# US 2026/0093586 A1 · Secure debug access of a system-on-chip device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0093586 A1 - Document ID: US20260093586A1 - Status: Published application - Kind: A1 - Application number: 18/954,865 - Filed: 2024-11-21 - Published: 2026-04-02 - Earliest claimed: 2024-09-30 - Assignees: NXP USA, Inc. - Applicants: NXP USA, Inc. - Inventors: Surender KUMAR; Pradip SINGH; Fabrice POULARD; Stefan DOLL - Web page: https://patentgrep.com/patent/US20260093586A1 ## CPC - G06F 11/263: Generation of test inputs, e.g. test vectors, patterns or sequences {; with adaptation of the tested hardware for testability with external testers} - H04L 63/102: {Entity profiles} - G06F 21/44: Program or device authentication - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method include receiving, by a security controller of a system-on-chip and from a controller of the system-on-chip, an indication that a debugger computing device is connected to a debug port of the system-on-chip. A user debug authorization key and a user debug profile are received and verified by the security controller. The user debug profile identifies a set of requested resources. A configuration of the system-on-chip is modified to allow the debugger computing device to access resources of the set of requested resources. ## Claims ### Claim 1 A system-on-chip device, comprising: a memory configured to store a cohort definition that identifies for each user of a plurality of users a subset of a set of resources of the system-on-chip that the user is authorized to access; a controller; a debug port configured to communicate, via a wired connection or a wireless connection, with a debugger computing device; a bus interconnect coupled to and configured to communicate data to the memory, the controller and the debug port; and a security controller coupled to the bus interconnect, wherein the security controller is configured to: receive, from the controller, an indication that the debugger computing device is connected to the debug port, receive, from the debug port, a user debug authorization key from the debugger computing device, determine, using the user debug authorization key, that the debugger computing device is associated with a first user of the plurality of users, receive, from the debug port, a user debug profile, wherein the security controller is configured to verify an authenticity of the user debug authorization key and the user debug profile by cryptographic operation, determine, using the user debug profile, a set of resources requested by the user, determine, using the cohort definition, that the set of requested resources includes resources associated with the user in the cohort definitions, and modify a configuration of the system-on-chip to allow the debugger computing device to access resources of the system-on-chip that are in the set of requested resources and to disallow the debugger computing device access to resources of the system-on-chip that are not in the set of requested resources based on the determination that the set of requested resources includes resources associated with the user in the cohort definitions using the cohort definition. ### Claim 2 (depends on 1) The system-on-chip device of claim 1, wherein the set of resources include processor cores configured to implement one or more of a vehicle infotainment function, vehicle safety function, and vehicle engine management function. ### Claim 3 (depends on 1) The system-on-chip device of claim 1, wherein the indication that the debugger computing device has been connected to the debug port includes receiving, by the controller and from the debug port, an interrupt signal. ### Claim 4 (depends on 1) The system-on-chip device of claim 1, wherein the cohort definition is stored in a non-volatile memory of the system-on-chip. ### Claim 5 (depends on 1) The system-on-chip device of claim 1, wherein the user debug authorization key comprises an AES-256 bit key. ### Claim 6 (depends on 1) The system-on-chip device of claim 1, wherein the security controller is configured to determine, using the user debug authorization key, that the debugger computing device is associated with the first user of the plurality users by validating the user debug authorization key using a stored user debug authorization key. ### Claim 7 (depends on 1) The system-on-chip device of claim 1, wherein the cohort definition identifies, for each user of the plurality of users, a start-up image configured to determine a start-up initialization configuration of the system-on-chip device. ### Claim 8 A system-on-chip device, comprising: a memory configured to store: a user identification for each user of a plurality of users; a cohort definition that identifies for each user of the plurality of users a subset of a set of resources of the system-on-chip that a corresponding user is authorized to access; a system-on-chip unique identifier; and a key catalog that includes authorization keys associated with each subset of resources of the system-on-chip for each user of the plurality of users; a controller; a debug port configured to communicate, via a wired connection or a wireless connection, with a debugger computing device; a bus interconnect coupled to the memory, the controller, and the debug port; and a security controller coupled to the bus interconnect, wherein the security controller is configured to: receive, via the debug port, an authorization key corresponding to a request to access a set of resources of the system-on-chip device; determine, using the key catalog stored in the memory, that the authorization key corresponds to at least one of the authorization keys of the key catalog; and modify a configuration of the system-on-chip to allow access to resources that are in the set of requested resources and to block access to resources of the system-on-chip that are not in the set of requested resources based on the determination. ### Claim 9 (depends on 8) The system-on-chip of claim 8, wherein the set of resources include processor cores configured to implement vehicle infotainment functions, vehicle safety functions, and vehicle engine management. ### Claim 10 (depends on 8) The system-on-chip of claim 8, wherein the user identification is stored in a non-volatile memory of the system-on-chip. ### Claim 11 (depends on 8) The system-on-chip of claim 8, wherein the cohort definition is stored in a non-volatile memory of the system-on-chip. ### Claim 12 (depends on 8) The system-on-chip of claim 8, wherein the authorization keys comprise AES-256 bit keys. ### Claim 13 (depends on 8) The system-on-chip of claim 8, wherein the controller is configured to determine a start-up image that defines an initial configuration of each of the resources of the system-on-chip. ### Claim 14 (depends on 8) The system-on-chip of claim 8, wherein the security controller is further configured to: receive, via the debug port, a unique identifier; and based on a comparison of the unique identifier and the system-on-chip unique identifier, modify the configuration of the system-on-chip to enable access to the set of requested resources. ### Claim 15 A method, comprising: receiving, by a security controller of a system-on-chip and from a controller of the system-on-chip, an indication that a debugger computing device is connected to a debug port of the system-on-chip; receiving, via the debug port, a user debug authorization key from the debugger computing device; determining, using the user debug authorization key, that the debugger computing device is associated with a first user of a plurality of users; receiving, via the debug port, a user debug profile, wherein the user debug authorization key and the user debug profile are verified as authentic by the security controller of the system-on-chip; determining, using the user debug profile, a set of requested resources of the system-on-chip; determining, using a cohort definition, that the set of requested resources includes resources associated with the first user of the plurality of users in the cohort definitions; and modifying a configuration of the system-on-chip to allow the debugger computing device to access resources of the set of requested resources that are in the set of requested resources and to disallow the debugger computing device access to resources of the system-on-chip device that are not in the set of requested resources based on the determination that the set of requested resources includes resources associated with the first user of the plurality of users in the cohort definitions using the cohort definition. ### Claim 16 (depends on 15) The method of claim 15, further comprising: receiving, by the security controller from the debug port, a unique identifier; determining that the unique identifier matches a system-on-chip unique identifier; and enabling the debugger computing device to access the requested resources. ### Claim 17 (depends on 15) The method of claim 15, further comprising determining that the debugger computing device is connected to the debug port by detecting an interrupt signal from the controller. ### Claim 18 (depends on 15) The method of claim 15, further comprising: storing, in a memory of the system-on-chip, a stored user debug authorization key; storing, in the memory of the system-on-chip, a stored user debug profile; and comparing, by the security controller, the user debug authorization key to the stored user debug authorization key and the user debug profile to the stored user debug profile to determine whether to enable the debugger computing device access to the set of requested resources. ### Claim 19 (depends on 15) The method of claim 15, further comprising: determining a start-up image that defines a start-up configuration of the system-on-chip; and configuring the security controller and a memory of the system-on-chip device according to the start-up image. ### Claim 20 (depends on 15) The method of claim 15, further comprising: receiving, from the debug port, a debug authentication key; determining, based on a comparison of the debug authentication key to the user debug authorization key, that the debugger computing device is authorized to request access to the system-on-chip; and modifying the configuration of the system-on-chip to allow the debugger computing device access to the requested resources of the system-on-chip based on the determination that the debugger computing device is authorized to request access to the system-on-chip.