# US 10,482,275 B2 · Implementing access control by system-on-chip > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,275 B2 - Document ID: US10482275B2 - Status: Granted - Kind: B2 - Application number: 15/111,972 - Filed: 2015-01-27 - Published: 2016-12-01 - Granted: 2019-11-19 - Earliest claimed: 2014-01-27 - Assignees: Cryptography Research, Inc. - Applicants: Cryptography Research, Inc. - Inventors: Craig E. Hampel; Jean-Michel Cioranesco; Rodrigo Portella do Canto; Guilherme Ozari de Almeida - Web page: https://patentgrep.com/patent/US10482275B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/44: Program or device authentication - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/755: {with measures against power attack} - G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/101: {Access control lists [ACL]} - H04L 63/123: {received data contents, e.g. message integrity} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for implementing access control by systems-on-chip (SoCs). An example SoC may comprise: an access control unit comprising a secure memory for storing access control data, the access control unit to: receive a message comprising an access control data item; store the access control data item in the secure memory; perform at least one of: authenticating the message using a message digest function, or validating contents of the secure memory by comparing a stored reference value with a calculated value of a message digest function of the contents of the secure memory; and control, in view of the access control data item, access by an initiator device to a target device. ## Claims ### Claim 1 A system-on-chip (SoC), comprising a hardware access control unit, the hardware access control unit comprising a secure memory for storing access control data, the hardware access control unit to: receive, from a programming agent, a message comprising an access control data item; store the access control data item in the secure memory; update a state variable reflecting a state of communications between the hardware access control unit and the programming agent, by applying a non-linear function to a current value of the state variable, a cryptographic key shared between the programming agent and the hardware access control unit, and a hash of contents of the secure memory; calculate a message digest by applying a first cryptographic hash function to contents of the message, a cryptographic key the state variable; authenticate the message using the message digest; repeatedly validate the access control data item for detecting unauthorized modification of the access control data item stored in the secure memory, wherein validating the access control data item comprises comparing a value of a second cryptographic hash function of the access control data item to a stored reference value; and control, in view of the access control data item, access by an initiator device to a target device. ### Claim 2 (depends on 1) The SoC of claim 1, wherein the access control data item comprises an access control rule. ### Claim 3 (depends on 2) The SoC of claim 2, wherein the access control rule comprises an identifier of the initiator device, an identifier of the target device, an address range, and an access permission. ### Claim 4 (depends on 1) The SoC of claim 1, wherein the hardware access control unit is implemented by a network-on-chip (NoC) comprising a filtering firewall to enforce access control in view of the access control data item while transporting at least one of data frames or electric signals between the initiator device and the target device. ### Claim 5 (depends on 1) The SoC of claim 1, wherein the hardware access control unit is implemented by a memory management unit (MMU) to enforce access control in view of the access control data item while translating a first address to a second address referencing a memory location on the target device. ### Claim 6 (depends on 1) The SoC of claim 1, wherein the initiator device is provided by one of: a central processing unit (CPU), a graphical processing unit (GPU), or a cryptographic core. ### Claim 7 (depends on 1) The SoC of claim 1, wherein the target device is provided by one of: a memory device, a storage device, or an input/output (I/O) device. ### Claim 8 (depends on 1) The SoC of claim 1, further comprising a cryptographic key management system to generate the cryptographic key. ### Claim 9 (depends on 1) The SoC of claim 1, wherein the access control data item comprises an address translation rule. ### Claim 10 A system-on-chip (SoC), comprising a hardware access control unit, the hardware access control unit comprising a first secure memory and a second secure memory for storing access control data, the hardware access control unit to: receive, from a programming agent, a first message comprising a first access control data item; store the first access control data item in the first secure memory; update a state variable reflecting a state of communications between the hardware access control unit and the programming agent, by applying a non-linear function to a current value of the state variable, a cryptographic key shared between the programming agent and the hardware access control unit, and a hash of contents of the first secure memory; calculate a first message digest by applying a first cryptographic hash function to contents of the first message, the cryptographic key the state variable; authenticate the first message using the first message digest; receive a second message comprising a second access control data item; store the second access control data item in the second secure memory; responsive to detecting a triggering event, validating the first access control data item for detecting unauthorized modification of the first access control data item stored in the first secure memory, wherein validating the first access control data item comprises comparing a value of a second cryptographic hash function of the first access control data item to a stored reference value; validate the second access control data item for detecting unauthorized modification of the second access control data item stored in the second secure memory; interpret the first access control data item as subordinate to the second access control data item; and control, in view of the second access control data item, access by an initiator device to a target device. ### Claim 11 A method, comprising: receiving, by a hardware access control unit, from a programming agent, a message comprising an access control data item; storing the access control data item in a secure memory; updating a state variable reflecting a state of communications between the hardware access control unit and the programming agent, by applying a non-linear function to a current value of the state variable, a cryptographic key shared between the programming agent and the hardware access control unit, and a hash of contents of a secure memory; calculating a message digest by applying a first cryptographic hash function to contents of the message, the cryptographic key and the state variable; authenticating the message using the message digest; repeatedly, responsive to detecting a triggering event, validating the access control data item for detecting unauthorized modification of the access control data item stored in the secure memory, wherein validating the access control data item comprises comparing a value of a second cryptographic hash function of the access control data item to a stored reference value; and controlling, in view of the access control data item, access by an initiator device to a target device. ### Claim 12 (depends on 11) The method of claim 11, wherein the access control data item comprises an access control rule. ### Claim 13 (depends on 12) The method of claim 12, wherein the access control rule comprises at least one of: an identifier of the initiator device, an identifier of the target device, an address range, an access permission, or an access authorization type. ### Claim 14 (depends on 11) The method of claim 11, wherein the controlling further comprises filtering data frames traversing the hardware access control unit based on an access control rule set comprising a plurality of access control rules defined on non-overlapping address ranges. ### Claim 15 (depends on 11) The method of claim 11, the controlling further comprises filtering data frames traversing the hardware access control unit based on an access control rule set comprising a plurality of access control rules defined on a plurality of overlapping address ranges. ### Claim 16 (depends on 15) The method of claim 15, wherein a first access control rule defined on a first address range of the plurality of overlapping address ranges is interpreted as overriding a second access control rule defined on a second address range of the plurality of overlapping address ranges. ### Claim 17 (depends on 11) The method of claim 11, wherein the controlling further comprises translating a virtual address to a physical address, the physical address referencing a memory location on the target device. ### Claim 18 (depends on 11) The method of claim 11, wherein receiving the message comprising the access control data item is performed within a boot sequence of the SoC. ### Claim 19 (depends on 11) The method of claim 11, wherein the access control data item comprises an address translation rule.