# US 2008/0189560 A1 · Secure data access methods and apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2008/0189560 A1 - Document ID: US20080189560A1 - Status: Published application - Kind: A1 - Application number: 11/671,271 - Filed: 2007-02-05 - Published: 2008-08-07 - Earliest claimed: 2007-02-05 - Assignees: Freescale Semiconductor, Inc. - Inventors: Lawrence L. Case; Thomas Tkacik - Web page: https://patentgrep.com/patent/US20080189560A1 ## CPC - G06F 12/1458: {by checking the subject access rights} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments include systems and methods for securely accessing data in the context of a data transaction. A system may include a memory block, within which a memory partition may be allocated to the data transaction. The memory partition includes a data storage block and at least one binding register. The system also includes platform entities and an access control block, which determines whether a particular platform entity may access data within the data storage block, and whether a particular platform entity may write binding information into a binding register. Access also may be granted or denied based on the current state of a state machine associated with the data transaction. The system also includes a cipher/binding function adapted to encrypt the data, using the binding information, for storage on an unsecured memory device, and to decrypting encrypted data, using the binding information, which is retrieved from the unsecured memory device. ## Claims ### Claim 1 A method for securely accessing data in the context of a data transaction, the method being performed in a system that includes multiple platform entities, and comprising the steps of: writing data, by a first platform entity, into a data block of a memory partition allocated to the data transaction; and encrypting the data using binding information to produce encrypted data, wherein the binding information is provided by a set of the multiple platform entities that are permitted to participate in the data transaction. ### Claim 2 (depends on 1) The method of claim 1, further comprising the steps of: a second platform entity attempting to write a portion of the binding information into at least one binding register associated with the memory partition, wherein the first platform entity and the second platform entity may be a same platform entity or different platform entities; and permitting the second platform entity to write the portion of the binding information when the second platform entity is assigned to a memory function role that allows writing to the at least one binding register, wherein a platform entity may be assigned to one or more of a plurality of memory function roles. ### Claim 3 (depends on 1) The method of claim 1, further comprising the steps of: determining whether a second platform entity is a Resource Manager; and when the second platform entity is the Resource Manager, permitting the second platform entity to write a first binding value into a memory controller binding register, wherein the first binding value forms a portion of the binding information, and wherein the first platform entity and the second platform entity may be a same platform entity or different platform entities. ### Claim 4 (depends on 3) The method of claim 3, further comprising the step of: writing a Bus ID of the second platform entity into a Bus ID capture binding register associated with the memory partition, wherein the Bus ID forms a portion of the binding information. ### Claim 5 (depends on 1) The method of claim 1, further comprising the steps of: determining whether a second platform entity is a Memory Owner; and when the second platform entity is the Memory Owner, permitting the second platform entity to write a second binding value into a memory owner binding register, wherein the second binding value forms a portion of the binding information, and wherein the first platform entity and the second platform entity may be a same platform entity or different platform entities. ### Claim 6 (depends on 1) The method of claim 1, further comprising the steps of: determining whether a second platform entity is a Memory Owner; and when the second platform entity is the Memory Owner, permitting the second platform entity to write access permissions information into an access permissions binding register, wherein the access permissions information forms a portion of the binding information, and wherein the first platform entity and the second platform entity may be a same platform entity or different platform entities. ### Claim 7 (depends on 6) The method of claim 6, further comprising: determining whether the first platform entity is identified in the access permissions information as having permission to write the data; and when the first platform entity is identified in the access permissions information as having permission to write the data, permitting the first platform entity to write the data. ### Claim 8 (depends on 1) The method of claim 1, further comprising the steps of: initiating a state machine for the data transaction, wherein the state machine includes a user state; and permitting the first platform entity to write the data when the state machine is in the user state. ### Claim 9 (depends on 8) The method of claim 8, wherein the state machine further includes a control state, and the method further comprises the step of: a second platform entity attempting to write Resource Manager-provided binding information into a Resource Manager binding register, wherein the first platform entity and the second platform entity may be a same platform entity or different platform entities; and permitting the second platform entity to write the Resource Manager-provided binding information when the state machine is in the control state. ### Claim 10 (depends on 8) The method of claim 8, wherein the state machine further includes an owner state, and the method further comprises the step of: a second platform entity attempting to write Memory Owner-provided binding information into a Memory Owner binding register, wherein the first platform entity and the second platform entity may be a same platform entity or different platform entities; and permitting the second platform entity to write the Memory Owner-provided binding information when the state machine is in the owner state. ### Claim 11 (depends on 1) The method of claim 1, wherein encrypting comprises: also encrypting the data using a device identifier. ### Claim 12 A method for securely accessing data in the context of a data transaction, the method being performed in a system that includes multiple platform entities, and comprising the steps of: allocating a memory partition to the data transaction; a first platform entity writing access permissions information into at least one binding register associated with the memory partition; permitting a second platform entity to access data stored in a data block of the memory partition when the second platform entity is identified in the access permissions information, wherein the first platform entity and the second platform entity may be a same platform entity or different platform entities ; and the second platform entity accessing the data. ### Claim 13 (depends on 12) The method of claim 12, further comprising the steps of: encrypting the data using the binding information to produce encrypted data; and storing the encrypted data to an unsecured memory device. ### Claim 14 (depends on 12) The method of claim 12, further comprising the steps of: retrieving encrypted data from an unsecured memory device; and decrypting the encrypted data using the binding information to produce the data. ### Claim 15 (depends on 12) The method of claim 12, further comprising the steps of: a third platform entity attempting to write Resource Manager-provided binding information into a particular register of the at least one binding register, wherein some or all of the first platform entity, the second platform entity, and the third platform entity may be same platform entities or different platform entities; and permitting the third platform entity to write the Resource Manager-provided binding information when the third platform entity is a Resource Manager. ### Claim 16 (depends on 12) The method of claim 12, further comprising the steps of: a third platform entity attempting to write Memory Owner-provided binding information into a particular register of the at least one binding register, wherein some or all of the first platform entity, the second platform entity, and the third platform entity may be same platform entities or different platform entities; and permitting the third platform entity to write the Memory Owner-provided binding information when the third platform entity is a Memory Owner. ### Claim 17 (depends on 12) The method of claim 12, further comprising the steps of: providing binding information in the at least one binding register, wherein the binding information is provided by a set of the multiple platform entities that are permitted to participate in the data transaction. ### Claim 18 A system for securely accessing data in the context of a data transaction, the system comprising: a memory block, within which a memory partition may be allocated to the data transaction, wherein the memory partition includes a data storage block and at least one binding register, and wherein the data block is adapted to store data, and wherein the at least one binding register is adapted to store binding information, wherein the binding information includes information provided by a set of platform entities that are permitted to participate in the data transaction; the set of platform entities, wherein each of the set of platform entities includes one or more hardware blocks adapted to perform one or more functions; an access control block, adapted to determine whether a particular platform entity is permitted to access the data and whether the particular platform entity is permitted to write a portion of the binding information; and a cipher/binding function adapted to encrypt the data, using the binding information, for storage on an unsecured memory device, and to decrypt encrypted data, using the binding information, which is retrieved from the unsecured memory device. ### Claim 19 (depends on 18) The system of claim 18, wherein the memory block, the set of platform entities, the access control block, and the cipher/binding function are included within a system-on-a-chip. ### Claim 20 (depends on 18) The system of claim 18, wherein the memory block, the set of platform entities, the access control block, and the cipher/binding function are included within a system-on-package. ### Claim 21 (depends on 18) The system of claim 18, wherein the apparatus is selected from a group of apparatus that includes a cellular telephone, a pager, a radio, a personal data assistant, a portable media player, a computer, a controller, a set top box, and a gaming system. ### Claim 22 A system for securely accessing data in the context of a data transaction, the system comprising: a memory block, within which a memory partition may be allocated to the data transaction, wherein the memory partition includes a data storage block and at least one binding register, and wherein the data block is adapted to store data, and wherein the at least one binding register is adapted to store access permissions information; the set of platform entities, wherein each of the set of platform entities includes one or more hardware blocks adapted to perform one or more functions; an access control block, adapted to determine whether a particular platform entity is permitted to access the data based at least in part on the access permissions information; and a cipher/binding function adapted to encrypt the data, using at least the access permissions information, for storage on an unsecured memory device, and to decrypt encrypted data, using at least the access permissions information, which is retrieved from the unsecured memory device.