Secure debug access of a system-on-chip device

A system-on-chip device, comprising:

• a memory configured to store:
• a user identification for each user of a plurality of users;
• a cohort definition that identifies for each user of the plurality of users a subset of a set of resources of the system-on-chip that a corresponding user is authorized to access;
• a system-on-chip unique identifier;
• and
• a key catalog that includes authorization keys associated with each subset of resources of the system-on-chip for each user of the plurality of users;
• a controller;
• a debug port configured to communicate, via a wired connection or a wireless connection, with a debugger computing device;
• a bus interconnect coupled to the memory, the controller, and the debug port;
• and
• a security controller coupled to the bus interconnect, wherein the security controller is configured to:
• receive, via the debug port, an authorization key corresponding to a request to access a set of resources of the system-on-chip device;
• determine, using the key catalog stored in the memory, that the authorization key corresponds to at least one of the authorization keys of the key catalog;
• and
• modify a configuration of the system-on-chip to allow access to resources that are in the set of requested resources and to block access to resources of the system-on-chip that are not in the set of requested resources based on the determination.

A method, comprising:

• receiving, by a security controller of a system-on-chip and from a controller of the system-on-chip, an indication that a debugger computing device is connected to a debug port of the system-on-chip;
• receiving, via the debug port, a user debug authorization key from the debugger computing device;
• determining, using the user debug authorization key, that the debugger computing device is associated with a first user of a plurality of users;
• receiving, via the debug port, a user debug profile, wherein the user debug authorization key and the user debug profile are verified as authentic by the security controller of the system-on-chip;
• determining, using the user debug profile, a set of requested resources of the system-on-chip;
• determining, using a cohort definition, that the set of requested resources includes resources associated with the first user of the plurality of users in the cohort definitions;
• and
• modifying a configuration of the system-on-chip to allow the debugger computing device to access resources of the set of requested resources that are in the set of requested resources and to disallow the debugger computing device access to resources of the system-on-chip device that are not in the set of requested resources based on the determination that the set of requested resources includes resources associated with the first user of the plurality of users in the cohort definitions using the cohort definition.