# US 10,482,289 B2 · Computing device to provide access control to a hardware resource > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,289 B2 - Document ID: US10482289B2 - Status: Granted - Kind: B2 - Application number: 15/685,795 - Filed: 2017-08-24 - Published: 2019-02-28 - Granted: 2019-11-19 - Earliest claimed: 2017-08-24 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: David Barr; Dafna Shaool; Rahul Gulati; Pranjal Bhuyan - Web page: https://patentgrep.com/patent/US10482289B2 ## CPC - G06F 21/70: Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer - B60W 50/00: Details of control systems for road vehicle drive control not related to the control of a particular sub-unit {, e.g. process diagnostic or vehicle driver interfaces} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/44: Program or device authentication - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - B60W 2050/0005: {Processor details or data handling, e.g. memory registers or chip architecture} - B60W 2050/0006: {Digital architecture hierarchy} - F02N 11/0807: {Remote means} - G06F 9/5011: {the resources being hardware resources other than CPUs, Servers and Terminals} - G06F 2221/2129: Authenticate client device independently of the user - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT - F02N: STARTING OF COMBUSTION ENGINES; STARTING AIDS FOR SUCH ENGINES, NOT OTHERWISE PROVIDED FOR ## Abstract A computing device includes a hardware resource, a component to send a transaction signal including a target address of the hardware resource, a security data associated with an initiator of the transaction signal, and a safety data associated with the initiator, and an access control unit coupled to the component and the hardware resource, the access control unit to receive the transaction signal, determine whether security access is granted based on the transaction signal, determine whether safety access is granted based on the transaction signal, and allow access to the hardware resource based on both the security access and the safety access being granted. ## Claims ### Claim 1 A computing device comprising: a hardware resource; a safety configuration register; a component to send a transaction signal, the transaction signal including a target address of the hardware resource, a security data associated with an initiator of the transaction signal, a safety data associated with the initiator, and a safety master identifier, wherein the safety master identifier allows safety access to the safety configuration register but prevents safety access to the hardware resource when the safety master identifier is set to a first value, and does not prevent safety access to the hardware resource but prevents safety access to the safety configuration register when the safety master identifier is set to a second value; and an access control unit coupled to the component and the hardware resource, the access control unit to: receive the transaction signal; determine whether security access is granted based on the transaction signal; determine whether safety access is granted based on the transaction signal; and allow access to the hardware resource based on both the security access and the safety access being granted. ### Claim 2 (depends on 1) The computing device of claim 1, wherein the security data associated with the initiator includes one or more bits indicating a security level of the initiator. ### Claim 3 (depends on 2) The computing device of claim 2, wherein the security data associated with the initiator includes an access domain identifier. ### Claim 4 (depends on 1) The computing device of claim 1, wherein the safety data associated with the initiator includes a safety identifier. ### Claim 5 (depends on 4) The computing device of claim 4, wherein the safety identifier identifies one of a plurality of safety levels. ### Claim 6 (depends on 1) The computing device of claim 1, further comprising: a logic element included within the access control unit, the logic element to allow access to the hardware resource based on both the security access and the safety access being granted. ### Claim 7 (depends on 1) The computing device of claim 1, wherein the safety master identifier includes a bit indicating a safety master, the safety master allowed to only access the safety configuration register. ### Claim 8 (depends on 1) The computing device of claim 1, wherein the hardware resource is a memory. ### Claim 9 A computing device comprising: means for sending a transaction signal, the transaction signal including a target address of a hardware resource, a security data associated with an initiator of the transaction signal, a safety data associated with the initiator, and a safety master identifier, wherein the safety master identifier allows safety access to a safety configuration register but prevents safety access to the hardware resource when the safety master identifier is set to a first value, and does not prevent safety access to the hardware resource but prevents safety access to the safety configuration register when the safety master identifier is set to a second value; means for receiving the transaction signal; means for determining whether security access is granted based on the transaction signal; means for determining whether safety access is granted based on the transaction signal; and means for allowing access to the hardware resource based on both the security access and the safety access being granted. ### Claim 10 (depends on 9) The computing device of claim 9, wherein the security data associated with the initiator includes one or more bits indicating a security level of the initiator. ### Claim 11 (depends on 10) The computing device of claim 10, wherein the security data associated with the initiator includes an access domain identifier. ### Claim 12 (depends on 9) The computing device of claim 9, wherein the safety data associated with the initiator includes a safety identifier. ### Claim 13 (depends on 12) The computing device of claim 12, wherein the safety identifier identifies one of a plurality of safety levels. ### Claim 14 (depends on 9) The computing device of claim 9, wherein the safety master identifier includes a bit indicating a safety master, the safety master allowed to only access the safety configuration register. ### Claim 15 A method operational in a computing device comprising: sending, by a component, a transaction signal, the transaction signal including a target address of a hardware resource, a security data associated with an initiator of the transaction signal, a safety data associated with the initiator, and a safety master identifier, wherein the safety master identifier allows safety access to a safety configuration register but prevents safety access to the hardware resource when the safety master identifier is set to a first value, and does not prevent safety access to the hardware resource but prevents safety access to the safety configuration register when the safety master identifier is set to a second value; receiving, by an access control unit, the transaction signal; determining, by the access control unit, whether security access is granted based on the transaction signal; determining, by the access control unit, whether safety access is granted based on the transaction signal; and allowing, by the access control unit, access to the hardware resource based on both the security access and the safety access being granted. ### Claim 16 (depends on 15) The method of claim 15, wherein the security data associated with the initiator includes one or more bits indicating a security level of the initiator. ### Claim 17 (depends on 16) The method of claim 16, wherein the security data associated with the initiator includes an access domain identifier. ### Claim 18 (depends on 15) The method of claim 15, wherein the safety data associated with the initiator includes a safety identifier. ### Claim 19 (depends on 18) The method of claim 18, wherein the safety identifier identifies one of a plurality of safety levels. ### Claim 20 (depends on 15) The method of claim 15, wherein the safety master identifier includes a bit indicating a safety master, further comprising: allowing only to the safety master access to the safety configuration register. ### Claim 21 A non-transitory, computer-readable medium, having stored thereon computer-readable instructions for providing access control to a hardware resource, comprising instructions configured to cause a computing device to: send a transaction signal, the transaction signal including a target address of the hardware resource, a security data associated with an initiator of the transaction signal, a safety data associated with the initiator, and a safety master identifier, wherein the safety master identifier allows safety access to a safety configuration register but prevents safety access to the hardware resource when the safety master identifier is set to a first value, and does not prevent safety access to the hardware resource but prevents safety access to the safety configuration register when the safety master identifier is set to a second value; receive the transaction signal; determine whether security access is granted based on the transaction signal; determine whether safety access is granted based on the transaction signal; and allow access to the hardware resource based on both the security access and the safety access being granted. ### Claim 22 (depends on 21) The computer-readable medium of claim 21, wherein the security data associated with the initiator includes one or more bits indicating a security level of the initiator. ### Claim 23 (depends on 22) The computer-readable medium of claim 22, wherein the security data associated with the initiator includes an access domain identifier. ### Claim 24 (depends on 21) The computer-readable medium of claim 21, wherein the safety data associated with the initiator includes a safety identifier. ### Claim 25 (depends on 24) The computer-readable medium of claim 24, wherein the safety identifier identifies one of a plurality of safety levels.