Access enablement security circuit

A system-on-chip, comprising:

• a plurality of hardware modules implemented on a silicon substrate, the plurality of hardware modules configured for communication over one or more buses;
• a plurality of security features provided by the plurality of hardware modules;
• a one-time programmable memory configured to define a progression of a plurality of security states for the system-on-chip;
• a first memory configured to define a default access control setting for each security feature in each security state;
• and
• a second memory configured to define an ability of register data to affect access to each security feature;
• a centralized access enablement (AEB) circuit configured to control access to the plurality of security features, the centralized AEB circuit including a plurality of outputs, each output corresponding to a security feature of the hardware modules and configured to control access to the security feature, the AEB circuit configured to provide each output based on an output of the first memory for an active security state;
• and
• a set of registers configured to store the register data, the set of registers including for each output a disable register, an enable register, and a write lock enable register;
• the AEB circuit configured to access the set of data registers for a corresponding output to determine an access control setting for a security feature based at least in part on the second memory indicating that access to the security feature may be modified by register data;
• the AEB circuit configured to determine the default access control setting for a security feature from the first memory and generate an output signal using the default access control setting based at least in part on the second memory indicating that access to the security feature may not be modified by register data.

A system-on-chip, comprising:

• a plurality of hardware modules implemented on a silicon substrate, the plurality of hardware modules configured for communication over one or more buses;
• a plurality of security features provided by the plurality of hardware modules;
• a one-time programmable memory storing information to indicate a progression of a plurality of security states for the system-on-chip;
• a first read only memory (ROM) including a default access control setting for each security feature in each security state;
• a set of registers configured to store register data corresponding to the plurality of security features, the set of registers include for each output a disable register, an enable register, and a write lock enable register;
• a second read only memory (ROM) storing information to indicate an ability of the register data to affect access to each security feature;
• and
• a centralized access enablement (AEB) circuit configured to control access to the plurality of security features, the centralized AEB circuit including a plurality of outputs, each output corresponding to a security feature of the hardware modules and controlling access to the security feature, the centralized AEB circuit is configured to provide each output based on an output of the first ROM for an active security state;
• wherein based at least in part on the second ROM storing information to indicate that access to a security feature may be modified by register data, the AEB circuit is configured to access the set of data registers for the corresponding output to determine an access control setting for the security feature;
• and
• wherein based at least in part on the second ROM storing information to indicate that access to a security feature may not be modified by register data, the AEB circuit is configured to determine the default access control setting for the security feature from the first ROM and generate an output signal based on the default access control setting.

A method, comprising:

• providing by a plurality of hardware modules of a system-on-chip a plurality of security features, the plurality of hardware modules configured for communication over one or more buses;
• providing by a one-time programming memory an indication of a progression of a plurality of security states for the system-on-chip;
• storing in a first memory a default access control setting for each security feature in each security state;
• storing in a set of registers register data corresponding to the plurality of security features;
• providing from a second memory an override signal for each security feature indicating whether the register data is to override the default access control setting;
• and
• providing by a centralized access enablement (AEB) circuit a plurality of outputs for controlling access to the plurality of security features, wherein the AEB circuit provides the output corresponding to a security feature based on an output of the set of registers for an active security state based at least in part on the override signal being asserted for the corresponding security feature.

A method, comprising:

• providing by a plurality of hardware modules of a system-on-chip a plurality of security features, the plurality of hardware modules are configured for communication over one or more buses;
• providing by a one-time programmable memory an indication of a progression of a plurality of security states for the system-on-chip;
• providing by a centralized access enablement (AEB) circuit a plurality of outputs corresponding to the plurality of security features;
• storing in a first memory a default access control setting for each security feature in each security state;
• storing register data in a set of registers, the set of registers including for each output of the AEB circuit a disable register, an enable register, and a write lock enable register;
• storing in a second memory an indication of an ability of the register data to affect access to each security feature;
• accessing the set of data registers for a corresponding output of the AEB to determine an access control setting for a corresponding security feature based at least in part on the second memory indicating that access to the corresponding security feature may be affected by register data;
• and
• determining the default access control setting for a corresponding security feature from the first memory and generating an output signal based on the default access control setting based at least in part on the second memory indicating that access to the corresponding security feature may not be affected by register data.