Back to results
US 9,805,221 B2Granted
Incorporating access control functionality into a system on a chip (SoC)
AssigneeIntel Corporation
InventorsManoj R. Sastry, Ioannis T. Schoinas, Robert J. Toepfer, Alpa T. Narendra Trivedi, Men Long
Life of this patent
Estimating the term…
Abstract
In one embodiment, the present invention includes a system on a chip (SoC) that has a first agent with an intellectual property (IP) logic, an interface to a fabric including a target interface, a master interface and a sideband interface, and an access control plug-in unit to handle access control policy for the first agent with respect to incoming and outgoing transactions. This access control plug-in unit can be incorporated into the SoC at integration time and without any modification to the IP logic. Other embodiments are described and claimed.
Claims20
A method comprising:
- receiving a transaction initiated by an initiator agent of a system on a chip (SoC) to access a target agent of the SoC in a target interface of the target agent;
- providing security attributes of the transaction from the target interface to an access control logic associated with and included in the target agent as a plug-in module and incorporated into the target agent of the SoC without modification of an intellectual property (IP) block of the target agent, the access control logic located in the target agent between the target interface and a core of the target agent, the security attributes defining access privileges associated with the initiator agent that are evaluated against an access policy defined for the target agent, the initiator agent further comprising a second access control logic associated with and included in the initiator agent as a plug-in module and incorporated into the initiator agent of the SoC without modification of an IP block of the initiator agent;
- and
- allowing the transaction to proceed to the core of the target agent from the target interface of the target agent if the access control logic determines that the security attributes indicate access to the target agent by the initiator agent is permitted by the access policy, and otherwise preventing the transaction from proceeding to the core of the target agent from the target interface.
1 more element
An apparatus comprising:
- a system on chip (SoC) formed on a single semiconductor die and comprising:
- a first agent including an intellectual property (IP) logic, an interface to a fabric including a target interface to receive incoming transactions, a master interface and a sideband interface, and an access control plug-in unit included in the first agent to handle access control policy for the first agent with respect to the incoming transactions and outgoing transactions, wherein the target interface is to provide security attributes of the incoming transactions to the access control plug-in unit and thereafter send the incoming transactions to the IP logic if permitted by the access control plug-in unit, the first agent incorporated into the apparatus in an unmodified state;
- and
- the fabric coupled to the first agent, the fabric including a primary interface to interface with the target and master interfaces of the first agent and a sideband interface to interface with the sideband interface of the first agent.
1 more element
A system on a chip (SoC) comprising:
- a master agent to send a transaction to a target agent, the transaction including security attributes of the master agent, the master agent further including a plug-in module to generate the security attributes, wherein the master agent is incorporated into the SoC in an unmodified state;
- a fabric coupled to the master agent and the target agent;
- and
- the target agent coupled to the fabric via an interface of the target agent, the target agent further including a plug-in module located between the interface of the target agent and a core of the target agent, the plug-in module comprising an access control unit having an interface circuit to interface with the target agent interface and a functional unit to perform access control on behalf of at least a first asset and a second asset of the target agent, the first asset having a first access control policy associated therewith and the second asset having a second access control policy, wherein the target agent is incorporated into the SoC in an unmodified state and the target agent interface is to provide the security attributes to the access control unit and thereafter forward the transaction to one of the first asset and the second asset of the target agent if the access control unit permits the transaction to be forwarded.
1 more element
Dependencies are inferred from the claim text.