US 2018/0004979 A1Published application

Migration of Trusted Security Attributes to a Security Engine Co-Processor

AssigneeIntel Corporation

InventorsJose S. Niell, Gautham N. Chinya, Khee Wooi Lee, William A. Stevens, JR., Josh Triplett

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system-on-chip (SoC) includes a host CPU on a CPU fabric, the host CPU including multiple processor cores, each associated with multiple security attributes. The SoC includes a secure asset on a network-on-chip and a security co-processor. The security co-processor includes circuitry to detect requests from the processor cores targeting the secure asset and security function processing requests, to determine, based on associated security attributes, whether the core or function is authorized to access the secure asset, to allow the request to be issued, if the core or function is so authorized, and to prevent its issuance, if not. The determination may be dependent on a signal from the CPU fabric indicating whether the host CPU can modify its security attributes or they are locked down. The security co-processor may have the highest security level and may be the only master on the SoC that can access the secure asset.

Claims20

Dependent claims

A system, comprising:

a host CPU comprising a processor core, the processor core including circuitry to execute instructions;
a CPU fabric communicatively coupled to the processor core, the CPU fabric including a first storage location to store a first security identifier value associated with the processor core;
a secure asset;
an on-chip network, communicatively coupled to the secure asset, through which requests that target the secure asset are to be directed to the secure asset;
and
a security engine outside of the CPU fabric and distinct from the processor core, including:
a processor to execute instructions;
and
circuitry to:
detect a request from the processor core for performance, by the security engine, of a security function that targets the secure asset;
determine, dependent on the first security identifier value associated with the processor core, whether or not access to the secure asset by the security function is authorized;
allow, responsive to a determination that access to the secure asset by the security function is authorized, the request to be issued over the on-chip network;
and
prevent, responsive to a determination that access to the secure asset by the security function is not authorized, issuance of the request over the on-chip network.

11 more elements

A method, comprising, in a system-on-chip (SoC):

initializing, by program instructions executing on a host CPU on a CPU fabric of the SoC, a security mechanism on the CPU fabric, the initializing including:
storing respective values of one or more security attributes associated with a processor core of the host CPU;
extending the security mechanism from the CPU fabric to a security co-processor on the SoC that is outside the CPU fabric and is distinct from the host CPU;
detecting, by the security co-processor, a request from the processor core of the host CPU for performance, by the security co-processor, of a security function targeting a secure asset on an on-chip network of the SoC;
and
determining, by program instructions executing on the security co-processor, whether or not access to the secure asset by the security function is authorized, the determining being dependent on the respective values of the one or more security attributes associated with the processor core of the host CPU.

3 more elements

Dependencies are inferred from the claim text.