CN115688089A - A PCIE protocol security extension method, system and medium - Google Patents

Abstract

The invention discloses a method, a system and a medium for safely expanding a PCIE protocol, wherein the method for safely expanding the PCIE protocol comprises the following steps: s101, generating a PCIE message carrying security information by an access request issued by a CPU and sending the PCIE message to a target terminal device; and S102, after the target terminal equipment receives the PCIE message carrying the security information, implementing security access control of the CPU to the target terminal equipment according to the security information, wherein the security access control can adopt access permission and denial of resource granularity or equipment granularity according to requirements. The method, the system and the medium for safely expanding the PCIE protocol introduce safety information into a PCIE protocol message, so that the PCIE protocol is safely sensed, terminal equipment is brought into a trusted execution environment of a processor end in the PIO direction, and safety protection of data unloaded to an off-chip PCIE equipment end is realized.

Description

A PCIE protocol security extension method, system and medium

technical field

The invention belongs to the field of computer security, and in particular relates to a PCIE protocol security extension method, system and medium.

Background technique

At present, hardware security is getting more and more attention. Only by enhancing system security from the perspective of underlying hardware security and preventing security loopholes can a more secure information system be formed. In the existing international mainstream CPU architecture, mechanisms related to hardware resource isolation are defined. Based on these mechanisms, an isolated area can be constructed in the system. This area has independent computing, storage, and IO resources, and it is guaranteed from the hardware that the data in the isolated area cannot be accessed by resources outside the isolated area. The software executed in it cannot be maliciously tampered with, thus supporting the construction of a secure trusted execution environment.

However, traditional hardware resource isolation mechanisms are generally built around the interior of the processor. However, as the computing power of off-chip accelerators continues to increase, heterogeneous frameworks using main processing chips and off-chip accelerator chips are being used more and more in new application fields. Under this heterogeneous architecture, a large amount of user data needs to be offloaded to the accelerator chip for execution. Generally speaking, the accelerator chip is connected to the main processor through the PCIE bus. Under the current mainstream CPU hardware resource isolation architecture, the PCIE bus is not included in the isolation area. Therefore, from the security perspective of the CPU side, the data offloaded to the accelerator chip is not safe, and it is located outside the trusted execution environment, which has a large hardware security risk.

In a typical CPU+accelerator heterogeneous computing system, the RC (Root Complex) device of the PCIE protocol is located between the CPU and the PCIE topology, connected to the CPU through the bus at the top, and manages each PCIE tree topology at the bottom of nodes. PCIE nodes include switching equipment (switch), EP (terminal) equipment, and the like. The root complex device and the CPU are interconnected through the AXI (Advanced eXtensible Interface) bus. The AXI bus is the fourth-generation on-chip bus protocol developed by ARM. It is an on-chip bus for high performance, high bandwidth, and low latency. It Use the AxPROT signal to distinguish whether the request is a security request.

FIG. 1 is a typical framework diagram of a system (System on Chip, SOC) in which a main processor is plugged with a PCIE acceleration device. The topology of the PCIE bus system is a tree topology, which mainly includes PCIE devices such as root complex (Root Complex, RC) devices, switching devices (Switch), and terminal (Endpoint, EP) devices. A terminal device is a device capable of supporting diverse application functions, and mainly includes a graphics card, a network card, and the like. The switching device is a PCIE switch, which can realize the expansion of the PCIE link when the PCIE link cannot meet the demand. There are two data transmission methods in PCIE devices: DMA (Direct Memory Access, direct memory access)) and PIO (Programmed Input-Output, programmable input and output). Among them, in the data transmission mode of the DMA mode, the data transmission between the memory and the PCIE device can be realized. For example, the terminal device sends an access request to the memory, and the memory returns the requested data to the terminal device; in the data transmission mode of the PIO mode, you can Realize the data transmission between the processor and the terminal device, for example, the processor sends an access request to the terminal device, and the terminal device returns the requested data to the processor. At present, the PCIE interface is widely used in the communication between current processors and high-speed peripherals. However, since the development of the PCIE protocol, there has never been a targeted design for data security in the message format. Therefore, security breaches are inevitable when it comes to transferring data off-chip of the processor. Therefore, it is necessary to extend the PCIE protocol so that the security control request of the CPU is transmitted to the peripheral hardware, which has become a key technical problem to be solved urgently.

Contents of the invention

The technical problem to be solved in the present invention: aim at the above-mentioned problem of prior art, provide a kind of security extension method, system and medium of PCIE protocol, the present invention introduces security information in PCIE protocol message, makes PCIE protocol security perception, In the PIO direction, the terminal device is included in the trusted execution environment on the processor side, so that the security control request of the CPU is transmitted to the peripheral device, and the security protection of the data unloaded to the off-chip PCIE device side is realized.

In order to solve the problems of the technologies described above, the technical solution adopted in the present invention is:

A security extension method of the PCIE protocol, comprising:

S101, generate a PCIE message carrying security information from the access request issued by the CPU and send it to the target terminal device;

S102. After receiving the PCIE message carrying the security information, the target terminal device implements security access control of the CPU to the target terminal device according to the security information.

Optionally, implementing the security access control of the CPU to the target terminal device in step S102 refers to allowing the CPU to access all resources of the target terminal device, or only allowing the CPU to access some resources of the target terminal device that are set as non-secure, and the All resources of the target terminal device are divided into non-secure partial resources and secure partial resources.

Optionally, the value of the security information carried by the PCIE message in step S102 is one of two options of the first value or the second value. In step S102, implementing the security access control of the CPU to the target terminal device includes: if the security information is the first value If the value is one, the CPU is only allowed to access some non-secure resources of the target terminal device; if the security information is a second value, the CPU is allowed to access all resources of the target terminal device.

Optionally, implementing security access control of the CPU to the target terminal device in step S102 refers to allowing the CPU to access the target terminal device, or denying the CPU to access the target terminal device.

Optionally, the value of the security information carried by the PCIE message in step S102 is one of two options of the first value or the second value. In step S102, implementing the security access control of the CPU to the target terminal device includes: when the security information is the first value When the value is one, compare the device information of the target terminal device with the preset security terminal device information list to determine whether the target terminal device is a security terminal device, and only allow the CPU to access the target terminal device when the target terminal device is a security terminal device; When the security information is the second value, the CPU is directly allowed to access the target terminal device.

Optionally, step S101 includes:

S201, the root complex device receives an AXI request sent by the CPU through the AXI bus;

S202, the root complex device parses and obtains the AxPROT signal in the AXI request, generates security information according to the AxPROT signal, and encodes the security information into a PCIE message;

S203, the root complex device judges the connection mode with the target terminal device, if it is directly connected to the target terminal device, then directly sends the PCIE message to the target terminal device, otherwise sends the PCIE message to the switching device connected to the target terminal device ;

S204. Forward the PCIE message to the target terminal device through the switching device connected to the target terminal device and at the same time transparently transmit the security information encoded in the PCIE message, and finally send the PCIE message to the target terminal device.

Optionally, when the security information is generated according to the AxPROT signal in step S202, the generated security information is from the AxPROT signal in the AXI request indicating that the access is safe or unsafe, if the AxPROT signal indicates that the access is safe or unsafe If the identification bit indicates security, then the value of the security information is the first value; otherwise, the value of the security information is the second value, wherein the first value is used to only allow the CPU to access the target terminal device's non- Some of the resources that are safe, the second value is used to allow the CPU to access all resources of the target terminal device, or the first value is used to allow the CPU to access the target terminal device only when the target terminal device is a secure terminal device, the second value is used to allow the CPU to access the target terminal device, the second value The binary value is used to directly allow the CPU to access the target end device.

Optionally, encoding the security information into the PCIE message in step S202 specifically refers to encoding the security information into a reserved field of the PCIE message to achieve compatibility with the standard PCIE message protocol.

In addition, the present invention also provides a security extension system of the PCIE protocol, which includes a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the security extension method of the PCIE protocol.

In addition, the present invention also provides a computer-readable storage medium, and a computer program is stored in the computer-readable storage medium, and the computer program is used to be programmed or configured by a microprocessor to perform the security extension method of the PCIE protocol .

Compared with the prior art, the present invention mainly has the following advantages: the security extension method of the PCIE protocol of the present invention includes: the PCIE message sent by the CPU to the target terminal device carries security information; After the PCIE message of the information, according to the security information, select to allow the CPU to access all resources of the target terminal device or be set as non-safe partial resources. The present invention introduces security information into the PCIE protocol message, so that the PCIE protocol is security-aware. In the direction of PIO (the reading and writing direction from the CPU to the terminal device), the terminal device is included in the trusted execution environment of the processor side, so that the security control request of the CPU is transmitted to the peripheral device, and the security protection of the data unloaded to the off-chip PCIE device side is realized. .

Description of drawings

FIG. 1 is a schematic diagram of an architecture of an existing PCIE application system.

Fig. 2 is a schematic flow diagram of the basic method of the first embodiment of the present invention.

FIG. 3 is a schematic diagram of a specific implementation flow of security access control in Embodiment 1 of the present invention.

FIG. 4 is a schematic flowchart of step S101 in Embodiment 1 of the present invention.

FIG. 5 is a format definition of a packet header of the third generation standard PCIE packet protocol (PCIe Gen3).

FIG. 6 is a schematic diagram of a specific implementation flow of security access control in Embodiment 2 of the present invention.

Detailed ways

Embodiment one:

As shown in Figure 2, the security extension method of the PCIE protocol of the present embodiment includes:

S101, generate a PCIE message carrying security information from the access request issued by the CPU and send it to the target terminal device;

S102. After receiving the PCIE message carrying the security information, the target terminal device implements security access control of the CPU to the target terminal device according to the security information.

To implement the security access control of the CPU to the target terminal device according to the security information, a feasible implementation method of security access control may be selected according to needs. For example, as an optional implementation, implementing the security access control of the CPU to the target terminal device in step S102 of this embodiment refers to allowing the CPU to access all resources of the target terminal device, or only allowing the CPU to access the target terminal device is set to Non-secure partial resources, and all resources of the target terminal device are divided into non-secure partial resources and safe partial resources, this embodiment divides the security level of target terminal device resources (non-secure partial resources and secure Part of the resources), which makes the security control of the target terminal device more fine-grained, thus making the realization of the target terminal device more flexible.

As shown in Figure 3, in the present embodiment step S102, the value of the security information carried by the PCIE message is one of the first value or the second value, and the security access control of the CPU to the target terminal device in the step S102 includes: If the security information is the first value, the CPU is only allowed to access some non-secure resources of the target terminal device; if the security information is the second value, the CPU is allowed to access all resources of the target terminal device. Wherein, the first value or the second value is only used to distinguish between the two security access control methods, and the required definition can be adopted as required. For example, as an optional implementation mode, the first value is defined as 1 in this embodiment , the second value is 0.

The access request delivered by the CPU in step S101 may be a configuration request, an IO request, a MEM request, etc., and the method of this embodiment does not depend on the specific request type. The topology corresponding to the PCIE protocol of the computer includes the root complex device and the target terminal device. The root complex device and the target terminal device can be directly connected, or connected through a switching device (specifically referred to as a PCIE switching device). The root complex device is used to receive the access request issued by the CPU. There is no doubt that a bus supporting security control can be used between the root complex device and the CPU as required. For example, the common bus that supports security control between the root complex device and the CPU is the AXI bus. The following will take the AXI bus between the root complex device and the CPU as an example to further describe the implementation of step S101 in this embodiment. Detailed description.

As shown in Figure 4, step S101 of this embodiment includes:

S201, the root complex device receives an AXI request sent by the CPU through the AXI bus;

S202, the root complex device parses and obtains the AxPROT signal in the AXI request, generates security information according to the AxPROT signal, and encodes the security information into a PCIE message;

S203, the root complex device judges the connection mode with the target terminal device, if it is directly connected to the target terminal device, then directly sends the PCIE message to the target terminal device, otherwise sends the PCIE message to the switching device connected to the target terminal device ;

S204. Forward the PCIE message to the target terminal device through the switching device connected to the target terminal device and at the same time transparently transmit the security information encoded in the PCIE message, and finally send the PCIE message to the target terminal device.

In this embodiment, when the security information is generated according to the AxPROT signal in step S202, the generated security information is from the AxPROT signal in the AXI request indicating that the access is safe or unsafe. 0] identifies the access as non-privileged or privileged. AxPROT[1] identifies the access as secure or unsecure. AxPROT[2] indicates whether it is a data or instruction access. However, it is not accurate in all cases, for example, transaction contains a mix of instructions and data items), if the flag indicating that the access is safe or unsafe in the AxPROT signal is safe, then the value of the security information is the first value, otherwise the value of the security information is the first value Two values, wherein the first value is used to only allow the CPU to access some non-secure resources of the target terminal device, and the second value is used to allow the CPU to access all resources of the target terminal device.

As an optional implementation manner, encoding the security information into the PCIE message in step S202 in this embodiment specifically refers to encoding the security information into a reserved field of the PCIE message to achieve compatibility with the standard PCIE message protocol. Figure 5 shows the format definition of the packet header of the third-generation standard PCIE packet protocol (PCIe Gen3). The packet header is four bytes with a total size of 32 bits, and the fields include the type between the type Type and the transmission level TC. A 1-bit reserved field R is respectively set between the transmission class TC and the message attribute Attr, and between the message attribute Attr and the message processing prompt information flag TH. Since the first value is defined as 1 and the second value is 0 in this embodiment, one of the 1-bit reserved field R may be occupied. The security extension of the protocol can be carried out by using any 1-bit reserved field R among them, and the security information AxPROT inside the processor is transmitted to the external device through encoding into the reserved field R in the PCIE message. After the external terminal device receives these messages, it needs to decode the reserved field R in the TLP message, convert the decoded reserved field R into the security information inside the terminal device, and then implement the CPU to check the Secure access control for target end devices.

To sum up, this embodiment introduces security information into the PCIE protocol message, so that the PCIE protocol is security-aware, and incorporates the EP device (terminal device) into the processor in the PIO direction (the reading and writing direction from the CPU to the EP device) The trusted execution environment on the end realizes the security protection of the data offloaded to the off-chip PCIE device end. In particular, in order to achieve compatibility with the existing PCIE protocol, in this embodiment, the security attribute field segment of the security information is introduced into the standard PCIe protocol message, so that the security control request of the CPU is transmitted to the peripheral device, which can be implemented in A security extension to the PCIE standard protocol under the compatible precursor of the existing PCIE protocol.

In addition, the present embodiment also provides a security extension system of the PCIE protocol, including interconnected microprocessors and memory, the microprocessor is programmed or configured to perform the security extension method of the aforementioned PCIE protocol, the security extension of the PCIE protocol The system can be a heterogeneous system composed of CPU+accelerator, or a system without accelerator. In addition, this embodiment also provides a computer-readable storage medium, in which a computer program is stored, and the computer program is used to be programmed or configured by a microprocessor to execute the aforementioned security extension method of the PCIE protocol.

Embodiment two:

This embodiment is basically the same as Embodiment 1, and the main difference is that in step S102 of this embodiment, implementing the security access control of the CPU to the target terminal device refers to allowing the CPU to access the target terminal device, or denying the CPU to access the target terminal device, that is, to implement Security access control at the granularity of terminal devices.

Similarly, the value of the security information carried in the PCIE message in step S102 of this embodiment is one of the first value or the second value. However, different from Embodiment 1, as shown in FIG. 6 , this embodiment For example, in step S102, implementing the security access control of the CPU to the target terminal device includes: when the security information is the first value, comparing the device information of the target terminal device with the preset security terminal device information list to determine whether the target terminal device is Secure terminal device, allowing the CPU to access the target terminal device only when the target terminal device is a secure terminal device (that is, if the non-secure terminal device CPU accesses the target terminal device, it will be rejected); when the security information is the second value, the CPU is directly allowed to access target end device.

Correspondingly, when the security information is generated according to the AxPROT signal in step S202 of this embodiment, the generated security information is the flag indicating whether the access is safe or unsafe from the AxPROT signal in the AXI request, if the AxPROT signal indicates that the access is safe or If the unsafe flag is indicated as safe, then the value of the security information is the first value; otherwise, the value of the security information is the second value. The difference from Embodiment 1 is that the first value in this embodiment The second value is used to allow the CPU to directly access the target terminal device only when the target terminal device is a security terminal device. Similarly, the first value or the second value is only used to distinguish between the two security access control methods, and the required definition can be adopted as required. For example, as an optional implementation mode, the first value defined in this embodiment is 1, the second value is 0.

In addition, the present embodiment also provides a security extension system of the PCIE protocol, including interconnected microprocessors and memory, the microprocessor is programmed or configured to perform the security extension method of the aforementioned PCIE protocol, the security extension of the PCIE protocol The system can be a heterogeneous system composed of CPU+accelerator, or a system without accelerator. In addition, this embodiment also provides a computer-readable storage medium, in which a computer program is stored, and the computer program is used to be programmed or configured by a microprocessor to execute the aforementioned security extension method of the PCIE protocol.

Embodiment three:

This embodiment is basically the same as Embodiment 1, and the main difference is: the root complex device in step S202 of this embodiment parses and obtains the AxPROT signal in the AXI request, generates security information according to the AxPROT signal, and encodes the security information into the PCIE message. , the security information is not encoded in the packet header of the PCIE protocol, but encoded into the data of the PCIE packet. The target terminal device can also extract security information by decoding the data of the PCIE message. In addition, not only can the security information be encoded into the data of the PCIE message, but also other feasible valid information fields can be selected to write the security information according to the format definition of the PCIE message, which will not be listed here.

In addition, the present embodiment also provides a security extension system of the PCIE protocol, including interconnected microprocessors and memory, the microprocessor is programmed or configured to perform the security extension method of the aforementioned PCIE protocol, the security extension of the PCIE protocol The system can be a heterogeneous system composed of CPU+accelerator, or a system without accelerator. In addition, this embodiment also provides a computer-readable storage medium, in which a computer program is stored, and the computer program is used to be programmed or configured by a microprocessor to execute the aforementioned security extension method of the PCIE protocol.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein. The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and combinations of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a Means for realizing the functions specified in one or more steps of the flowchart and/or one or more blocks of the block diagram. These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram. These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart flow or flows and/or block diagram block or blocks.

The above descriptions are only preferred implementations of the present invention, and the protection scope of the present invention is not limited to the above-mentioned embodiments, and all technical solutions under the idea of the present invention belong to the protection scope of the present invention. It should be pointed out that for those skilled in the art, some improvements and modifications without departing from the principles of the present invention should also be regarded as the protection scope of the present invention.

Claims (10)

1. A method for secure extension of a PCIE protocol is characterized by comprising the following steps:

s101, generating a PCIE message carrying security information by an access request issued by a CPU and sending the PCIE message to a target terminal device;

and S102, after the target terminal equipment receives the PCIE message carrying the safety information, implementing safety access control of the CPU to the target terminal equipment according to the safety information.

2. The method according to claim 1, wherein the step S102 of implementing the security access control of the CPU on the target terminal device means that the CPU is allowed to access all resources of the target terminal device, or only allowed to access a part of resources, which are set as non-secure resources, of the target terminal device, and all resources of the target terminal device are divided into a non-secure part of resources and a secure part of resources.

3. The security extension method of a PCIE protocol according to claim 2, wherein the value of the security information carried in the PCIE packet in step S102 is one of a first value and a second value, and implementing the security access control of the CPU to the target terminal device in step S102 includes: if the safety information is a first value, only allowing the CPU to access the non-safety partial resource of the target terminal equipment; and if the safety information is the second value, allowing the CPU to access all resources of the target terminal equipment.

4. The security extension method of a PCIE protocol of claim 1, wherein the implementation of the security access control of the CPU to the target terminal device in step S102 is to allow the CPU to access the target terminal device or to deny the CPU from accessing the target terminal device.

5. The security extension method of a PCIE protocol according to claim 4, wherein the value of the security information carried in the PCIE packet in step S102 is one of a first value and a second value, and implementing the security access control of the CPU to the target terminal device in step S102 includes: when the safety information is a first value, comparing the equipment information of the target terminal equipment with a preset safety terminal equipment information list to determine whether the target terminal equipment is the safety terminal equipment, and allowing the CPU to access the target terminal equipment only when the target terminal equipment is the safety terminal equipment; and directly allowing the CPU to access the target terminal equipment when the safety information is the second value.

6. The method for securely extending a PCIE protocol according to any one of claims 1 to 5, wherein the step S101 includes:

s201, a root complex device receives an AXI request issued by a CPU through an AXI bus;

s202, the root complex device analyzes and obtains an AxPROT signal in the AXI request, generates safety information according to the AxPROT signal, and codes the safety information into a PCIE message;

s203, the root complex device judges the connection mode with the target terminal device, if the root complex device is directly connected with the target terminal device, the PCIE message is directly sent to the target terminal device, otherwise, the PCIE message is sent to the switching device connected with the target terminal device;

and S204, forwarding the PCIE message to the target terminal equipment through the switching equipment connected with the target terminal equipment, and simultaneously transmitting the safety information coded in the PCIE message, and finally sending the PCIE message to the target terminal equipment.

7. The method according to claim 6, wherein when the security information is generated according to the AxPROT signal in step S202, the generated security information is an identifier bit indicating that access is safe or unsafe in the AxPROT signal from the AXI request, if the identifier bit indicating that access is safe or unsafe in the AxPROT signal indicates safe, the value of the security information is a first value, otherwise, the value of the security information is a second value, where the first value is used to allow only the CPU to access the non-safe part of the target terminal device, the second value is used to allow the CPU to access all the resources of the target terminal device, or the first value is used to allow only the CPU to access the target terminal device when the target terminal device is a safe terminal device, and the second value is used to directly allow the CPU to access the target terminal device.

8. The method according to claim 6, wherein the step S202 of encoding the security information into the PCIE message specifically means encoding the security information into a reserved field of the PCIE message to achieve compatibility with a standard PCIE message protocol.

9. A security extension system of PCIE protocol, comprising a microprocessor and a memory, which are connected to each other, wherein the microprocessor is programmed or configured to execute the security extension method of PCIE protocol according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, wherein the computer program is configured or programmed by a microprocessor to perform the method for security extension of a PCIE protocol as defined in any one of claims 1 to 8.

Images