JP2007300370A - Information processor and control method therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processor capable of ciphering packet data sent and received between devices, and to provide its control method. <P>SOLUTION: The information processor includes a first ciphering/deciphering means (36), provided for one of a plurality of virtual channels defined in a transaction layer of a first device (24, 26); a second ciphering/deciphering means (36), provided for one of the plurality of virtual channels defined in a transaction layer of the second device (26, 24); and a control means (23) of selecting the virtual channels, for which the first and second ciphering/deciphering means (36) are provided by the first and second devices (24, 26) and performing communication between the selected virtual channels through ciphering of packet data, when the packet data are requested to be communicated between the first and second devices (24, 26) through the ciphering. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an information processing apparatus such as a personal computer (PC) and a control method for controlling the operation thereof.

  As is well known, in recent years, third-generation general-purpose I / O interconnection interfaces called PCI Express have been adopted in information processing apparatuses such as PCs. PCI Express is a standard for interconnecting devices via a communication path called a link, and is defined by PCI SIG (peripheral component interconnect special interest group).

  By the way, in the PCI Express standard, data transmission between devices is performed using packets. However, the technology defined in PCI Express Base Specification Revision 1.1 defines the configuration format of packets (Ordered-set / DLLP / TLP) sent and received between devices, but data security (data encryption Is not defined.

Patent Document 1 discloses a configuration in which, in a multiprocessor system, a logical channel is dynamically allocated according to the activation of an application to perform encrypted data communication.
JP 2002-215480 A

  Accordingly, the present invention has been made in view of the above circumstances, and an object thereof is to provide an information processing apparatus capable of encrypting packet data transmitted and received between devices and a control method thereof.

  An information processing apparatus according to the present invention is intended for an apparatus including first and second devices connected by a serial bus interface. Then, the first encryption / decryption means provided in one of the plurality of virtual channels defined in the transaction layer of the first device, and one of the plurality of virtual channels defined in the transaction layer of the second device A second encryption / decryption means provided, and when the packet data communication by encryption is requested between the first and second devices, the first and second devices respectively perform the first and second encryption / decryption means. Is selected, and control means for performing communication by encrypting packet data between the selected virtual channels is provided.

  A method for controlling an information processing apparatus according to the present invention is directed to a method for controlling an information processing apparatus including first and second devices connected by a serial bus interface. Then, the first encryption / decryption means is provided in any one of the plurality of virtual channels defined in the transaction layer of the first device, and one of the plurality of virtual channels defined in the transaction layer of the second device. A second encryption / decryption means, and when the packet data communication by encryption is requested between the first and second devices, the first and second devices respectively have the first and second encryption / decryption means The provided virtual channel is selected, and communication by encryption of packet data is performed between the selected virtual channels.

  According to the above-described invention, when packet data communication by encryption is requested between the first and second devices, the first and second devices are respectively provided with the first and second encryption / decryption means. Since the selected virtual channel is selected and communication is performed by encrypting the packet data between the selected virtual channels, the packet data transmitted / received between the devices connected by the serial bus interface is encrypted. It becomes possible.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 shows the appearance of a notebook PC 11 that can be driven by a battery as an information processing apparatus described in this embodiment.

  The PC 11 includes a PC main body 12 and a display unit 13. The display unit 13 incorporates a display device made up of a liquid crystal display (LCD), and the display screen 14 of the LCD is located almost at the center of the display unit 13.

  The display unit 13 is attached to the PC main body 12 so as to be rotatable between an open position and a closed position. The PC main body 12 has a thin box-shaped housing, and on its upper surface, a power button 15, an LED (light emitting diode) display unit 16, a keyboard 17, a touch pad 18, two left and right buttons 19, 20 and the like. Is arranged.

  FIG. 2 shows a signal processing system of the PC 11. The PC 11 includes a built-in battery 21 and operates with power from the built-in battery 21 when not connected to an external power supply (AC power supply). Further, in a state where the AC adapter 22 is connected to the PC 11, that is, in a state where the PC 11 is connected to an external power source (AC power source), the PC 11 operates with the external power source (AC power source). Further, the internal battery 21 is charged by an external power source.

  As shown in FIG. 2, the PC 11 includes a CPU (central processing unit) 23, a root complex 24, a main memory 25, a graphics controller (end point) 26, the display device (LCD) 27, a PCI device group 28, a PCI Express. Device group 29, HDD (hard disk drive) 30, BIOS-ROM 31, embedded controller / keyboard controller (EC / KBC) 32, power controller (PSC) 33, power button 15, keyboard (KB) 17, touch pad 18, etc. It has.

  The Root Complex 24, the graphics controller (end point) 26, and the PCI Express device group 29 are devices compliant with the PCI Express standard. Communication between the Root Complex 24 and the graphics controller (end point) 26 is executed via a PCI Express link 34 disposed between the Root Complex 24 and the graphics controller (end point) 26.

  Communication between the Root Complex 24 and the PCI Express device group 29 is executed via a PCI Express link 35 disposed between the Root Complex 24 and the PCI Express device group 29. Each PCI Express link 34, 35 is a communication path composed of a serial bus interface, and includes an upstream lane and a downstream lane.

  The CPU 23 is a processor that controls the operation of the PC 11, and executes various programs (operating system, application program) loaded from the HDD 30 to the main memory 25.

  The CPU 23 also executes a basic input output system (BIOS) stored in the BIOS-ROM 31. This BIOS is a program for controlling hardware. The BIOS also has a system management interrupt (SMI) routine for dynamically permitting or prohibiting execution of an ASPM (active state power management) function defined by the PCI Express standard according to the operation mode of the PC 11. ing.

  As described above, the ASPM function can set the link to which the device is connected to the low power state (standby state) even if the device corresponding to the PCI Express standard is in the operating state (D0 state). Communication path control function. Each of the two devices interconnected via the link has an ASPM function, and the link state is set to an operation state and lower power consumption than the operation state depending on whether or not the link is in an idle state. Transition to and from the standby state. This transition is automatically performed by hardware.

  The Root Complex 24 is a bridge device that connects a local bus of the CPU 23 and a graphics controller (end point) 26. The Root Complex 24 also has a function of executing communication with the graphics controller (end point) 26 via the PCI Express link 34.

  The graphics controller (end point) 26 is a display controller that controls a display device (LCD) 27 used as a display monitor of the PC 11.

  The embedded controller / keyboard controller (EC / KBC) 32 is a one-chip microcomputer in which an embedded controller for power management and a keyboard controller for controlling the keyboard (KB) 17 and the touch pad 18 are integrated.

  The embedded controller / keyboard controller (EC / KBC) 32 has a function of powering on / off the PC 11 in cooperation with the power controller (PSC) 33 in accordance with the operation of the power button 15 by the user. . Further, the embedded controller / keyboard controller (EC / KBC) 32 also has a function of detecting connection and removal of the AC adapter 22 with respect to the PC 11.

  When an event of connecting / disconnecting the AC adapter 22 occurs, the embedded controller / keyboard controller (EC / KBC) 32 generates an interrupt signal (INTR) to notify the BIOS of the occurrence of the power management event. In response to the generation of the interrupt signal (INTR), the root complex 24 generates an interrupt signal (SMI) to the CPU 23. In response to the SMI, the CPU 23 executes a BIOS SMI routine. The SMI may be directly supplied from the embedded controller / keyboard controller (EC / KBC) 32 to the CPU 23.

  FIG. 3 shows a connection configuration between two devices each compliant with the PCI Express standard. Here, as two devices, a connection configuration of a Root Complex 24 (first device) and a graphics controller (end point) 26 (second device) will be described as an example.

  That is, in the PCI Express standard, the physical layers 24a and 26a for controlling and managing the physical connection between the two devices 24 and 26 facing each other and the data integrity between the two devices 24 and 26 are controlled and managed. DataLink Layers 24b and 26b, and Transaction Layers 24c and 26c for controlling and managing transactions such as reading and writing to the memory are defined. The devices 24 and 26 are provided with internal bus control circuits 24d and 26d for controlling and managing the interface between the internal logic and the Transaction Layers 24c and 26c, respectively. , 26d are outside the range of the PCI Express standard.

  Then, between the opposing layers (24a, 26a), (24b, 26b), (24c, 26c) of the two devices 24, 26, data is transmitted and received by transmitting / receiving packets formatted in the standard. Delivery takes place. The following three types of packets are transmitted and received between the opposing layers (24a, 26a), (24b, 26b), (24c, 26c).

  That is, an Ordered-set that performs transmission / reception to manage and control the physical connection between the Physical Layers 24a and 26a, and a DLLP (datalink layer packet) that performs transmission / reception to ensure data integrity between the DataLink Layers 24b and 26b. (Refer to FIG. 4) and TLP (transaction layer packet) (refer to FIG. 5) for transmitting and receiving data between the devices 24 and 26.

  The data transmitted / received by TLP is subdivided as follows. That is, a Memory transaction (read / write) for transmitting / receiving stream data (signal) such as a control signal and video data of the opposite device, an I / O transaction (read / write) mainly transmitting / receiving a control signal of the opposite device, PC12. A Configuration transaction that transmits / receives PCI / PCI Express-compliant control information defined in x / PCI-X / PCI Express, and a Message transaction that transmits / receives management information such as interrupt, error information, slot management, and power control is there. The Configuration transaction and the Message transaction are used for management and control information transmission / reception between the devices 24 and 26 and the PCI Express hierarchy.

  Here, as described above, the root complex 24 and the graphics controller (end point) 26 are interconnected via the PCI Express link 34. The PCI Express link 34 is a serial bus interface that connects the Root Complex 24 and the graphics controller (end point) 26 in a point-to-point format.

  That is, the PCI Express link 34 includes a differential signal line pair 34a for transmitting information from the root complex 24 to the graphics controller (end point) 26, and a direction from the graphics controller (end point) 26 to the root complex 24. A differential signal line pair 34b for transmitting information to a signal line, a signal line pair for transmitting and receiving an ordered-set between the physical layers 24a and 26a, and a signal line pair for transmitting and receiving a DLLP between the data link layers 24b and 26b. And a pair of signal lines for transmitting and receiving TLP between the Transaction Layers 24c and 26c and between the internal bus control circuits 24d and 26d.

  Here, the ordered-set and the DLLP are used for local communication between the devices 24 and 26. For these two types of packets, data arbitrarily set by the user cannot be added, and the data format is strictly defined by the PCI Express standard.

  On the other hand, the packet format of TLP is strictly defined by the PCI Express standard, but the data payload added in the packet is not defined except for the data length. For this reason, the contents described in the data payload can be easily viewed by a third party on the physical lane. In the current PCI Express standard, data confidentiality is not defined.

  Therefore, in this embodiment, the devices 24 and 26 are newly provided with encryption means and decryption means. That is, in the PCI Express standard, as shown in FIG. 6, it is defined that Virtual Channels 0 to 7 of up to 8 channels are mounted in the Transaction Layers 24c and 26c of the devices 24 and 26, respectively.

  Of these, Virtual Channel 0 is required for all devices, and the other Virtual Channels 1 to 7 can be arbitrarily installed for each device. In this embodiment, the encryption / decryption circuit 36 is mounted on any one (or a plurality of Virtual Channels 1 to 7) of the devices 24 and 26.

  Here, of the above TLP types, each transaction of I / O, Configuration, and Message (excluding some) is determined to use only the default Virtual Channel 0. On the other hand, for the Memory transaction, the Virtual Channels 1 to 7 to be used can be arbitrarily selected according to the designation of the user (application software).

  For this reason, I / O, Configuration, and Message (except for some) transactions in the TLP are transmitted via the default Virtual Channel 0 in which the encryption / decryption circuit 36 is not mounted, as indicated by a broken line in FIG. The data is transmitted and received between the root complex 24 and the graphics controller (end point) 26.

  For the Memory transaction in the TLP, as indicated by the solid line in FIG. 7, it is specified that the user (application software) uses Virtual Channel n (n is 1 to 7) on which the encryption / decryption circuit 36 is installed. In this case, encryption processing is performed when passing through the virtual channel n. Then, the encrypted packet is output to the opposing device 24 or 26 via the DataLink Layer and the Physical Layer.

  In the opposite device 24 or 25, the encrypted Memory transaction is decrypted by the Virtual Channel n on which the encryption / decryption circuit 36 is mounted, and the original Memory transaction is acquired.

  Note that data encryption processing is performed only by the Data field of the TLP shown in FIG. 5 by the Virtual Channel n in which the encryption / decryption circuit 36 is mounted. Other fields of TLP and Ordered-set / DLLP are not subject to encryption.

  FIG. 8 shows management packets 37 and 38 used for performing the above-described encryption and decryption. The management packets 37 and 38 control an authentication mechanism for enabling the encryption / decryption circuit 36 implemented in the Virtual Channel n of both devices [Root Complex 24 and graphics controller (end point) 26]. Used for. The management packets 37 and 38 are not defined in the PCI Express standard, but are newly defined packets for realizing the data security mechanism according to this embodiment.

  Here, FIG. 9 shows a flowchart summarizing the processing operations when the packet is encrypted or decrypted according to the designation of the user (application software) and when the packet is not encrypted. That is, when the process is started (step S1), the CPU 23 determines whether or not the user (application software) has designated to perform encryption or decryption processing on the packet in step S2.

  If it is determined that encryption or decryption processing has been designated for the packet (YES), the CPU 23 encrypts or decrypts the packet with Virtual Channel n in which the encryption / decryption circuit 36 is mounted in step S3. And the process ends (step S5).

  If it is determined in step S3 that the packet is not designated to be encrypted or decrypted (NO), the CPU 23 has the encryption / decryption circuit 36 installed in step S4. The process is terminated by no virtual channel n, and the process ends (step S5).

  Next, FIG. 10 shows a flowchart summarizing the processing operation for initializing the authentication of the encryption / decryption circuit 36. This processing operation is started when the devices are connected to each other (step S6). Then, in step S7, the CPU 23 executes an initialization operation defined by the PCI Express standard.

  When initialization conforming to the PCI Express standard is completed and a communication path between devices is established, the CPU 23 establishes the encryption / decryption circuit 36 between devices in step S8. The initialization (authentication) of Virtual Channel n in which the encryption / decryption circuit 36 is mounted is executed, and the process is terminated (step S9).

  The initialization processing in step S8 is executed following the detection of the hardware that has been installed automatically by the installed hardware without the intervention of the upper software, and that has been completed. When the initialization (authentication) of the Virtual Channel n in which the encryption / decryption circuit 36 is installed is completed, this is notified to the upper software.

  The management packets 37 and 38 described above are newly defined packets used for processing for enabling Virtual Channel n in which the encryption / decryption circuit 36 is mounted. An encryption that is used for communication between devices at the time of initialization and re-authentication (described later) of the Virtual Channel n in which the encryption / decryption circuit 36 is installed, and is installed in both devices by transmitting / receiving control information between the devices.・ Authentication and key exchange of Virtual Channel n on which the decryption circuit 36 is mounted are performed to establish data security.

  FIG. 11 shows a flowchart summarizing the processing operation when re-authentication is performed between devices. This re-authentication between devices is established for some reason in the communication path where the communication path is established by the initialization process between the devices, and the initialization of the data security mechanism is completed and the communication in which the data security is guaranteed is established. This process is performed when re-authentication between devices becomes necessary.

  Similar to the initialization process, it is realized by transmitting and receiving newly defined management packets 36 and 37 between devices. This re-authentication process is also automatically executed by the installed hardware.

  That is, when the process is started (step S10), the CPU 23 determines whether or not the re-authentication process between devices is executed in step S11. If it is determined that the process is not executed (NO), the process is ended. (Step S13). If it is determined in step S11 that re-authentication processing between devices has been executed (YES), the CPU 23 performs re-authentication processing of Virtual Channel n in which the encryption / decryption circuit 36 between devices is mounted in step S12. Then, the process is terminated (step S13).

  The following situations require re-authentication. In other words, in order to ensure data security between devices, re-authentication is performed at regular intervals to update the encryption algorithm and encryption / decryption key between devices, or the communication path becomes unstable and communication between devices This is a case where re-authentication is required between devices as a result of path reconstruction (compliant with the PCI Express standard).

  As described above, it is possible to encrypt packet data transmitted / received between devices connected by the serial bus interface.

  Note that the present invention is not limited to the above-described embodiments as they are, and can be embodied by variously modifying the constituent elements without departing from the scope of the invention in the implementation stage. Various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the above-described embodiments. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements according to different embodiments may be appropriately combined.

The perspective view which shows embodiment of this invention and is shown in order to demonstrate the external appearance of the notebook-type PC which can be battery-driven. The block block diagram shown in order to demonstrate the signal processing system of PC in the embodiment. The figure shown in order to demonstrate the connection structure based on PCI Express specification between two devices in PC in the embodiment. The figure shown in order to demonstrate DLLLP which transmits / receives in order to ensure the integrity of data between the DataLink Layers of the PCI Express specification in the embodiment. The figure shown in order to demonstrate TLP which transmits / receives data between the Transaction Layer of PCI Express specification in the embodiment, and between internal bus control circuits. The figure shown in order to demonstrate the data communication operation | movement which does not encrypt between the two devices in PC in the embodiment. The figure shown in order to demonstrate the data communication operation | movement which encrypts between the two devices in PC in the embodiment. The figure shown in order to demonstrate the management packet of the data communication which encrypts between the two devices in PC in the embodiment. The flowchart shown in order to demonstrate the data communication operation | movement which does not encrypt or decode within PC in the same embodiment, and the data communication operation | movement performed. The flowchart shown in order to demonstrate the initialization operation | movement of Virtual Channel n which mounted the encryption / decryption circuit in PC in the embodiment. The flowchart shown in order to demonstrate the re-authentication operation | movement of Virtual Channel n which mounted the encryption / decryption circuit in PC in the embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 11 ... PC, 12 ... PC main body, 13 ... Display unit, 14 ... Display screen, 15 ... Power button, 16 ... LED display part, 17 ... Keyboard, 18 ... Touch pad, 19, 20 ... Button, 21 ... Built-in battery, 22 ... AC adapter, 23 ... CPU, 24 ... Root Complex, 25 ... main memory, 26 ... graphics controller (end point), 27 ... display device, 28 ... PCI device group 28, 29 ... PCI Express device group, 30 ... HDD, 31 ... BIOS-ROM, 32 ... Embedded controller / keyboard controller (EC / KBC), 33 ... Power supply controller (PSC), 34, 35 ... PCI Express link, 36 ... Encryption / decryption circuit, 37, 38 ... Management packet .

Claims (8)

An information processing apparatus comprising first and second devices connected by a serial bus interface,
First encryption / decryption means provided in any of a plurality of virtual channels defined in the transaction layer of the first device;
Second encryption / decryption means provided in any of a plurality of virtual channels defined in the transaction layer of the second device;
When communication of packet data by encryption is requested between the first and second devices, virtual channels provided with the first and second encryption / decryption means respectively in the first and second devices are provided. An information processing apparatus comprising: control means for selecting and performing communication by encryption of packet data between the selected virtual channels.   The control means encrypts and outputs the packet data by the encryption / decryption means provided in the virtual channel selected from one of the first and second devices, and is selected from the other device. 2. The information processing apparatus according to claim 1, wherein the encrypted packet data is decrypted by the encryption / decryption means provided in the virtual channel.   2. The information processing apparatus according to claim 1, wherein the packet data to be encrypted by the first and second encryption / decryption means is a TLP Data field.   2. The information processing apparatus according to claim 1, wherein the packet data to be encrypted by the first and second encryption / decryption means is a TLP Memory transaction.   2. The information processing apparatus according to claim 1, wherein the control means uses a management packet to control an authentication mechanism for enabling each encryption / decryption means between the first and second devices. .   When the packet data communication by encryption is not requested between the first and second devices, the control means is configured so that the first and second encryption / decryption means respectively in the first and second devices. 2. The information processing apparatus according to claim 1, wherein a virtual channel that is not provided is selected, and packet data is communicated between the selected virtual channels.   The information processing apparatus according to claim 1, wherein the serial bus interface corresponds to PCI Express. A method for controlling an information processing apparatus including first and second devices connected by a serial bus interface,
One of the plurality of virtual channels defined in the transaction layer of the first device is provided with a first encryption / decryption means, and one of the plurality of virtual channels defined in the transaction layer of the second device. A second encryption / decryption means;
When communication of packet data by encryption is requested between the first and second devices, virtual channels provided with the first and second encryption / decryption means respectively in the first and second devices are provided. A control method for an information processing apparatus, comprising: selecting and causing communication by encryption of packet data between the selected virtual channels.

Images