, when advanced security level code leads to
Crossing signature verification inspection, safe processor is by the memory location write registers of code protection block.
From the point of view of another viewpoint, the present invention proposes the code protection method of a kind of System on Chip/SoC.Above-mentioned System on Chip/SoC bag
Including memorizer and safe processor, this memorizer includes main storage block and safe storage block.Code protection
Method comprises the following steps.Store advanced security level code in the code protection block of safe storage block.Foundation
The access request that safe processor is sent is to access memorizer.If access request extracts request for instruction, check instruction
Extract the instruction corresponding to request and extract whether address is positioned in code protection block.If address is extracted in instruction is not positioned at generation
In code protection block, passback null value or error message are to safe processor.
Based on above-mentioned, in the code protection method of an embodiment, by the first bridgt circuit monitoring safe processor pair
The access request of memorizer, and decision instruction extracts whether address is positioned at code protection block further.If instruction carries
Taking address not to be positioned in code protection block, passback null value or error message are to safe processor.So, peace can be avoided
Full processor performs unexpected malicious code, and guarantees that safe processor is run and through the senior peace of signature verification
Full level code is not exposed among the risk that is tampered or is stolen.
For the features described above of the present invention and advantage can be become apparent, special embodiment below, and coordinate institute's accompanying drawings
It is described in detail below.
Accompanying drawing explanation
The block chart of the Fig. 1 System on Chip/SoC by being painted according to one embodiment of the invention.
Fig. 2 is the flow chart according to the code protection method depicted in one embodiment of the invention.
Fig. 3 is the example schematic according to the code protection method depicted in one embodiment of the invention.
Fig. 4 is the block chart according to the System on Chip/SoC depicted in one embodiment of the invention.
Fig. 5 is the flow chart according to the code protection method depicted in one embodiment of the invention.
Description of reference numerals
10,20: System on Chip/SoC
110,210: primary processor
120,220: safe processor
130,140,230,240: bridgt circuit
150,250: memorizer
150a, 250a: main storage block
150b, 250b: safe storage block
151,251: code protection district is fast
C1, C2: advanced security level code
160: memory control unit
31,32,33,38: access request
35,36: instruction
37: data
B1: memory heap boundaries
270: buffer
280: read only memory
221: authentication unit
P1: protected data
S201～S204, S501～S512: step
Detailed description of the invention
The present invention through bridgt circuit and the interconnective characteristic of memorizer, utilizes bridgt circuit by safe processor system
Check the access request that safe processor is sent.The instruction that safe processor to be performed is checked by bridgt circuit
Whether it is stored in a protected field of memorizer, to avoid safe processor by hacker or malice when system is run
Program induction goes to perform unexpected instruction or rogue program.In order to make the content of the present invention become apparent from, it is exemplified below
The example that embodiment can actually be implemented according to this as the present invention.
The block chart of the Fig. 1 System on Chip/SoC by being painted according to one embodiment of the invention.Refer to Fig. 1, System on Chip/SoC
(System On Chip, SOC) 10 include primary processor 110, safe processor (Security CPU, SCPU) 120,
Bridgt circuit 130, bridgt circuit 140, memorizer 150 and memory control unit (Memory Management
Unit, MMU) 160.System on Chip/SoC 10 may be disposed in an apparatus for processing multimedia data, above-mentioned multimedia number
According to processing means e.g. top box of digital machine (Set Top Box, STB), intelligent television (Smart TV), holder for TV playing
Or the electronic installation that DVD player etc. is in order to receive the audio/video content that third party content supplier is provided.
Primary processor 110 and safe processor 120 can be by have the hardware unit of operational capability, hardware circuit with
And buffer is constituted.Primary processor 110 is responsible for most running of System on Chip/SoC 10 and is processed with general data, and pacifies
The data of the task and confidentiality that advanced security sensitivity be responsible for by full processor 120 process.For example, primary processor
110 can be responsible for power management, the general utility functions such as audio effect processing or image processing.It is close that safe processor 120 can manage root
Key (root key), perform clean boot first, send third party content supplier secret, send user secret letter
Breath, execution Digital Right Management (Digital Right Management, DRM) or execution watermark process etc..Letter
For list, safe processor 120 is in order to protect code and the data of high secret.
Primary processor 110 couples bridgt circuit 130, and safe processor 120 couples bridgt circuit 140.In this enforcement
In example, bridgt circuit 130 and bridgt circuit 140 e.g. north bridge chips, but this is not limiting as by the present invention, as long as
In order to connect what the chipset of primary processor 110, safe processor 120 and memorizer 150 was all contained in the present invention
In the range of.Bridgt circuit 130 and bridgt circuit 140 are coupled to memorizer 150 via memory control unit 160.
In the present embodiment, memory control unit 160 provides conversion virtual memory address to corresponding physical memory
The ability of address.In simple terms, memory control unit 160 in order to manage the physical memory address of memorizer 150,
And primary processor 110 is linked up with memorizer 150 through memory control unit 160 with safe processor 120.Citing
For, in the present embodiment, safe processor 120 can be belonging to the virtual memory in ARMV7-a architecture
System architecture (Virtual Memory System Architecture, VMSA).Specifically be, although this enforcement
Example system is coupled between primary processor 110, safe processor 120 and memorizer 150 with memory control unit 160
As a example by illustrate, but in another embodiment memory control unit 160 be not necessity, seem safe processor 120
Protection storage system architecture (the Protected Memory System can also being belonging in ARMV7-a architecture
Architecture, PMSA).
Memorizer 150 can be static RAM (Static Radom Access Memory, SRAM) with
Dynamic random access memory (Dynamic Radom Access Memory, DRAM), this is not limiting as by the present invention.
Memorizer 150 includes main storage block 150a and safe storage block 150b.In an embodiment, safety is deposited
Memory block 150b is configured and accesses for safe processor 120, and primary processor 110 cannot access safe storage
Device block 150b.In other words, although primary processor 110 does not allow to access safe storage block 150b, but safe place
Reason device 120 is configured and has and safe storage block 150b carries out data write and the ability read.On the other hand,
Main storage block 150a is configured and is available for primary processor 110 and accesses with safe processor 120.In other words, main
Processor 110 all has the ability accessing main storage block 150a with safe processor 120.That is, primary processor
110 authorities with accessing main memory block 150a but do not have access safe storage block 150b authority.
But, in order to ensure safe processor 120 run code be all the time through checking code, the present embodiment it
Safe storage block 150b is configured and has code protection block 151, and code protection block 151 stores height
Level security level code C1.Safe processor 120 can send access request to access memorizer 150, senior to perform
Safe class code C1.Base this, by checking that request (instruction is extracted in the instruction that sent of safe processor 120
Fetch request) corresponding to storage address, it is non-that bridgt circuit 140 can determine whether whether safe processor 120 will run
Intended instruction.Specifically, judge that extraction is stored in main storage by safe processor 120 when bridgt circuit 140
During instruction among block 150a, bridgt circuit 140 can return null value (Null) or error message to safe processor 120.
Fig. 2 is the flow chart according to the code protection method depicted in one embodiment of the invention.Refer to Fig. 2, this reality
The each element executed in the mode of the example System on Chip/SoC 10 be applicable to above-described embodiment, the most i.e. collocation Fig. 1 is said with module
The detailed step of bright the present embodiment code protection method.
First, in step S201, safe processor 120 stores advanced security level code C1 in safe storage district
The code protection block 151 of block 150b.Advanced security level code C1 is the journey of the task of relating to advanced security grade
Sequence code section.For example, advanced security level code C1 e.g. relates to the use of the procedure code that root key is decrypted
Section or relate to the procedure code section of secret processing third party content supplier.In other words, safe processor 120 can be transported
Row advanced security level code C1 utilizes root key to be decrypted or handles the secret of third party content supplier.
In step S202, the access request (access request) that bridgt circuit 140 is sent according to safe processor 120
Access memorizer 150.In step S203, if access request extracts request for instruction, bridgt circuit 140 checks and refers to
Order is extracted the instruction corresponding to request and is extracted whether address is positioned in code protection block 151.In step S204, if referring to
Order is extracted address and is not positioned in the code protection block 151 of safe storage block 150b, and bridgt circuit 140 returns sky
Value or error message are to safe processor 120.So, safe processor 120 can be avoided because of the induction of rogue program
And perform the instruction being not belonging in code protection block 151, so that it is guaranteed that the secret in advanced security level code C1
Information is not exposed among the risk that is stolen.
Specifically, Fig. 3 is the example schematic according to the code protection method depicted in one embodiment of the invention.Please
With reference to Fig. 3, memorizer 150 is divided into main storage block 150a and safe storage district according to memory heap boundaries B1
Block 150b, and safe storage block 150b further includes the code protection block 151 storing advanced security level code.
When safe processor 120 sends access request 31, bridgt circuit 140 judges that access request 31 is extracted as instruction asks
Ask or reading and writing data request.In this example, owing to access request 31 extracts request, and access request 31 for instruction
Corresponding instruction is extracted address and is positioned among code protection block 151.It is to say, corresponding to access request 31
Instruction 35 belongs to one of them instruction of advanced security level code.Therefore, bridgt circuit 140 can extract instruction 35,
Cause safe processor 120 can so that operating instruction 35 to complete the task of advanced security grade.In other words, if referring to
Order is extracted address and is positioned in code protection block 151, and bridgt circuit 140 extracts request from memorizer 150 according to instruction
Extract the instruction 35 of advanced security level code and perform the operation of correspondence, and instructing 35 and be stored in memorizer 150
Address for instruction extract address.
On the other hand, when safe processor 120 sends access request 32, bridgt circuit 140 judges access request
32 extract request or reading and writing data request for instruction.In this example, owing to access request 32 extracts request for instruction,
But the instruction extraction address corresponding to access request 32 is not positioned at and is in main storage among code protection block 151
In block 150a.It is to say, instruction 36 corresponding to access request 32 be not belonging to advanced security level code.
Therefore, bridgt circuit 140 will not extract instruction 36 but passback null value or error message to safe processor 120, with really
The processor 120 that ensures safety will not run the instruction beyond advanced security level code.
It is noted that the instruction in addition to preventing safe processor 120 from running advanced security level code, this
The bridgt circuit 140 of invention more can prevent safe processor 120 from writing data into code protection block 151 further,
It is tampered with the advanced security level code in prevention code protection block 151.Refer to Fig. 3, work as safe processor
120 when sending access request 33, and bridgt circuit 140 judges that access request 33 extracts request or reading and writing data as instruction
Request.In this example, owing to access request 33 is asked for reading and writing data, bridgt circuit 140 further judges to deposit
Take whether request 33 is the illegal write request writing data into code protection block 151.In the example of Fig. 3, by
It is that data 37 are write the reading and writing data request of main storage block 150a, therefore bridgt circuit in access request 33
140 can determine that access request 33 is not for illegal write request.Then, bridgt circuit 140 is asked (i.e. according to reading and writing data
Access request 33) data 37 are write main storage block 150a.
On the contrary, refer to Fig. 3, it is assumed that access request 38 is asked for reading and writing data, and bridgt circuit 140 is further
Judge whether access request 38 is the illegal write request writing data into code protection block 151.Example in Fig. 3
In, owing to access request 38 is to write data into the reading and writing data request of code protection block 151, therefore bridgt circuit
140 can determine that access request 38 is for illegal write request.Then, bridgt circuit 140 ignores reading and writing data request (i.e.
Access request 38), to avoid the non-data for advanced security level code to write code protection block 151.In other words,
Data writing address corresponding to access request 38 is positioned among code protection block 151, therefore bridgt circuit 140
To ignore or filter access request 38, to avoid the advanced security grade being stored in code protection block 151 further
Code is maliciously altered.Furthermore, it is necessary to special instruction, when the access request that safe processor 120 is sent
During for reading the request of data, bridgt circuit 140 can reading address corresponding to direct basis access request from primary storage
Device block 150a or safe storage block 150b reads corresponding data.
In order to become apparent from illustrating the present invention, illustrate how that the code configuring the present invention is protected by enumerating another embodiment below
Protect block.Fig. 4 is the block chart according to the System on Chip/SoC depicted in one embodiment of the invention.Refer to Fig. 4, system
Chip 20 includes primary processor 210, safe processor 220, bridgt circuit 230, bridgt circuit 240 and storage
Device 250.Primary processor 210, safe processor 220, bridgt circuit 230, bridgt circuit 240 and memorizer 250
Function with couple the primary processor 110 shown in relation and Fig. 1, safe processor 120, bridgt circuit 130, bridge joint
Circuit 140 and memorizer 150 are similar or identical, repeat no more in this.Unlike previous embodiment, system
Chip 20 further includes buffer 270 and read only memory 280.In the present embodiment, buffer 270 is arranged at bridge
Among connection circuit 240, but this is not limiting as by the present invention.In another embodiment, buffer 270 may be disposed at bridge
Connecing outside chip 240, this is not intended to by the present invention.Buffer 270 is in order to store the storage of code protection block 251
Device address realm, the instruction of allow well bridgt circuit 240 judge according to this instruction that safe processor 220 extracted is extracted
Within whether address is positioned at code protection block 251.
Furthermore, the safe processor 220 of the present embodiment further includes authentication unit 221.Read only memory (Read Only
Memory, ROM) 280 store protected data P1.Protected data P1 is to sign with numeral through encryption
The procedure code that name processes, and be stored among read only memory 280.In other words, protected data P1 is a kind of burning
The high confidential information recording among read only memory 280 and cannot be tampered.When safe processor 220 starts, test
Card unit 221 is decrypted program to protected data P1 and obtains advanced security level code C2, and by senior peace
Full level code C2 writes to safe storage block 251.Afterwards, authentication unit 221 is to advanced security level code
C2 carries out signature verification inspection.When advanced security level code C2 is checked by signature verification, safe processor 220
The storage location current according to advanced security level code C2 is set the memory location of code protection block 251.
For further, when advanced security level code C2 is checked by signature verification, and safe processor 220 can be by generation
The memory location write registers 270 of code protection block 251.In an embodiment, buffer 270 can be one
The secondary writeable buffer of property.
Fig. 5 is the flow chart according to the code protection method depicted in one embodiment of the invention.Refer to Fig. 5, this reality
The each element executed in the mode of the example System on Chip/SoC 20 be applicable to above-described embodiment, the most i.e. collocation Fig. 4 is said with module
The detailed step of bright the present embodiment code protection method.
First, in step S501, start safe processor 220.Furthermore, it is understood that when safe processor 220 receives
During to power supply supply or a startup signal, safe processor 220 starts and runs clean boot code to carry out at the beginning of some
The action of beginningization.Afterwards, in step S502, safe processor 220 is to being stored in being protected in read only memory 280
Protect data P1 to be decrypted program and obtain advanced security level code C2, and by the advanced security grade generation after deciphering
Code C2 writes the safe storage block 250b to memorizer 250.
In step S503, safe processor 220 carries out signature verification inspection to the advanced security level code C2 after deciphering
Look into.In step S504, when advanced security level code C2 is checked by signature verification, and safe processor 220 sets
The memory location of code protection block 251 by the memory location write registers 270 of code protection block 251.
In other words, protected data P1 is the high confidential information processed with digital signature through encryption, and safe processor
220 deciphering protected data P1 and/or carry out signature verification inspection and obtain the advanced security that will run on startup
Level code C2.In simple terms, advanced security level code C2 is the secret procedure code through digital signature authentication.
In an embodiment, as clean boot code check complete advanced security level code C2 and by advanced security level code
After C2 copies code protection block 251 to, by temporary for the designated memory address write constituting code protection block 251
Device 270, to start the defencive function of advanced security level code.
In step S505, the access request that bridgt circuit 240 is sent according to safe processor 220 is to access memorizer
250.In step S506, bridgt circuit 240 judges whether access request is that request is extracted in instruction.In an embodiment,
Safe processor 220 can include that instruction cache (I-cache) caches (D-cache) with data high-speed.Please according to access
Seeking Truth sends from the instruction cache of safe processor 220 or caches from the data high-speed of safe processor 220 and sends out
Going out, bridgt circuit 240 can determine whether that access request is that request or reading and writing data request are extracted in instruction.If access request is for referring to
Order is extracted and is asked, and in step S507, bridgt circuit 240 checks that instruction is extracted the instruction extraction address corresponding to request and is
No it is positioned in code protection block 251.In an embodiment, code protection block 251 can be between two storages
A connected storage block between device address, but the present invention is not restricted to this.In another embodiment, code
The multiple discontinuous memory block that protection block 251 can be the division by multiple storage address and produce is constituted
's.
Then, if the instruction extraction address that instruction is extracted corresponding to request is positioned in code protection block 251, in step
S508, bridgt circuit 240 extracts request according to instruction and extracts the finger of advanced security level code C2 from memorizer 250
Make and perform the operation of correspondence.If on the contrary, the instruction corresponding to request is extracted in instruction extracts address bit not in code guarantor
Protecting in block 251, in step S509, bridgt circuit 240 returns null value or error message to safe processor.Simply
For, bridgt circuit 240 can supervise whether the instruction that safe processor 220 run is through digital signature authentication
Advanced security level code C2, to avoid safe processor 220 by the induction of rogue program by advanced security grade
Information in code C2 moves to unsafe main storage block 250a.
On the other hand, if access request is non-extracts request (representing access request is reading and writing data request), Yu Bu for instruction
Rapid S510, bridgt circuit 240 judges that whether reading and writing data request is write data into code protection block 251 illegal
Write request.Furthermore, it is understood that bridgt circuit 240 can judge according to the writing address corresponding to data write request
Whether reading and writing data request is illegal write request.If reading and writing data request is non-for writing data into code protection block
The illegal write request of 251, in step S511, bridgt circuit 240 asks read-write memory 250 according to reading and writing data
Safe storage block 250a or main storage block 250b.If on the contrary, reading and writing data is asked as data to be write
Entering the illegal write request of code protection block 251, in step S512, reading and writing data request ignored by bridgt circuit 240.
Although it is noted that technology today exists the paging (page) to memorizer carries out page attribute configuration, seeming can
Perform the page attribute configuration of (executable) attribute, guarantee that advanced security level code will not be tampered or steal.So
And, the depositor once depositing paging configuration is attacked, then advanced security level code still can be exposed to and be stolen
Among the risk being tampered.In comparison, the code protection block of the present invention is that safe processor is once starting setting
Good designated memory scope, the most only advanced security level code in code protection block can be safely handled
Device performs, and the code in code protection block also cannot be written over.It is to say, come one by one through bridgt circuit
In the range of checking whether the instruction of extraction is positioned at appointment by safe processor, safe place can be ensure that from arranging of hardware
The code that reason device performs is the advanced security level code in code protection block.
In sum, in an embodiment of the present invention, the advanced security level code through digital signature authentication will store
Among the code protection block of safe storage block, and safe processor by bridgt circuit monitoring with filter also
The instruction being stored in outside code protection block will not be run.In addition, bridgt circuit more can filter out and be intended to data
Write code protection block illegal write request, with guarantee through digital signature authentication advanced security level code not
Can be altered by hacker or rogue program.Consequently, it is possible to the advanced security level code in the range of only specifying can be pacified
Full processor performs, and specifies the advanced security level code of scope not to be written over, and thus ensures from hardware
Safe processor will not be performed unexpected instruction by the induction of rogue program, and guarantees through signature verification
Advanced security level code be not exposed among the risk that is tampered or is stolen.
Although the present invention is disclosed above with embodiment, so it is not limited to the present invention, any art
Middle tool usually intellectual, without departing from the spirit and scope of the present invention, when making a little change and retouching, therefore
Protection scope of the present invention is when being as the criterion depending on the defined person of appended claims.
Claims (15)
1. the System on Chip/SoC that can protect code, it is characterised in that including:
One memorizer, including a main storage block and a safe storage block, wherein this safe storage block
One code protection zone block stores advanced security level code；
One safe processor, sends an access request to access this memorizer, to perform this advanced security level code；
And
One first bridgt circuit, is coupled between this safe processor and this memorizer,
Wherein, if this access request is an instruction extracts request, this first bridgt circuit checks that request institute is extracted in this instruction
A corresponding instruction extracts whether address is positioned in this code protection block, if address is extracted in this instruction is not positioned at this code
In protection block, this first bridgt circuit returns a null value or an error message to this safe processor.
The System on Chip/SoC of code can be protected the most as claimed in claim 1, it is characterised in that when this safe processor is saturating
Crossing this first bridgt circuit and this memorizer is sent this access request, this first bridgt circuit judges that this access request is as being somebody's turn to do
Request or reading and writing data request are extracted in instruction.
The System on Chip/SoC of code can be protected the most as claimed in claim 2, it is characterised in that if address is extracted in this instruction
Being positioned in this code protection block, it is senior that this first bridgt circuit extracts this according to this instruction request of extracting from this memorizer
The instruction of safe class code also performs the operation of correspondence, and this instruction to be stored in the address in this memorizer be this instruction
Extract address.
The System on Chip/SoC of code can be protected the most as claimed in claim 2, it is characterised in that if this access request is for being somebody's turn to do
Reading and writing data is asked, and this first bridgt circuit judges that whether this reading and writing data asks for writing data into this code protection district
The illegal write request of the one of block, if the request of this reading and writing data is this illegal write request, this is ignored by this first bridgt circuit
Reading and writing data is asked.
The System on Chip/SoC of code can be protected the most as claimed in claim 4, it is characterised in that if the request of this reading and writing data
Be not this illegal write request, this first bridgt circuit according to this reading and writing data request read and write this safe storage block or
This main storage block.
The System on Chip/SoC of code can be protected the most as claimed in claim 1, it is characterised in that this System on Chip/SoC further includes
One primary processor and one second bridgt circuit, this second bridgt circuit is coupled between this primary processor and this memorizer,
This primary processor has the authority of this main storage block of access but does not have the authority accessing this safe storage block.
The System on Chip/SoC of code can be protected the most as claimed in claim 1, it is characterised in that this System on Chip/SoC includes one
Read only memory and this safe processor include an authentication unit, and this read only memory stores protected data, and this is tested
Card unit carries out a decryption program to this protected data and obtains this advanced security level code, and by this advanced security
Level code writes to this safe storage block.
The System on Chip/SoC of code can be protected the most as claimed in claim 7, it is characterised in that this authentication unit is more to this
Advanced security level code carries out a signature verification inspection, when this advanced security level code is checked by this signature verification,
This safe processor sets the memory location of this code protection block.
The System on Chip/SoC of code can be protected the most as claimed in claim 8, it is characterised in that this System on Chip/SoC further includes
One buffer, when this advanced security level code is checked by this signature verification, and this safe processor is by this code protection
The memory location of block writes this buffer.
10. a code protection method for System on Chip/SoC, described System on Chip/SoC includes a memorizer and a safe handling
Device, this memorizer includes a main storage block and a safe storage block, it is characterised in that described method includes
The following step:
Store advanced security level code in a code protection zone block of this safe storage block；
The access request sent according to this safe processor is to access this memorizer；
If this access request is an instruction extracts request, check that address is extracted in the instruction that this instruction is extracted corresponding to request
Whether it is positioned in this code protection block；And
It is not positioned in this code protection block if address is extracted in this instruction, returns a null value or an error message to this safety
Processor.
The code protection method of 11. System on Chip/SoCs as claimed in claim 10, it is characterised in that this System on Chip/SoC bag
Including one first bridgt circuit, be coupled between this safe processor and this memorizer, described method further includes:
When this safe processor sends this access request through this first bridgt circuit to this memorizer, it is judged that this access please
Ask and extract request or reading and writing data request for this instruction.
The code protection method of 12. System on Chip/SoCs as claimed in claim 11, it is characterised in that described method is more wrapped
Include:
It is positioned in this code protection block if address is extracted in this instruction, extracts from this memorizer according to this instruction request of extracting
The instruction of this advanced security level code also performs the operation of correspondence, and this instruction is stored in the address in this memorizer and is
Address is extracted in this instruction.
The code protection method of 13. System on Chip/SoCs as claimed in claim 11, it is characterised in that described method is more wrapped
Include:
If this access request is the request of this reading and writing data, it is judged that whether this reading and writing data asks for writing data into this code
One illegal write request of protection block；
If the request of this reading and writing data is this illegal write request, ignore the request of this reading and writing data；And
If the request of this reading and writing data is not this illegal write request, read and write being somebody's turn to do of this memorizer according to the request of this reading and writing data
Safe storage block or this main storage block.
The code protection method of 14. System on Chip/SoCs as claimed in claim 10, it is characterised in that storing senior peace
Full level code is before the step of this code protection block of this safe storage block, and described method further includes；
The protected data being stored in a read only memory is carried out a decryption program and obtains this advanced security grade generation
Code, to write this advanced security level code after deciphering to this safe storage block.
The code protection method of 15. System on Chip/SoCs as claimed in claim 14, it is characterised in that storing senior peace
Full level code is after the step of this code protection block of this safe storage block, and described method further includes；
This advanced security level code after deciphering is carried out a signature verification inspection；And
When this advanced security level code is checked by this signature verification, set the memory location of this code protection block
And the memory location of this code protection block is write a buffer.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510183908.5A CN106155940A (en) | 2015-04-17 | 2015-04-17 | The System on Chip/SoC of code and the code protection method of System on Chip/SoC can be protected |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510183908.5A CN106155940A (en) | 2015-04-17 | 2015-04-17 | The System on Chip/SoC of code and the code protection method of System on Chip/SoC can be protected |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106155940A true CN106155940A (en) | 2016-11-23 |
Family
ID=58058682
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510183908.5A Pending CN106155940A (en) | 2015-04-17 | 2015-04-17 | The System on Chip/SoC of code and the code protection method of System on Chip/SoC can be protected |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106155940A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110569205A (en) * | 2018-06-06 | 2019-12-13 | 旭景科技股份有限公司 | Security system single chip and method of operation thereof |
| CN110806836A (en) * | 2018-08-06 | 2020-02-18 | 新唐科技股份有限公司 | Data processing system and data processing method |
| CN111386513A (en) * | 2018-05-03 | 2020-07-07 | 华为技术有限公司 | Data processing method, device and system chip |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP0463409B1 (en) * | 1990-06-28 | 1998-12-30 | Casio Computer Company Limited | Musical tone waveform generation apparatus |
| TW201133351A (en) * | 2010-03-16 | 2011-10-01 | Ali Corp | A method for generating die identification codes, die identification method and system, and using computer process in performing the die identification method |
| CN103377349A (en) * | 2012-04-27 | 2013-10-30 | 美国博通公司 | Security controlled multi-processor system |
| CN103593603A (en) * | 2012-08-17 | 2014-02-19 | 美国博通公司 | Protecting secure software in a multi-security-CPU system |
| CN103914663A (en) * | 2014-04-01 | 2014-07-09 | 英硬(上海)信息科技有限公司 | Method for designing security scheme for financial terminal equipment and security system |
-
2015
- 2015-04-17 CN CN201510183908.5A patent/CN106155940A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP0463409B1 (en) * | 1990-06-28 | 1998-12-30 | Casio Computer Company Limited | Musical tone waveform generation apparatus |
| TW201133351A (en) * | 2010-03-16 | 2011-10-01 | Ali Corp | A method for generating die identification codes, die identification method and system, and using computer process in performing the die identification method |
| CN103377349A (en) * | 2012-04-27 | 2013-10-30 | 美国博通公司 | Security controlled multi-processor system |
| CN103593603A (en) * | 2012-08-17 | 2014-02-19 | 美国博通公司 | Protecting secure software in a multi-security-CPU system |
| CN103914663A (en) * | 2014-04-01 | 2014-07-09 | 英硬(上海)信息科技有限公司 | Method for designing security scheme for financial terminal equipment and security system |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111386513A (en) * | 2018-05-03 | 2020-07-07 | 华为技术有限公司 | Data processing method, device and system chip |
| CN111386513B (en) * | 2018-05-03 | 2021-09-07 | 华为技术有限公司 | Data processing method, device and system chip |
| CN110569205A (en) * | 2018-06-06 | 2019-12-13 | 旭景科技股份有限公司 | Security system single chip and method of operation thereof |
| CN110806836A (en) * | 2018-08-06 | 2020-02-18 | 新唐科技股份有限公司 | Data processing system and data processing method |
| CN110806836B (en) * | 2018-08-06 | 2023-03-24 | 新唐科技股份有限公司 | Data processing system and data processing method |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109002706B (en) | In-process data isolation protection method and system based on user-level page table | |
| US20070266214A1 (en) | Computer system having memory protection function | |
| US11829299B2 (en) | Technologies for execute only transactional memory | |
| US20040003321A1 (en) | Initialization of protected system | |
| US20080201540A1 (en) | Preservation of integrity of data across a storage hierarchy | |
| US10180913B1 (en) | Secure virtual access for real-time embedded devices | |
| CN109828827A (en) | A kind of detection method, device and relevant device | |
| US10536274B2 (en) | Cryptographic protection for trusted operating systems | |
| CN106462509A (en) | Apparatuses and methods for securing access protection scheme | |
| US20090222500A1 (en) | Information storage device and method capable of hiding confidential files | |
| CN108108631A (en) | A kind of root key processing method and relevant apparatus | |
| CN110532767B (en) | Internal isolation method for SGX (secure gateway) security application | |
| CN103593604A (en) | A multi-security-CPU system | |
| CN102184143B (en) | Data protection method, device and system for storage device | |
| US11748493B2 (en) | Secure asset management system | |
| US20070174622A1 (en) | Protection of data of a memory associated with a microprocessor | |
| CN110069935A (en) | Inside protecting sensitive data method and system based on label memory | |
| CN107092838A (en) | A kind of safety access control method of hard disk and a kind of hard disk | |
| CN115659379A (en) | Bus access authority control method and device | |
| CN106155940A (en) | The System on Chip/SoC of code and the code protection method of System on Chip/SoC can be protected | |
| CN202110552U (en) | Software protection device based on multi-body interleaved storage technology | |
| CN105512560A (en) | Disposable programmable storage chip and control method thereof | |
| CN109669884A (en) | A kind of processor system and terminal chip | |
| US10691586B2 (en) | Apparatus and method for software self-test | |
| CN112133356B (en) | Function test method and device for RPMB in eMMC and computer equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20161123 |
|
| RJ01 | Rejection of invention patent application after publication |