Method for enforcing resource access control in computer systems

A system on a chip (SoC), comprising:

• a first fabric comprising a memory fabric, including a memory interface to which memory may be operatively coupled;
• one or more processing cores operatively coupled to the memory fabric;
• a second fabric comprising an Input/Output (IO) fabric, operatively coupled to the memory fabric via an interface, the IO fabric including interfaces to a plurality of IO devices;
• and
• a secure access mechanism under which resource access requests associated with transactions initiated by an initiator device to access a target resource in the SoC include a set of immutable security attributes defining access privileges associated with the initiator device that are evaluated against an access policy defined for the target resource to determine whether the transaction is permitted,
• wherein the initiator devices include devices that can initiate transactions via the SoC including internal devices in the SoC and IO devices operatively coupled to an interface of the SoC, wherein target resources include memory and register resources included in the SoC, memory coupled to the memory fabric and IO fabric and memory and register resources accessible via the IO devices, and wherein all security attributes in each set of immutable security attributes are immutable.

A computer system comprising:

• a system on a chip (SoC), including,
• a first fabric comprising a memory fabric, including a memory interface and a core interface and employing a first protocol;
• one or more processing cores operatively coupled to the memory fabric via the core interface;
• a second fabric comprising an Input/Output (IO) fabric, operatively coupled to the memory fabric via an interface;
• and
• memory, operative coupled to the memory fabric via the memory interface;
• and
• a plurality of IO devices, operatively coupled to the IO Fabric,
• wherein the SoC further includes a secure access mechanism under which resource access requests associated with transactions initiated by an initiator device to access a target resource in the SoC include a set of immutable security attributes defining access privileges associated with the initiator device that are evaluated against an access policy defined for the target resource to determine whether the transaction is permitted,
• wherein the initiator devices comprise devices that can initiate transactions via the SoC including devices in the SoC and IO devices interfaced to the IO fabric, wherein target resources include memory and register resources included in the SoC, memory coupled to the memory fabric and IO fabric and memory and register resources accessible via the IO devices, and wherein all security attributes in each set of immutable security attributes are immutable.