CONFIGURATOR FOR SECURE FEATURE AND KEY MANAGER

• US 20140359755A1
• Filed: 05/28/2014
• Published: 12/04/2014
• Est. Priority Date: 05/30/2013
• Status: Active Grant

• Current Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Original Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Inventors: Kocher, Paul Carl, Kumar, Ambuj, Leiserson, Andrew John, Beitel, Daniel, Gao, Lauren, Gori, Christopher
• Granted Patent: US 9,436,848 B2
• Time in Patent Office: Days
• US Class Current: 726/18
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]

Abstract

A computing device receives a feature name or key name for an integrated circuit comprising a security manager core and an additional component. At least one of a) the additional component is associated with the key name or b) a feature provided by the additional component is associated with the feature name. The computing device receives a specified number of bits associated with the feature name or the key name, and maps the feature name to a feature address space or the key name to a key interface of the security manager core based at on the specified number of bits. The computing device generates at least one hardware description logic (HDL) module based on the mapping, wherein the at least one HDL module is usable to configure the security manager core for delivery of payloads associated with the feature name or the key name to the additional component.

Claims

1. A method comprising:

receiving at least one of a feature name or a key name for an integrated circuit comprising a security manager core and an additional component, wherein at least one of a) the additional component is associated with the key name or b) a feature provided by the additional component is associated with the feature name;

receiving a specified number of bits associated with at least one of the feature name or the key name;

mapping, by a processing device, at least one of the feature name to a feature address space or the key name to a key interface of the security manager core based at least in part on the specified number of bits; and

generating at least one hardware description logic (HDL) module based on the mapping, wherein the at least one HDL module is usable to configure the security manager core for delivery of at least one of payloads associated with the feature name to the additional component or payloads associated with the key name to the additional component.

2. The method of claim 1, wherein mapping the feature name to the feature address space comprises:

identifying available feature bits from a plurality of feature bits in the feature address space; and

allocating, from the identified available feature bits, the specified number of bits to the feature name.

3. The method of claim 2, wherein generating the at least one HDL module comprises:

generating a first HDL module for an extractor that is to connect to a feature bus comprising the plurality of feature bits of the feature address space, wherein the extractor groups subsets of the plurality of feature bits that are associated with related features into sub-feature buses.

4. The method of claim 3, wherein generating the at least one HDL module further comprises:

generating a second HDL module for a sub-extractor that is to connect to the extractor and to the additional component of the integrated circuit, wherein the sub-extractor routes feature bits from a sub-feature bus comprising the allocated feature bits to input/outputs for features provided by the additional component.

5. The method of claim 2, wherein the allocated feature bits comprise wires that connect the security manager core to the additional component, the allocated feature bits being usable to enable and disable the feature on the additional component.

6. The method of claim 2, wherein the allocated feature bits comprise wires that carry data to be used internally to change the behavior of the security manager core.

7. The method of claim 1, wherein mapping the key name to the key interface comprises:

identifying a plurality of available key buses having the specified number of bits; and

allocating the key bus to the key name from the identified plurality of available key buses, wherein the allocated key bus is usable to deliver a key associated with the key name to an additional component of the integrated circuit that is also associated with the key name.

8. The method of claim 1, further comprising:

receiving the specified number of bits and at least one of the feature name or the key name via a graphical user interface.

9. The method of claim 1, further comprising:

generating a configuration file that comprises the feature name and the specified number of feature bits; and

using the generated configuration file to perform the mapping.

10. The method of claim 1, further comprising generating an updated version of the at least one HDL model, wherein generating the updated version comprises:

generating a configuration map that comprises a result of the mapping;

receiving a configuration file;

comparing the configuration map to the received configuration file;

responsive to determining that the configuration file lacks an existing feature included in the configuration map, generating said updated version of the at least one HDL module so that the existing feature is removed without affecting routing of additional features; and

responsive to determining that the configuration file includes a new feature name not included in the configuration map, generating said updated version of the at least one HDL module so that the new feature name is mapped to a previously unused feature address space without affecting the routing of additional features.

11. The method of claim 1, further comprising:

generating a configuration map that comprises a result of the mapping; and

outputting a firmware mapping file that comprises contents of the configuration map, wherein the firmware mapping file is usable by a device driver for the security manager core to deliver commands referencing the feature using the feature name and without specifying the allocated feature bits.

12. The method of claim 1, further comprising:

generating a configuration map that comprises a result of the mapping; and

outputting a compiler mapping file that comprises the configuration map, wherein the compiler mapping file further comprises definitions that enable programmers of the security manager core to write commands using the feature name without specifying the feature bits mapped to the feature name, and wherein the commands comprise commands for determining a value currently associated to the feature.

13. A computer readable medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

receiving at least one of a feature name or a key name for an integrated circuit comprising a security manager core and an additional component, wherein at least one of a) the additional component is associated with the key name or b) a feature provided by the additional component is associated with the feature name;

receiving a specified number of bits associated with at least one of the feature name or the key name;

mapping, by the processing device, at least one of the feature name to a feature address space or the key name to a key interface of the security manager core based at least in part on the specified number of bits; and

outputting a result of the mapping, wherein the result of the mapping is usable to configure the security manager core for delivery of at least one of payloads associated with the feature name to the additional component or payloads associated with the key name to the additional component.

14. The computer readable medium of claim 13, wherein mapping the feature name to the feature address space comprises:

identifying available feature bits from a plurality of feature bits in the feature address space; and

allocating, from the identified available feature bits, the specified number of bits to the feature name.

15. The computer readable medium of claim 14, wherein outputting the result of the mapping comprises:

generating a first HDL module for an extractor that is to connect to a feature bus comprising the plurality of feature bits of the feature address space, wherein the extractor groups subsets of the plurality of feature bits that are associated with related features into sub-feature buses.

16. The computer readable medium of claim 15, wherein outputting the result of the mapping further comprises:

generating a second HDL module for a sub-extractor that is to connect to the extractor and to the additional component of the integrated circuit, wherein the sub-extractor routes feature bits from a sub-feature bus comprising the allocated feature bits to input/outputs for features provided by the additional component.

17. The computer readable medium of claim 14, wherein the allocated feature bits comprise wires that connect the security manager core to the additional component, the allocated feature bits being usable to enable and disable the feature on the additional component.

18. The computer readable medium of claim 14, wherein the allocated feature bits comprise wires that carry data to be used internally to change the behavior of the security manager core.

19. The computer readable medium of claim 13, wherein mapping the key name to the key interface comprises:

identifying a plurality of available key buses having the specified number of bits; and

allocating the key bus to the key name from the identified plurality of available key buses, wherein the allocated key bus is usable to deliver a key associated with the key name to an additional component of the integrated circuit that is also associated with the key name.

20. A computing device comprising:

a memory; and

a processing device connected to the memory, the processing device to;

receive a feature name for an integrated circuit comprising a security manager core and an additional component that provides a feature associated with the feature name;

receive a specified number of bits associated with the feature name;

map the feature name to a feature address space of the security manager core based at least in part on the specified number of bits; and

generate at least one hardware description logic (HDL) module based on the mapping, wherein the at least one HDL module is usable to configure the security manager core for delivery of payloads associated the feature name to the feature.