MANAGING PRIVILEGES OF DIFFERENT ENTITIES FOR AN INTEGRATED CIRCUIT

• US 20170249099A1
• Filed: 08/31/2015
• Published: 08/31/2017
• Est. Priority Date: 09/17/2014
• Status: Active Grant

• Current Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Original Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Inventors: JUN, Benjamin Che-Ming, RAWLINGS, William Craig, KUMAR, Ambuj, MARSON, Mark Evan
• Granted Patent: US 10,860,229 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0688 Non-volatile semiconductor memory arrays
• CPC Class Codes: G11C 17/16 using electrically-fusible links
• CPC Class Codes: G11C 17/18 Auxiliary circuits, e.g. for writing into memory

Abstract

A request associated with one or more privileges assigned to a first entity may be received. Each of the one or more privileges may correspond to an operation of an integrated circuit. Information corresponding to the first entity and stored in a memory that is associated with the integrated circuit may be identified. Furthermore, the memory may be programmed to modify the information stored in the memory that is associated with the integrated circuit in response to the request associated with the one or more privileges assigned to the first entity.

Claims

1. A method comprising:

receiving a request associated with one or more privileges assigned to a first entity, each of the one or more privileges corresponding to an operation of an integrated circuit;

identifying information corresponding to the first entity, the information being stored in a memory that is associated with the integrated circuit; and

programming, by a processing device, the memory to modify the information being stored in the memory that is associated with the integrated circuit in response to the request associated with the one or more privileges assigned to the first entity.

2. The method of claim 1, wherein the first entity is a root entity, and wherein the request associated with the one or more privileges comprises a revocation of the one or more privileges assigned to the first entity that is the root entity, and wherein the programming of the memory to modify the information comprises programming at least one bit of the memory corresponding to the first entity that is the root entity from a first value to a second value to revoke the one or more privileges.

3. The method of claim 1, wherein the first entity is a delegate entity that has been assigned the one or more privileges by a root entity or the first entity is the root entity, and wherein the request associated with the one or more privileges comprises a revocation of the one or more privileges assigned to the first entity.

4. The method of claim 1, further comprising:

receiving a second request associated with one or more privileges to be assigned to a second entity, each of the one or more privileges to be assigned to the second entity corresponding to an operation of the integrated circuit;

identifying information corresponding to the second entity, the information being stored in the same memory that is associated with the integrated circuit and stores the information corresponding to the first entity; and

programming the memory to modify the information corresponding to the second entity in response to the second request.

5. The method of claim 1, further comprising:

receiving a request from a second entity to access a particular operation of the integrated circuit; and

allowing access to the particular operation of the integrated circuit to the second entity when information corresponding to the second entity and stored in the memory and when information corresponding to the first entity and stored in the same memory identify that the second entity has been assigned a privilege to access the requested particular operation of the integrated circuit.

6. The method of claim 1, wherein the memory is a one-time programmable (OTP) memory.

7. The method of claim 1, further comprising:

receiving a request from the first entity to access a particular operation of the integrated circuit;

identifying information being stored in the memory that corresponds to a permission associated with the particular operation of the integrated circuit from each of a plurality of other entities; and

allowing access for the first entity to the particular operation of the integrated circuit when the information being stored in the memory that corresponds to a permission from each of the plurality of other entities indicates that the particular operation of the integrated circuit is permitted to be performed by the first entity.

8. The method of claim 7, wherein the particular operation of the integrated circuit is a debug operation.

9. A system comprising:

a plurality of components in an integrated circuit device to perform a plurality of operations;

a one-time programmable (OTP) memory to store information associated with a plurality of privileges for a plurality of entities to have the components perform the plurality of operations; and

a security manager in the integrated circuit device, comprising a processor and operatively coupled with the OTP memory, to;

receive a request associated with one or more of the privileges of the plurality of privileges that is assigned to a first entity, each of the one or more privileges corresponding to one operation performed by the components;

identify information corresponding to the first entity and stored in the OTP memory; and

program the OTP memory to modify the information being stored in the OTP memory based on the request associated with the one or more privileges.

10. The system of claim 9, wherein the first entity is a root entity, and wherein the request comprises a revocation of the one or more privileges assigned to the first entity that is the root entity, and wherein the programming of the OTP memory to modify the information comprises programming at least one bit of the OTP memory corresponding to the first entity that is the root entity from a first value to a second value to revoke the one or more privileges.

11. The system of claim 9, wherein the first entity is a delegate entity that has been assigned the one or more privileges by a root entity or the first entity is the root entity, and wherein the request associated with the one or more privileges comprises a revocation of the one or more privileges assigned to the first entity.

12. The system of claim 9, wherein the security manager is further to:

receive a second request associated with one or more privileges to be assigned to a second entity, each of the one or more privileges to be assigned to the second entity corresponding to one of the operations performed by at least one of the components;

identify information corresponding to the second entity, the information being stored in the same OTP memory that stores the information corresponding to the first entity; and

program the OTP memory to modify the information corresponding to the second entity in response to the second request.

13. The system of claim 9, wherein the security manager is further to:

receive a request from a second entity to have one or more of the components perform one or more of the operations; and

allow the one or more components to perform the one or more operations when information corresponding to the second entity and stored in the OTP memory and when information corresponding to the first entity and stored in the same OTP memory identify that the second entity has been assigned a privilege to have the one or more components perform the one or more operations.

14. The system of claim 9, wherein the security manager is further to:

receive a request from the first entity to have the one or more components perform a particular operation;

identify information being stored in the OTP memory that corresponds to a permission associated with the particular operation from each of a plurality of other entities; and

allow the one or more components to perform the particular operation when the information being stored in the OTP memory that corresponds to the permission from each of the plurality of other entities indicates that the particular operation is permitted to be performed by the one or more components in response to the request by the first entity.

15. The system of claim 14, wherein the particular operation of the integrated circuit is a debug operation.

16. The system of claim 9, wherein the programming of the OTP memory to modify the information being stored in the OTP memory based on the request associated with the one or more privileges comprises programming a bit of the OTP memory corresponding to the one or more privileges from a first value to a second value by using a fuse or an antifuse associated with the bit of the OTP memory.

17. A non-transitory computer readable medium including data that, when accessed by a processing device, cause the processing device to perform operations comprising:

receiving a request associated with one or more privileges assigned to a first entity, each of the one or more privileges corresponding to an operation of an integrated circuit;

identifying information corresponding to the first entity, the information being stored in a memory that is associated with the integrated circuit; and

programming the memory to modify the information being stored in the memory that is associated with the integrated circuit in response to the request associated with the one or more privileges assigned to the first entity.

18. The non-transitory computer readable medium of claim 17, wherein the first entity is a root entity, and wherein the request associated with the one or more privileges comprises a revocation of the one or more privileges assigned to the first entity that is the root entity, and wherein the programming of the memory to modify the information comprises programming at least one bit of the memory corresponding to the first entity that is the root entity from a first value to a second value to revoke the one or more privileges.

19. The non-transitory computer readable medium of claim of claim 17, wherein the first entity is a delegate entity that has been assigned the one or more privileges by a root entity or the first entity is the root entity, and wherein the request associated with the one or more privileges comprises a revocation of the one or more privileges assigned to the first entity.

20. The non-transitory computer readable medium of claim 17, the operations further comprising:

receiving a second request associated with one or more privileges to be assigned to a second entity, each of the one or more privileges to be assigned to the second entity corresponding to an operation of the integrated circuit;

identifying information corresponding to the second entity, the information being stored in the same memory that is associated with the integrated circuit and stores the information corresponding to the first entity; and

programming the memory to modify the information corresponding to the second entity in response to the second request.