IMPLEMENTING ACCESS CONTROL BY SYSTEM-ON-CHIP

• US 20160028728A1
• Filed: 07/28/2015
• Published: 01/28/2016
• Est. Priority Date: 01/27/2014
• Status: Active Grant

• Current Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Original Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Inventors: Hampel, Craig E., Gori, Christopher, Cioranesco, Jean-Michel, do Canto, Rodrigo Portella, de Almeida, Guilherme Ozari
• Granted Patent: US 9,853,974 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods for implementing access control by systems-on-chip (SoCs). An example SoC may comprise an access control unit employed to: receive a message comprising an access control data item; validate the message using a value of a message digest function of contents of the message and a value of a state variable reflecting a state of communications between the access control unit and a programming agent that has initiated the message, wherein the value of the state variable is derived from a previous value of the message digest function calculated within a current communication session between the access control unit and the programming agent; update the state variable using the value of the message digest function of the contents of the message; and control, using the access control data item, access by an initiator device to a target device.

Claims

1. A system-on-chip (SoC), comprising:

an access control unit to;

receive a message comprising an access control data item;

validate the message using a value of a message digest function of contents of the message and a value of a state variable reflecting a state of communications between the access control unit and a programming agent that has initiated the message, wherein the value of the state variable is derived from a previous value of the message digest function calculated within a current communication session between the access control unit and the programming agent;

update the state variable using the value of the message digest function of the contents of the message; and

control, using the access control data item, access by an initiator device to a target device.

2. The SoC of claim 1, wherein the message digest function is provided by a cryptographic hash function.

3. The SoC of claim 1, wherein the access control data item comprises at least one of:

an access control rule or an address translation rule.

4. The SoC of claim 3, wherein the access control rule comprises at least one of:

an identifier of the initiator device, an identifier of the target device, an address range, an access permission, or an access authorization type.

5. The SoC of claim 1, wherein the access control unit is implemented by a network-on-chip (NoC) comprising a filtering firewall to enforce access control using the access control data item while transporting at least one of data frames or electric signals between the initiator device and the target device.

6. The SoC of claim 1, wherein the access control unit is implemented by a memory management unit (MMU) to enforce access control using the access control data item while translating a first address to a second address referencing a memory location on the target device.

7. A system-on-chip (SoC), comprising:

an access control unit to;

receive an access control programming message comprising an access control data item;

validate the access control programming message using value of a message digest function of contents of the access control programming message, wherein the message digest function is computed using a session key, and wherein validating the access control programming message comprises validating the session key using an intermediate output of the message digest function; and

control, using the access control data item, access by an initiator device to a target device.

8. The SoC of claim 7, wherein the message digest function is provided by a cryptographic hash function.

9. The SoC of claim 7, wherein the access control data item comprises at least one of:

an access control rule or an address translation rule.

10. The SoC of claim 7, wherein the access control programming message further comprises a target address for storing the access control data item.

11. The SoC of claim 7, wherein the access control unit is further to:

receive, prior to receiving the access control programming message, a session key and a session key signature; and

validate the session key by comparing the session key signature with a value of the message digest function of the session key, wherein the message digest function is computed using a hardcoded key.

12. The SoC of claim 7, wherein validating the access control programming message comprises validating the session key using an intermediate output of the message digest function.

13. The SoC of claim 7, wherein the access control unit is implemented by a network-on-chip (NoC) comprising a filtering firewall to enforce access control using the access control data item while transporting at least one of data frames or electric signals between the initiator device and the target device.

14. The SoC of claim 7, wherein the access control unit is implemented by a memory management unit (MMU) to enforce access control using the access control data item while translating a first address to a second address referencing a memory location on the target device.

15. A system-on-chip (SoC), comprising:

an access control unit comprising a key register for storing a key value and a secure memory for storing access control data, the access control unit to;

receive a session key and a session key signature;

validate the session key by comparing the session key signature with a value of a message digest function of the session key, wherein the message digest function is computed using the key value stored by the key register;

receive an access control programming message comprising an access control data item and an access control data item signature;

validate the access control programming message by comparing the access control data item signature with a value of the message digest function of contents of the access control programming message, wherein the message digest function is computed using the session key;

store the access control data item in the secure memory; and

control, using the access control data item, access by an initiator device to a target device.

16. The SoC of claim 15, wherein the message digest function is provided by a cryptographic hash function.

17. The SoC of claim 15, further comprising a reset unit to:

responsive to detecting a transition into a test mode, clear the key register.

18. The SoC of claim 15, further comprising a reset unit to:

responsive to detecting a transition into a functional mode, load an initial key value into the key register.

19. The SoC of claim 15, further comprising a reset unit to:

responsive to detecting a transition into a functional mode, disable scanning the key register.

20. The SoC of claim 15, further comprising a reset unit to:

responsive to detecting a transition into a functional mode, clear the secure memory storing the access control data.

21. A method, comprising:

receiving, by an access control unit of a system-on-chip (SoC), a message comprising an access control data item;

validating the message using a value of a message digest function of contents of the message and a value of a state variable reflecting a state of communications between the access control unit and a programming agent that has initiated the message, wherein the value of the state variable is derived from a previous value of the message digest function calculated within a current communication session between the access control unit and the programming agent;

updating the state variable using the value of the message digest function of the contents of the message; and

controlling, using the access control data item, access by an initiator device to a target device.

22. The method of claim 21, wherein the message digest function is provided by a cryptographic hash function.

23. The method of claim 21, wherein the access control data item comprises at least one of:

an access control rule or an address translation rule.

24. The method of claim 23, wherein the access control rule comprises at least one of:

an identifier of the initiator device, an identifier of the target device, an address range, an access permission, or an access authorization type.

25. A method, comprising:

receiving, by an access control unit of a system-on-chip (SoC), an access control programming message comprising an access control data item;

validating the access control programming message using a value of a message digest function of contents of the access control programming message, wherein the message digest function is computed using a session key, and wherein validating the access control programming message comprises validating the session key using an intermediate output of the message digest function; and

controlling, using the access control data item, access by an initiator device to a target device.

26. The method of claim 25, wherein the message digest function is provided by a cryptographic hash function.

27. The method of claim 25, wherein the access control data item comprises at least one of:

an access control rule or an address translation rule.

28. The method of claim 25, wherein the access control programming message further comprises a target address for storing the access control data item.

29. The method of claim 25, further comprising:

receiving, prior to receiving the access control programming message, a session key and a session key signature; and

validating the session key by comparing the session key signature with a value of the message digest function of the session key, wherein the message digest function is computed using a hardcoded key.

30. The method of claim 29, wherein validating the access control programming message comprises validating the session key using an intermediate output of the message digest function.

31. A method, comprising:

receiving, by an access control unit of a system-on-chip (SoC), a session key and a session key signature;

validating the session key by comparing the session key signature with a value of a message digest function of the session key, wherein the message digest function is computed using the key value stored by a key register;

receiving an access control programming message comprising an access control data item and an access control data item signature;

validating the access control programming message by comparing the access control data item signature with a value of the message digest function of contents of the access control programming message, wherein the message digest function is computed using the session key;

controlling, using the access control data item, access by an initiator device to a target device.

32. The method of claim 31, wherein the message digest function is provided by a cryptographic hash function.

33. The method of claim 31, further comprising:

responsive to detecting a transition into a test mode, clearing the key register.

34. The method of claim 31, further comprising:

responsive to detecting a transition into a functional mode, loading an initial key value into the key register.

35. The method of claim 31, further comprising:

responsive to detecting a transition into a functional mode, disabling scanning the key register.

36. The method of claim 31, further comprising a reset unit to:

responsive to detecting a transition into a functional mode, clearing a secure memory storing the access control data.