TWI698769B - Secure access to peripheral devices over a bus - Google Patents

Abstract

A security device includes an interface and a processor. The interface is configured for connecting to a bus that serves one or more peripheral devices. The bus includes (i) one or more dedicated signals that are each dedicated to a respective one of the peripheral devices, and (ii) one or more shared signals that are shared among the peripheral devices served by the bus. The processor is connected to the bus as an additional device in addition to the peripheral devices, and is configured to disrupt on the bus a transaction in which a bus-master device attempts to access a given peripheral device, by disrupting a dedicated signal associated with the given peripheral device.

Description

Device and method for safely accessing peripheral devices through bus

Cross-reference of related applications

This application is a Continuation-In-Part (CIP) of U.S. Patent Application No. 15/075,219 filed on March 21, 2016, which requires a U.S. provisional patent application filed on June 8, 2015 62/172,298, the disclosure of which is incorporated herein by reference.

The present invention generally relates to electronic system security, and particularly relates to a method and system for protecting access to peripheral devices.

Electronic systems use various bus interfaces to communicate between host devices and peripheral devices. For example, the bus interface includes an Inter-Integrated-Circuit (I ² C) bus and a serial peripheral interface (SPI) bus. The relevant content of the I ² C bus is, for example, in "I ² C Bus Specification and User Manual" UM10204, NXP Semiconductors, revision 6, April 4, 2014, which is incorporated herein by reference.

The embodiments of the present invention described herein provide a security device including an interface and a processor. The interface is configured to connect to a bus that serves one or more peripheral devices. The bus system transmission includes (i) one or more dedicated signals, respectively dedicated to the corresponding one or more peripheral devices, and (ii) one or more shared signals, shared in one or more weeks served by the bus Between the side devices. The processor is connected to the bus and serves as an additional device in addition to one or more peripheral devices, and by interrupting the dedicated signal associated with a given peripheral device, it interrupts the bus main device trying to access the Determine the data handling of peripheral devices.

In some embodiments, the processor keeps the shared signal on the bus uninterrupted when interrupting data processing. In one embodiment, the interface includes: (i) an input unit for receiving a dedicated signal from the bus master device, and (ii) an output unit for outputting the dedicated signal to a given peripheral device, and the processor is through The dedicated signal to prevent input and reception is sent by the output unit, thereby interrupting data processing. In some embodiments, the processor is configured to respond to the bus master device instead of a given peripheral device when the dedicated signal is interrupted. In an exemplary embodiment, the dedicated signal includes a chip select signal.

In the disclosed embodiment, the processor monitors the bus to detect data processing to be interrupted. In an alternative embodiment, the processor detects the data processing to be interrupted by communicating with the bus master through an auxiliary interface outside the bus.

In one embodiment, the processor is configured to continuously interrupt the dedicated signal until the reset signal appears. In another embodiment, the processor is configured to interrupt the dedicated signal within a limited period of time after detecting the data processing. In one embodiment, by interrupting data processing, the processor is configured to generate data processing aborts at one or more peripheral devices. In some embodiments, the processor is configured to resume normal operation of the bus after data processing is interrupted.

According to an embodiment of the present invention, a security device including an interface and a processor is also provided. The interface is used to connect to a bus that serves one or more peripheral devices. In addition to being connected to one or more peripheral devices, the processor is also connected to the bus, and by responding to the main bus device and not responding to one or more peripheral devices, interrupts the main bus device trying to access a given peripheral device Device data handling.

In one embodiment, the bus transmission includes (i) one or more dedicated signals, respectively dedicated to the corresponding one or more peripheral devices, and (ii) one or more shared signals, which are shared by the bus service Between one or more peripheral devices, the processor interrupts data processing by (i) interrupting dedicated signals related to a given peripheral device, and (ii) responding to the bus master device when the dedicated signal is interrupted.

In some embodiments, the given peripheral device includes a memory device, and the processor is configured to recognize a request from the bus master device to read data from the memory device during data processing, and store it in the security device The replacement data in response to the request. In an exemplary embodiment, the processor is configured to recognize that the bus master device requests to access the predefined address area in the memory device, interrupt data processing and respond with substitute data.

In another embodiment, the processor is configured to identify the data processing of the bus master attempting to access the given peripheral device based on the data sent back from the given peripheral device to the bus master device during data processing. In yet another embodiment, the processor is configured to recognize the data processing of the bus master attempting to access a given peripheral device based on the instruction code used in the data processing.

According to an embodiment of the present invention, there is also provided a method for safely accessing peripheral devices through a bus, including using a security device to communicate via the bus, wherein the security device is connected to the bus and serves as one or more peripheral devices Additional equipment other than that, where the transmission on the bus includes (i) one or more dedicated signals, respectively dedicated to the corresponding one or more peripheral devices, and (ii) one or more shared signals, shared on the bus Between one or more peripheral devices served; using the security device, by interrupting the dedicated signal associated with a given peripheral device, thereby interrupting the bus main device trying to access the given peripheral device on the bus Data disposal.

According to an embodiment of the present invention, a method for securely accessing peripheral devices through a bus is also provided. The security device is used to communicate via the bus, and the security device is connected to the bus and used as an addition to one or more peripheral devices. Equipment; and the use of security devices through the response bus The main device does not respond to a given peripheral device in order to interrupt the bus on the bus when the main device attempts to access the data processing of the given peripheral device.

In another embodiment, a device including an interface and a processor is provided. The interface is set to communicate through the bus, and the processor is set to forcibly write one or more dummy values in parallel to at least one line of the bus to interrupt at least one line when the bus master device wants to access peripheral devices without authorization. Part of the data processing.

In one embodiment, the processor is configured to force a virtual value to be written to the data line on the bus to block it from receiving or transmitting the respective data value of the peripheral device through the data line. Additionally or alternatively, the processor is configured to force a virtual value to be written to the clock line on the bus to interrupt the clock signal used for data processing. Further additionally or alternatively, the processor is configured to forcibly write a dummy value to the chip selection line on the bus bar to interrupt the bus main device to select peripheral devices.

In some embodiments, the bus includes an open-collector bus or open-drain bus with a preset logic value, and the processor is configured to force a virtual value opposite to the preset logic value to be written to the bus At least one line.

In some embodiments, by forcing the virtual value to be written, the processor is configured to overwrite the corresponding value of at least one line written on the bus main device or peripheral device. In an exemplary embodiment, the processor is configured to overwrite the corresponding value of at least one line written on the main bus device or the peripheral device by driving at least one line whose drive strength is greater than that of the main bus device or the peripheral device. In another embodiment, the device includes at least one resistor, which is arranged on at least one line, and the resistor is arranged to reduce the value written to the bus main device or peripheral device to a virtual value that is lower than that written by the processor. The value is weak.

In some embodiments, the processor is configured to forcibly write the dummy value only through the existing line of the bus used for communication between the bus main device and the peripheral device. In some embodiments, the processor is configured to detect data processing to be interrupted by monitoring the bus. In one embodiment , The processor is set to detect the data processing to be interrupted by communicating with the bus main device on the auxiliary interface outside the bus main device.

In a disclosed embodiment, the processor is set to forcibly write virtual values without limitation until the device is reset. In another embodiment, the processor is configured to force a virtual value to be written within a limited time when data processing is detected. In one embodiment, the processor is configured to moderately resume normal operation of the bus after data processing is interrupted.

According to an embodiment of the present invention, a system including a peripheral device and a safety device is also provided. Peripheral devices can access one or more bus master devices through the bus. This security device interrupts at least a part of data processing by forcibly writing one or more dummy values to at least one line of the bus in parallel when the bus master device is not authorized to access peripheral devices.

According to an embodiment, the present invention also provides a method that includes using a security device coupled to the bus to determine whether to interrupt the data processing of the bus master device from unauthorized attempts to access peripheral devices, and write one or more data in parallel forcibly A plurality of dummy values are sent to at least one line of the bus to interrupt at least a part of data processing.

From the following detailed description of its embodiments in conjunction with the accompanying drawings, the present invention will be more fully understood:

20, 70, 110, 130: system

24, 74: host device

28, 78: peripheral devices

32: I ² C bus

36, 86: safety device

40, 90: Interface

44, 94: processor

48, 98: Memory

50: Monitoring steps

54: Detection steps

58: check steps

62: Approval Step

66: Interrupt step

82: SPI bus

91: Slave interface logic circuit

92: Interface monitoring logic circuit

100: series resistance

102: Maintain reset step

104: Initial reading step

108: Covering step

112: Reset release step

116: startup steps

120: Regional access sub-step

CS1#: Chip selection line

CS2#: Chip selection line

CLK: clock line

MASK_CS2#: Control signal

MOSI: master output and slave input line

MISO: main input and slave output line

Figure 1 is a block diagram of a security system in which multiple devices communicate via a 12C bus in an embodiment of the present invention.

Figure ² is a flowchart of a method for protecting access to peripheral devices through an I ² C bus according to an embodiment of the present invention.

Figures 3 to 5 are block diagrams of a security system in which multiple devices communicate via an SPI bus in an alternative embodiment of the present invention.

Figure 6 is a schematic block diagram of a security device according to an embodiment of the present invention.

FIG. 7 is a flowchart of a method for secure booting of a host device according to an embodiment of the present invention.

Overview

The embodiments of the present invention describe how the improved method and device protect the access to peripheral devices through the bus interface. Peripheral devices can include encryption engines, storage devices that store sensitive data, or any devices that can be accessed via a bus.

In some disclosed embodiments, the security device monitors the data processing on the bus and recognizes it when the host device or other bus master device tries to access the peripheral device without authorization. Data handling can be classified as authorized or unauthorized through various appropriate standards or policies.

When the unauthorized data processing is identified, the security device interrupts it by forcibly writing data or signals to a virtual value on one or more lines on the bus in parallel. The forced writing of virtual values can be performed on, for example, clock signals, data signals and/or chip-select signals.

The forced write virtual value is suitable for interrupting the signal on the bus, for example, for a bus with an open drain or an open collector, such as an I ² C bus or a push-pull bus, such as an SPI bus. In parallel with the data processing on the bus, forcibly writing the dummy value to interrupt the communication with the peripheral device and/or interrupt the respective clock signal.

This article describes several examples of techniques used to interrupt the handling of unauthorized data on the I ² C and SPI buses. It also describes techniques used to resume normal operation after an interruption. In some embodiments, the security device can interrupt data processing without first detecting the data processing on the bus, or even not monitoring the bus at all. For example, the security device can forcibly enter a virtual value on the chip select (CS) line of a certain host until or unless the host is authorized.

In some embodiments, for example, in SPI, a bus protected by a security device transmits (i) one or more dedicated signals, each dedicated signal dedicated to a corresponding peripheral device, and (ii) on the bus One or more shared signals shared between the peripheral devices being served. Examples of shared signals are data and clock signals. An example of a dedicated signal is the CS signal. In some embodiments, the security device interrupts data processing by interrupting dedicated signals associated with protected peripheral devices, while maintaining uninterrupted shared signals on the bus. It should be noted that not all buses have dedicated signals. For example, in an I ² C bus, all signals are shared signals.

In other embodiments, the security device interrupts data processing by responding to unauthorized hosts and not to protected peripheral devices. In an exemplary embodiment, the peripheral device includes flash memory, and the flash memory includes one or more address areas allocated for storing sensitive data such as keys, setting data, and/or startup codes. By selectively driving the CS signal of the flash memory, the security device can drive the access to the data in the flash memory. Instead, the security device uses the data stored inside the security device to respond to the host. This safe boot process is described here.

The technology disclosed here provides real-time secure and selective access to peripheral devices at the transaction-by-transaction level. In most of the technologies described in this article, only the existing signal of the bus is used to perform data processing identification and interruption. Therefore, the disclosed technology does not require additional pins or interconnections, thereby reducing the overall system size and cost.

Safely access data to peripheral devices through I ² C bus.

Figure 1 is a block diagram of the security system 20 in an embodiment of the invention. In the embodiment of the present invention, the system 20 includes a host device 24 and a peripheral device 28, both of which are connected to the I ² C bus 32. For the sake of brevity, the host device 24 and the peripheral device 28 are also referred to herein as the host and peripheral, and the host device 24 may also be a bus master device.

The security device 36 protects data access to the peripheral device 28 by monitoring data transactions on the I ² C bus 32, and prevents the host device 24 or other devices capable of the bus master device from attempting unauthorized access to the peripheral device 28 . The security device 36 is sometimes called a control device or a trusted platform module (TPM). In the embodiment of the present invention, the security device 36 includes an interface 40 for connecting to the I ² C bus 32; a processor 44 configured to execute the technology of the present invention; and a memory 48 configured to Used to store one or more security policies implemented by the processor 44.

The processor 44 can classify the data handling as unauthorized according to any predefined or set policy. Generally, unauthorized data handling can attempt to overwrite the data of the peripheral device 28, read the data of the peripheral device 28, set or send commands to the peripheral device 28, or access the peripheral device 28 in other suitable ways. The policy implemented by the security device 36 may include a positive policy (such as a whitelist), a negative policy (such as a blacklist), a policy that depends on the device address or register offset, or any other form of policy. policy.

For example, the security device 36 may require the host to authenticate the identity of the host device 24 before being authorized to access the peripheral device 28, and the data processing attempted by an unauthorized host may be regarded as unauthorized. Authentication can be performed through, for example, a challenge-response process between the host and the security device. Additionally or alternatively, the host may be required to prove its identity in some other suitable way, or successfully complete the secure boot procedure.

In addition, in addition or alternatively, some types of data disposal (such as read data disposal) can be considered authorized, while other types of data disposal (such as write data disposal) can be considered unauthorized of. In yet another embodiment, access to the address of the selected peripheral device may be regarded as authorized, and access to other addresses may be regarded as unauthorized. As another example, bit sequences on the bus can be displayed as unauthorized data handling.

Generally, the processor 44 can distinguish whether the data processing is authorized or not through any suitable method. The memory 48 stores one or more policies to distinguish whether the data processing is authorized.

The I ² C bus 32 includes a serial data line with a serial data (SDA) signal and a serial clock line with a serial clock signal (SCL). The terms "line" and "signal" can be used interchangeably in this article. By monitoring the SDA line and the SCL line, the processor 44 can monitor all data processing on the I ² C bus 32 and identify unauthorized data processing.

After identifying unauthorized data processing, the processor 44 interrupts the data processing by forcibly writing one or more dummy values to the SDA line and/or SCL line on the I ² C bus 32. This mechanism is possible because the I ² C bus has an open drain/open collector structure. Generally, both the SDA line and the SCL line use pull-up resistors and are pulled up to a logic "1" state by default. Any device can write a logical "0" value on the SDA line or SCL line at any time, regardless of the value that other devices may write at the same time.

Therefore, in some embodiments, when unauthorized data processing is identified, the processor 44 in the security device 36 will force the logic value "0" on the SDA line or SCL line of the I ² C bus 32 through the interface 40. "(The opposite of the preset logic value "1"). The "0" value is regarded as a dummy value in this article. The value "0" that is forcibly written on the SDA line will overwrite any value simultaneously sent by the host device 24 to the peripheral device 28 or the value read by the host device 24 from the peripheral device 28, or the preset logical value "1". Forcibly writing a "0" value on the SCL line will stop the clock signal. In any of the above cases, data processing will be interrupted.

In some embodiments, the processor 44 will continue to force write the "0" value until the device is reset. In other embodiments, the processor 44 allows moderate recovery from the interrupt, that is, allows the host device 24 and the peripheral device 28 to recover the data processing from the interrupt and resume normal operation. Some hosts and/or peripheral devices cannot respond from the timer pause. Therefore, if the simple host and peripheral devices need to be properly recovered later, it is better to forcibly write the dummy value on the SDA line instead of on the SCL line.

In one embodiment, in order to resume normal operation after interrupting data processing, the processor 44 generates an I ² C stop or I ² C restart condition on the bus. In this context, the I ² C stop or I ² C restart condition can include any sequence of bus signal values, which can indicate that the device bus is in an idle state and data processing can begin.

The processor 44 can use various techniques to allow moderate recovery after data processing is interrupted. In one embodiment, the processor 44 continues to forcibly write a "0" value for a predetermined length of time, which is deemed sufficient to interrupt unauthorized data handling. Any predetermined length of time can be used. For example, the length of the pause time defined by the SM bus is 25mS. Therefore, in the application of SM bus in I ² C, it makes sense to set the predefined duration to at least 25 mS in order to trigger the pause.

In another embodiment, the processor 44 continues to forcibly write a "0" value on the SDA line for a predetermined time until it detects that the SCL line is a logic high value (ie, not toggling). This condition can instruct the host to suspend or discard data processing. The processor 44 may then release the SDA line and may generate an I ² C stop condition.

In yet another embodiment, it is useful to interrupt the processing of data read from the peripheral device to set the security device 36 as an I ² C slave device with the same address as the peripheral device 28. The processor 44 in the security device 36 uses the "0" data value to respond to any unauthorized reading request. The peripheral device 28 will also respond to these read requests to the processor 44 in parallel, but its data value will be overwritten by the "0" value transmitted by the security device 36. This process will continue until the host suspends data processing, for example through a stop condition. It should be noted that according to the I ² C specification, the I ² C slave device does not drive the ACK/NEGACK bit when sending data.

In another embodiment, it is useful to simultaneously interrupt the read and write data handling is forcing the processor 44 to write a value of "0" on the SDA line. Then, if the host device 24 does not recognize the interruption, the data processing is normally terminated through the "0" data on the bus, instead of the data sent from the peripheral device 28. If the host device 24 detects this interrupt (for example, it supports I ² C multi-master arbitration) and discards data processing, the processor 44 can take over the data processing discarded by the host device 24, usually by Extra clock cycles are generated on the SCL line. The processor 44 can then complete the current byte being transferred and suspend the data processing by issuing a stop condition.

The interruption and recovery techniques described above are only described by embodiments. In an alternative embodiment, the processor 44 of the security device 36 may interrupt data processing and/or recover from the interruption through any other technology.

In the above embodiment, only the existing lines of the bus are used to realize the detection, interruption, and response after interruption of unauthorized data handling. In an alternative embodiment, the security device 36 and the host device 24 are also connected through some auxiliary interfaces outside the bus 32. For example, this mechanism is feasible when the security device 36 and the host device 24 are integrated in the same integrated circuit (IC) and share the SDA and SCL pins of the IC.

In these embodiments, the security device 36 and the host device 24 use an auxiliary interface to verify that no other host device accesses the peripheral device 28. In an exemplary embodiment, when the host device 24 accesses the peripheral device 28, the host device 24 notifies the security device 36 through the auxiliary interface. In response to the notification, the processor 44 does not forcibly write the virtual value "0" to the bus, and allows the data processing to be performed. When detecting data processing that accesses the peripheral device 28 but not reported on the auxiliary interface, the processor 44 assumes that the data processing is sent by some unauthorized host, and interrupts it by forcibly writing a "0" value.

FIG. 2 is a flowchart of a method for protecting access to the peripheral device 28 through the I ² C bus 32 according to an embodiment of the present invention. This method is started in the monitoring step 50, and the processor 44 on the security device 36 monitors the data processing on the I ² C bus 32 through the interface 40.

In the data processing detection step 54, the processor 44 recognizes that the host device 24 attempts to access the data processing of the peripheral device 28. In the checking step 58, the processor 44 checks whether the data handling is authorized. For example, the processor 44 can check whether the data handling violates the security policy stored in the memory 48.

If the data processing is authorized, in the permission step 62, the processor 44 will allow the data processing to proceed normally. Otherwise, if it is detected that the data processing is unauthorized, the processor 44 will write the virtual value by forcibly in the interrupt step 66 "0" to the SCL and/or SDA lines of the I ² C bus 32 to interrupt this data processing.

Safely access peripheral devices via SPI bus.

Figure 3 is a block diagram of the security system 70 in an alternative embodiment of the present invention. As shown in FIG. 3, the system 70 includes a host device 74, a peripheral device 78, and a security device 86, all of which are connected to the SPI bus 82.

When the host device 74 attempts to access the peripheral device 78 without authorization, the security device 86 will recognize and interrupt the data processing. In the embodiment of the present invention, the security device 86 includes an interface 90, which is connected to the SPI bus 82; a processor 94, which is configured to execute the technology of the present invention; and a memory 98, which is configured to store one or more The security policy implemented by the processor 94.

The security policy for distinguishing between authorized and unauthorized data handling, and the way the processor 94 of the security device 86 recognizes the unauthorized data handling is basically similar to that described in the aforementioned system 20. The difference between the latter technique and the above technique is that the security device 86 forcibly writes a dummy value on the bus 82 to interrupt unauthorized data processing.

The SPI bus 82 includes a clock (CLK) line and two data transmission lines called a master output slave input line (MOSI) and a master input slave output line (MISO). The CLK, MISO, and MOSI lines are common to all devices (host devices 74, 78, and 86 in this embodiment). In addition, each slave device can be selected through a dedicated chip selection line. In this embodiment, the host device 74 uses the CS line labeled CS2# to select the peripheral device 78, and uses the CS line labeled CS1# to select the security device 86.

The host device 74 as the master control device is connected to all CS lines. On the other hand, since the peripheral devices 78 are slave devices, each peripheral device 78 is only connected to its own CS line. Generally, the host device 74 initiates data processing by selecting the desired peripheral device 78 using the corresponding CS line, and then communicates with the device using the CLK, MOSI, and MISO lines. The MOSI line is used to send signals from the host device 74 to the peripheral device 78, and the MISO line is used to send signals from the peripheral device 78 to the host device 74.

The security device 86 is different from a conventional SIP slave device, which is defined as a slave device but can drive all CS lines. As shown in Figure 3, the interface 90 of the security device 86 is set to drive in parallel with the host device 74 Move the CS2# line. When the system 70 includes a plurality of peripheral devices 78 with corresponding CS lines, the safety device 86 is usually set to drive any CS lines connected to the host device 74 in parallel.

In some embodiments, the system 70 is designed such that when the host device 74 and the security device 86 drive the CS line with opposite logic values, the logic value driven by the security device 86 will overwrite the logic value driven by the host device 74. It can also be said that when the host device 74 and the safety device 86 drive opposite logic values on the CS line, the peripheral device 78 will receive and execute the logic value driven by the safety device 86.

Covering the CS line is another example of preventing data processing on the bus to interrupt unauthorized data processing between the host and peripheral device 78. The above-mentioned coverage mechanism can be implemented in various ways. The following description refers to the CS2# line used to select the peripheral device 78, but when multiple peripheral devices 78 and multiple corresponding CS lines are used, the same mechanism should be used.

In one embodiment, the line driver of the security device 86 that drives the CS2# line through the interface 90 is stronger than the line driver of the host device 74 that drives the CS2# line. In an alternative embodiment, the series resistor 100 may be inserted into the CS2# line at the output of the host device 74. With respect to the output of the safety device 86 to the CS2# line driver, the series resistor 100 attenuates the output of the host device 74 to the CS2# line driver. In addition, the security device 86 can be configured to cover the signal of the host device 74 driving the CS2# line in any other suitable manner.

The processor 94 of the security device 86 can monitor the CS# line, CLK, MISO and/or MOSI line of the SPI bus 82, and identify unauthorized data processing in any suitable manner. In some embodiments, the processor 94 of the security device 86 interrupts the data processing by disabling the CS line of the peripheral device 78 when the host device 74 is identified as an unauthorized attempt to access the data processing of a certain peripheral device 78. Since the security device 86 is set to overwrite the drive of the CS2# line by the host device 74, the peripheral device 78 will be deselected and the data processing will be interrupted. On the other hand, when it is determined that the data processing is authorized, the processor 94 will stop its CS2# drive, so that the host can access the peripheral device 78 without interruption.

Figure 4 is a block diagram of the security system 110 in another embodiment of the present invention. The system 110 is also based on the SPI bus 82, which is similar to the system 70 in FIG. 3. However, in the system 110, the security device 86 destroys unauthorized data processing by forcing a dummy value to be written on the CLK line, the MISO line, and/or the MOSI line instead of overwriting the CS line.

In this embodiment, the system 110 is configured to take priority over the host device 74 when the security device 86 drives the CLK line, MISO line, and/or MOSI line. As shown in the figure, to achieve this goal, a series resistor 100 is inserted into the CLK line, the MISO line and the MOSI line. Since the CS2# line in this embodiment is not overwritten, the series resistor 100 is not inserted in the CS2# line.

In an alternative embodiment, the overwrite mechanism can be implemented by making the corresponding line drivers of the CLK line, MISO line and/or MOSI line in the security device 86 stronger.

In other embodiments, a hybrid scheme that simultaneously overwrites the CS line (as shown in Figure 3) and overwrites the CLK line, MISO line and/or MOSI line (as shown in Figure 4) is also feasible.

Protect access to peripheral devices by covering dedicated point-to-point signals

The signals of the bus (such as SPI) can be divided into shared signals and dedicated signals. The shared signal is a signal connected in parallel with a plurality of (for example, all) peripheral devices on the bus. Examples of shared SPI signals are data (MOSI and MISO) and clock (CLK) signals. A dedicated signal is a signal dedicated to a specific peripheral device. An example of a dedicated signal that is part of the bus is the Chip-Select signal. In addition, the bus can be enhanced with out-of-band dedicated signals, such as a Write Protect signal (when the peripheral device includes a storage device). The dedicated signal may also be called a point to point (PTP) line.

In some embodiments, one or more dedicated signals pass through the security device 86 before reaching the peripheral device. On the contrary, shared signals are usually routed to peripheral devices and do not pass through security devices. This interconnection scheme enables the security device to effectively protect the peripheral devices, as detailed below.

Figure 5 is a block diagram schematically showing a security system 130 according to an alternative embodiment of the present invention. This system is similar to the system 70 in Figure 3. However, in this embodiment, the CS2# signal does not directly drive the input part of the peripheral device 78. Conversely, the CS2# line from the host device 74 is input to the safety device 86, and the safety device 86 in turn drives a signal denoted as CS2_O#, which is connected to the input part of the peripheral device 78.

In this embodiment, the CS2# signal is used as an example of a dedicated PTP signal, which is routed to a protected peripheral device through a security device on the way. It can be seen from the figure that the shared signals (MOSI, MISO, and CLK) are uninterrupted between the host device 74 and the peripheral device 78.

The security device 86 is configured to interrupt the data processing between the host device 74 and the peripheral device 78 by selectively causing the CS2# signal to reach the peripheral device or preventing the CS2# signal from reaching the peripheral device. In the example in Figure 5, the selection is performed by asserting or de-asserting the control signal denoted as MASK_CS2#.

Figure 6 is a block diagram of the security device 86 of the system 130 described in Figure 5 according to an embodiment of the present invention. In this example, the security device 86 includes an interface 90 for connecting to the SPI bus 82, a processor 94 configured to perform the disclosed technology, and a processor 94 configured to store one or more security policies enforced by the processor 94 The memory 98. The processor 94 includes a slave interface logic (slave interface logic) 91 and an interface monitor logic (IML) 92. The slave interface logic circuit 91 handles the communication between the security device 86 and the host device 74. The interface monitoring logic circuit 92 monitors, controls, and selectively covers the access of the host device 74 to the peripheral device 78.

In one embodiment, the security device 86 recognizes and interrupts the data processing of the host device 74 attempting to access the peripheral device 78 on the SPI bus 82 without authorization. It can be understood from Figures 5 and 6, that any security features possible in the system described in Figure 3 can also be implemented in the system of Figure 5.

In the above embodiment, the safety device is connected to the bus bar and is set as an additional slave device. However, in other embodiments, the security device may be connected and set as the master device. For example, this implementation is suitable for bus protocols that support multi-master capabilities.

Protects against unauthorized data handling with security devices that respond on behalf of peripheral devices

In another embodiment, the security device 86 responds to the selected host data handling on behalf of the peripheral device 78. The following description mainly relates to the settings of Figures 5 and 6, which are purely examples. Generally, the disclosed technology is not limited to this specific system setting, and can be applied using any other setting, for example, the setting of Figure 3 or Figure 4 above.

In the exemplary embodiment involving the settings of FIGS. 5 and 6, when a read command is detected from a certain address area in the address space of the peripheral device 78, the interface monitoring logic circuit 92 may force the setting of CS2_O# to "High" and provide the host read command (or part of the read command) from the memory 98 of the security device. The host device 74 usually has no way of knowing that the response did not originate from a peripheral device. In some embodiments, this scenario is also applicable to the system 110 in FIG. 4, for example, when the security device covers the MISO signal.

An example of the use of this mechanism is a system in which the peripheral device 78 includes an SPI flash memory device, and the security device 86 is set to cover part of the flash memory address space, and in this way provides a secure address area Flash memory emulation (emulation). For example, the security device 86 may include a TPM, which uses the interface monitoring logic circuit 92 to cover the flash memory address area containing the initial host startup code (the first startup command retrieved by the host at startup). The TPM can overwrite this flash memory address area with a self-contained authenticated initial startup code, for example, to verify the rest of the code before jumping to the code.

In some embodiments, the security device 86 also includes a main interface to the SPI flash memory device. In addition, the security device 86 may include appropriate interfaces and circuits to access the SPI flash memory The host device 74 is maintained to reset when the device is installed, which is usually part of the system startup process. The security device 86 may be, for example, an embedded controller (EC), super I/O (SIO) or a baseboard management controller (BMC) device.

Figure 7 is a flowchart schematically showing an example of such a secure boot process according to an embodiment of the present invention. The method starts from the start, that is, the system power is asserted. In the maintaining reset step 102, the security device 86 maintains the host device 74 in a reset state and optionally starts from the SPI flash memory (peripheral device 78). In the (optional) initial reading step 104, the security device 86 reads the data block from the SPI flash memory, verifies the authentication of the data block and stores it in the memory 98.

In the covering step 108, the security device 86 sets the interface monitoring logic circuit 92 to cover the access to at least one predefined address area in the SPI flash memory (the peripheral device 78 in this example). The address area in question may include, for example, one or more keys, setting data, and/or the initial boot block of the host device 74.

In the reset release step 112, the safety device 86 releases the host from reset. Therefore, in the activation step 116, the host device 74 starts its activation process. As part of the activation process, in the area access substep 120, the security device 86 services the access to the predefined address area from the internal memory 98.

In this way, sensitive information such as keys, setting data, and/or initial activation codes can be safely provided from the security device. The host device 74 has no way of knowing that the information is provided from the security device rather than from the SPI flash memory.

The method in Figure 7 shows an example of how the security device can cover access to the predefined address area of the peripheral device. In alternative embodiments, any other suitable method may be used for this purpose. As an alternative to disguising the SPI flash memory device, the security device can protect the flash memory device (or other peripheral devices) by covering and/or interrupting any other suitable unauthorized data handling.

In addition, the coverage of unauthorized data handling is not limited to protecting specific pre-defined address areas. For example, the coverage can be triggered based on the return data from the protected external device or the command code of the SPI. For example, a security device can implement a security policy that disables programs, erases, and erases flash memory devices. Write enable, status/settings and/or any other commands or functions. The specification examples of SPI flash memory commands and instructions were published by Winbond Electronics Corporation in "SPI Flash-3V Serial Flash Memory with Dual/Quad SPI and QPI (SPI Flash-3V Serial Flash Memory with Dual/Quad) SPI and QPI)”, published on August 24, 2015.

As another example, in the method of Figure 7, sensitive information always exists in the flash memory device and is read by the security device as part of the startup process. In alternative embodiments, sensitive information may be initially stored in a secure device (in addition to flash memory or not stored in flash memory). In such an embodiment, there is no need to read the information from the flash memory device to the security device.

In another example, the method of Figure 7 is described with reference to the SPI bus. In an alternative embodiment, the security device can use any dedicated signal (if any) and/or shared signal of the bus to cover access to the predefined address area of the peripheral device in other buses and protocols. For example, the I ² C bus is a pull-up bidirectional bus designed to support multiple slave devices and multiple master devices. Therefore, the protocol has an embedded mechanism to deal with contention between devices. For example, when an I ² C device detects a “0” on the SDA line while trying to set a “1” (pull up), the device assumes that it is in contention and releases the bus until the next data processing. In one embodiment, the I ² C security device (for example, the security device 36 in Figure 1) is configured to overlap some address space of another peripheral slave device (for example, the peripheral device 28 in Figure 1). The security device can, for example, be set to respond to the same data as other peripheral devices. If the security device detects that the data does not match (for example, trying to pull up a '1' but detecting a '0' on the SDA line), the security device can initiate a response action (for example, a stop condition is generated on one or more data lines Drive '0' to set endless clock stretching (or any other suitable action). This technology can use the traditional I ² C slave device (no hardware changes in the physical layer) to monitor the device to the data level.

In yet another embodiment, the security device 86 (using the interface monitoring logic circuit 92) also monitors the data phase of the SPI address. When the data does not match, the safety device can be activated Respond actions, for example, by interrupting data handling, resetting the system, locking access to the key, or any other appropriate action.

In an exemplary scenario, the security device 86 saves the signature or summary of a specific code segment stored in the SPI flash memory. The security device monitors the access of the host device 74 to the SPI flash memory when calculating the signature or the cache value of the code portion in the background. If an incorrect signature, cache value, or SPI acquisition sequence is detected, the security device 86 can initiate an appropriate response action.

In yet another embodiment, the security device may monitor more than one peripheral device 78 on the bus 82 and, for example, verify whether the order of access to different devices is as expected.

In another embodiment, the security device 86 uses one or more signals (except CS) to restrict access to the peripheral device 78, or enforce a certain system when it detects authorized data processing with the peripheral device 78 status. Non-limiting examples of such signals include: any signal as described in the system of Figure 4.

Write protection signal in flash memory.

Control reset signal.

Control the power management signal.

Control power to one or more devices.

Stop system communication (for example, stop the network interface controller).

System reset.

The configurations of the systems 20, 70, 110, and 130 shown in Figure 1 and Figures 3 to 6, as well as various system components such as safety devices 36, 86 and bus bars 32, 82 are drawn for clear description Schematic diagram In an alternative embodiment, any other suitable configuration may be used.

For example, for clarity, the drawings only show a single peripheral device and a single host device. In some embodiments, the system may include two or more peripheral devices and/or two or more host devices. The embodiment described here refers to an example using I ² C and SPI bus. In an alternative embodiment, the disclosed technology can be applied to other suitable types of busbars with necessary modifications.

The different components of the systems 20, 70, 110, and 130 can be implemented by any suitable hardware, such as Application-Specific Integrated Circuit (ASIC) or Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA). In some embodiments, some components of the security devices 36 and 86 (for example, the processor 44 or the processor 94) may be implemented using software or a combination of hardware and software components. The memory 48 and 98 can use any suitable type of memory device, such as Random Access Memory (RAM) or Flash memory.

In some embodiments, the processor 44 and/or the processor 94 comprise general-purpose programmable processors, which are programmed in software to perform the functions described herein. The software can be downloaded to the processor in electronic form via the Internet, or can be stored in additional or replaceable non-transitory tangible media (non-transitory tangible media) such as magnetic, optical, and electronic memory.

In the above embodiment, the security device first detects unauthorized data processing by monitoring the bus, and then interrupts the data processing. In an alternative embodiment, the security device can interrupt the data processing without first detecting the data processing, or even without monitoring the bus. For example, the security device can override the chip select (CS) line of a certain host until or unless the host is authorized. Authorization can be performed in any suitable way, and it is not necessary to use the same bus.

As a non-limiting example, the methods and systems described herein can be used in various applications, such as in secure memory applications, Internet of Things (IoT) applications, embedded applications, or automotive applications, to name just a few examples.

Therefore, it should be understood that the above-mentioned embodiments are cited as examples, and the present invention is not limited to the content specifically shown and described above. On the contrary, the scope of the present invention includes the combinations and sub-combinations of the above-mentioned various features, as well as the unintended ones that those skilled in the art will think of when reading the foregoing description. Revealed technology. The documents incorporated into this application by reference are a part of this application. Unless there are any definitions of terms in these incorporated documents that explicitly or implicitly conflict with this document, reference should be made to the definitions herein.

20: System

24: host device

28: Peripheral devices

32: I ² C bus

36: safety device

40: Interface

44: processor

48: memory

Claims (34)

A security device for securely accessing peripheral devices through a bus, including: an interface for connecting to a bus serving one or more peripheral devices, wherein the bus system transmission includes (i) one or more dedicated The signals are respectively dedicated to the corresponding one or more peripheral devices, and (ii) one or more shared signals are shared between the one or more peripheral devices served by the bus, and the one or more A dedicated signal is transmitted to the peripheral device or peripheral devices via the security device, and the shared signal or shared signal is not transmitted to the peripheral device or peripheral devices via the security device; and a processor connected to The bus is used as an additional device in addition to the one or more peripheral devices, and by interrupting the dedicated signal associated with a given peripheral device, a bus master device tries to interrupt the bus on the bus. Access to a data transaction of the given peripheral device. The security device according to claim 1, wherein the processor maintains the shared signal on the bus uninterrupted when interrupting the data processing. The security device according to claim 1, wherein the interface includes: an input portion for receiving the dedicated signal from the bus master device; and an output portion for outputting the dedicated signal to the given peripheral device, The processor interrupts the data processing by preventing the dedicated signal received by the input unit from being sent from the output unit. The security device according to claim 1, wherein the processor is set to respond to the bus main device instead of a given peripheral device when the dedicated signal is interrupted Set. The security device according to claim 1, wherein the dedicated signal includes a chip select (CS) signal. The security device according to claim 1, wherein the processor monitors the bus to detect the data processing to be interrupted. The security device according to claim 1, wherein the processor communicates with the bus master device through an auxiliary interface outside the bus to detect the data processing to be interrupted. The security device of claim 1, wherein the processor is configured to continuously interrupt the dedicated signal until a reset signal appears. The security device according to claim 1, wherein the processor is configured to interrupt the dedicated signal within a limited time period after detecting the data processing. The security device according to claim 1, wherein by interrupting the data processing, the processor is configured to generate a data processing abort (transaction abort) at the one or more peripheral devices. The security device according to claim 1, wherein the processor is configured to resume normal operation of the bus after the data processing is interrupted. A security device for securely accessing peripheral devices through a bus, comprising: an interface for connecting to a bus serving one or more peripheral devices; and a processor except for connecting to the one or more peripheral devices The external device is also connected to the bus, and the bus master is interrupted by responding to a bus master device instead of responding to one or more peripheral devices. The device attempts to access a data transaction of a given peripheral device; wherein the bus transmission includes (i) one or more dedicated signals, respectively dedicated to the corresponding one or more peripheral devices, and (ii ) One or more shared signals are shared between the one or more peripheral devices served by the bus, and the one or more dedicated signals are transmitted to the one or more peripheral devices via the security device, And the one or the plurality of shared signals are not transmitted to the one or the plurality of peripheral devices through the security device. The security device according to claim 12, wherein the processor uses (i) interrupts the dedicated signal related to the given peripheral device, and (ii) responds to the bus master device when the dedicated signal is interrupted, Take this to interrupt the data processing. The security device according to claim 12, wherein the given peripheral device includes a memory device, and the processor is configured to identify data from the bus master device for reading from the memory device in the data processing A request for fetching data, and responding to the request with a substitute data stored in the security device. The security device according to claim 14, wherein the processor is configured to recognize that the bus master device requests to access a predefined address area in the memory device, interrupt the data processing and respond with the substitute data . The security device according to claim 12, wherein the processor is configured to identify that the bus master device attempts to access based on the data returned from the given peripheral device to the bus master device in the data processing The data handling of the given peripheral device. The security device according to claim 12, wherein the processor is set to be based on The instruction code used in the data processing identifies the data processing of the bus master attempting to access the given peripheral device. A method for securely accessing peripheral devices through a bus includes: using a security device to communicate via a bus, wherein the security device is connected to the bus and used as an additional device in addition to one or more peripheral devices, The bus system transmission includes (i) one or more dedicated signals, respectively dedicated to the corresponding one or more peripheral devices, and (ii) one or more shared signals, shared with the bus served by the Between one or a plurality of peripheral devices, and the one or the plurality of dedicated signals are transmitted to the one or the plurality of peripheral devices through the security device, and the one or the plurality of shared signals are not transmitted to the one through the security device Or the plurality of peripheral devices; using the security device by interrupting the dedicated signal associated with a given peripheral device, thereby interrupting a bus master device trying to access a given peripheral device on the bus Data processing (transaction). The method of claim 18, wherein interrupting the data processing includes maintaining the shared signal on the bus uninterrupted. The method according to claim 18, wherein the interface includes: an input unit for receiving the dedicated signal from the bus master device; and an output unit for outputting the dedicated signal to the given peripheral device; wherein Interrupting the data processing includes preventing the dedicated signal received at the input unit from being sent from the output unit. The method according to claim 18, wherein interrupting the data processing includes when the special When the signal is interrupted, it responds to the main bus device instead of the given peripheral device. The method according to claim 18, wherein the dedicated signal includes a chip select (CS) signal. The method of claim 18, further comprising detecting the data processing to be interrupted by monitoring the bus. The method according to claim 18, further comprising detecting the data processing to be interrupted by communicating with the bus main device through an auxiliary interface outside the bus. The method of claim 18, wherein interrupting the data processing includes continuously interrupting the dedicated signal until a reset signal appears. The method of claim 18, wherein interrupting the data processing includes interrupting the dedicated signal within a limited time period after detecting the data processing. The method of claim 18, wherein interrupting the data handling includes generating a data handling suspension at the one or more peripheral devices. The method according to claim 18, further comprising restoring the normal operation of the bus after the data processing is interrupted. A method for securely accessing peripheral devices through a bus includes: using a security device to communicate via a bus, wherein the security device is connected to the bus and used as an additional device in addition to one or more peripheral devices, The bus system transmission includes (i) one or more dedicated signals, respectively dedicated to the corresponding one or more peripheral devices, and (ii) one or more shared signals, shared on the bus Between the one or more peripheral devices served by the row, and the one or the plurality of dedicated signals are transmitted to the one or the plurality of peripheral devices through the security device, and the one or the plurality of shared signals do not pass through the The security device is transmitted to the peripheral device or devices; and the security device is used by responding to a bus master device without responding to a given peripheral device, thereby interrupting the bus master device’s attempt to save on the bus Take a data transaction of the given peripheral device. The method of claim 29, wherein interrupting the data processing includes (i) interrupting the dedicated signal related to the given peripheral device, and (ii) responding to the bus master device when the dedicated signal is interrupted. The method of claim 29, wherein the given peripheral device includes a memory device, wherein interrupting the data processing includes identifying data from the bus master device in the data processing to read data from the memory device And respond to the request with a substitute data stored in the security device. The method according to claim 31, wherein when it is recognized that the bus master device requests to access a predefined address area in the memory device, the data processing is interrupted and the replacement data is responded. The method according to claim 29, further comprising identifying the bus master attempting to access the given peripheral device based on the data returned from the given peripheral device to the bus master device in the data processing The data is disposed of. The method of claim 29, further comprising identifying, based on the instruction code used in the data processing, that the bus master device attempts to access the data processing of the given peripheral device.

Images