Debugging port security interface
AssigneeResearch In Motion Limited
InventorsHerbert A. Little, Jerrold R. Randell, Richard C. Madter, Ryan J. Hickey
Life of this patent
Estimating the term…
Abstract
The present invention provides a secure JTAG interface to an application-specific integrated circuit (ASIC). In the preferred embodiment the invention operates through the combined efforts of a Security Module (SM) comprising a state machine that controls the security modes for the ASIC, and a Test Control Module (TCM) which contains the JTAG interface. The TCM operates in either a restricted mode or an unrestricted mode, depending on the state of the SM state machine. In a restricted mode, only limited access to memory content is permitted. In an unrestricted mode, full access to memory content is permitted.
Claims15
A device for allowing secure access to data stored on a memory component in a processing device comprising:
- a microprocessor;
- a control module connected to the microprocessor, the control module being configured to access at least one memory component;
- a test control module connected to the control module, the test control module comprising an access port interface;
- and
- a security module connected to the test control module, the security module having restricted and unrestricted security states, wherein in a restricted security state, access to debugging functions via the access port interface is limited whilst access to data stored on the at least one memory component via the access port interface is not permitted, and in first unrestricted security state, access to debugging functions is permitted whilst access to data stored on the at least one memory component via the access port interface is permitted, and in second unrestricted security state, access to debugging functions is permitted whilst access to data stored on the at least one memory component via the access port interface is not permitted;
- the state of the security module being alterable from the restricted security state to the first unrestricted security states if a request for access is supplied and a password supplied through the access port interface matches a predetermined password stored in a secure, non-volatile memory accessible by the security module,and the state of the security module being further alterable from the restricted security state to the second unrestricted security state if a request for access without a password is supplied through the access port interface.
A method for allowing secure access to a processing device comprising at least one memory component, the method comprising:
- whilst the processing device is in an insecure state,receiving a request for access via debugging port interface;
- if the request for access comprises a password,
- comparing the password to a predetermined password stored in a secure, non-volatile memory;
- if the received password matches the predetermined password, entering a first debug mode comprising access to debugging functions and permitting access to an encryption/decryption component to decrypt encryted data stored on the at least one memory component;
- and
- if the received password does not match the predetermined password, entering a second debug mode comprising access to debugging functions and not permitting access to encryption/decryption component to decrypt encrypted data stored on the at least one memory component.
A computer-readable medium comprising code executable by a computing device for causing the computing device to:
- whilst the processing device is in an insecure state, receive a request for access via a debugging port interface;
- if the request for access comprises a password,
- comparing the password to a predetermined password stored in a secure, non-volatile memory;
- if the received password matches the predetermined password, entering a first debug mode comprising access to debugging functions and permitting access to an encryption/decryption component to decrypt encrypted data stored on the at least one memory component;
- and
- if the received password does not match the predetermined password, entering a second debug mode comprising access to debugging functions and not permitting access to the encryption/decryption component decrypt encrypted data stored on the at least one memory component.
A computer-readable medium comprising code executable by a computing device for causing the computing device to:
- whilst the processing device is in an insecure state, receive a request for access via a debugging port interface;
- if the request for access comprises a password,
- comparing the password to a predetermined password stored in a secure, non-volatile memory;
- if the received password matches the predetermined password, entering a first debug mode comprising access to debugging functions and permitting access to an encryption/decryption component to decrypt encrypted data stored on the at least one memory component;
- and
- if the received password does not match the predetermined password,
- transitioning to an the insecure debug state, and
- entering a second debug mode comprising access to debugging functions and not permitting access to the encryption/decryption component decrypt encrypted data stored on the at least one memory component.
Dependencies are inferred from the claim text.