Time-based secure access control system

Abstract

A system on chip (SOC) has multiple master devices and multiple slave devices connected to a bus through a crossbar switch, and a time-based secure access control system of the SOC includes a central access control (CAC) circuit, which is coupled to the master device through each channel to receive a time-based access request from the master device. Each slave device is connected to the slave access control (SAC) circuit, and each SAC circuit includes an access time control (ATC) circuit and a dedicated timer that communicates with the CAC circuit. By checking to determine whether the requested access time has expired, the CAC circuit controls the ATC circuit to limit the access permission from the master device to the slave device.

Description

Technical Field

[0001] The present invention relates to system on chip (SOC) technology, and more particularly, to a time-based security access control system in a SOC. Background Art

[0002] Usually, a SOC has multiple master devices and multiple slave devices. Traditionally, a static access control method is used to manage the access permission of the master device to the slave device. Figure 1 A conventional static access control system 10 is shown, which can be implemented in a SOC. The system 10 includes two master devices (master 1, master 2) 101 and 102, three slave devices (slave 1, slave 2, slave 3) 103-105, two master security control (MSC) circuits (MSC1, MSCg) 106 and 107, three slave access control (SAC) circuits (SAC1, SAC2, SAC3) 108-110, a crossbar switch 111 and a central access control (CAC) circuit 112.

[0003] Master devices 101 and 102 are connected to crossbar switch 111 through respective MSC circuits 106 and 107, and slave devices 103-105 are connected to crossbar switch 111 through respective SAC circuits 108-110. CAC circuit 112 configures and controls MSC circuits 106 and 107 and SAC circuits 108-110 using a predetermined security policy of the SOC.

[0004] MSC circuits 106 and 107 assign security attributes to each bus transaction according to a predetermined security policy. The security attributes assigned to each transaction are transmitted together with the bus signal through the crossbar switch 111 to the bus interface of the SAC circuits 108-110, and the SAC circuits 108-110 are connected to the target slave devices 103-105. The SAC circuits 108-110 will allow or prohibit transactions to the target slave devices 103-105 based on the security attributes of the transactions.

[0005] However, the conventional static access control system 10 does not have a mechanism to dynamically limit the allowed access time of each master device, which will allow potential attackers to try to access the slave device for a long time. If the slave device is a secure memory, it may cause leakage of protected data.

[0006] Therefore, it is desirable to have a more secure access control system in a SOC. Summary of the invention

[0007] This Summary provides a selection of concepts in a simplified form that are further described in the Detailed Description. This Summary is not intended to identify key features or essential features of the subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0008] In one embodiment, the present invention provides a time-based security access control system. The system includes multiple slave devices, multiple master devices, and the master device is configured to generate a time-based access request to the slave device, wherein the time-based access request includes the requested access time for accessing the corresponding slave device, the master device identification (ID) and the slave device ID. A central access control (CAC) circuit is coupled to the master device and receives the time-based access request, and sends a confirmation of the request back to the master device. There are multiple slave access control (SAC) circuits, which are connected to the corresponding slave devices and CAC circuits. Each SAC circuit includes an access time control (ATC) circuit and a dedicated timer. The ATC circuit and the timer are used to determine whether the time-based access request has timed out and if the access request has timed out, the master device is denied access to the slave device.

[0009] In another embodiment, the present invention provides a method of controlling a time-based security access control system, the system comprising a plurality of slave devices, a plurality of master devices and a central access control (CAC) circuit, wherein each slave device comprises an access time control (ATC) circuit. The method comprises the master device generating a time-based access request, the time-based access request comprising a requested access time for accessing a corresponding slave device, and controlling the ATC circuit to restrict access permission to the slave device by checking whether the requested access time has expired. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] So that the manner in which the features of the invention described above can be understood in detail, according to the specific description of the invention of the embodiments and the above invention content, some embodiments are shown in the accompanying drawings. It will be noted, however, that the drawings only show typical embodiments of the invention and are therefore not to be considered as limiting the scope, because the invention may have other equally effective embodiments. It should be understood that the drawings are only schematic and are not drawn to scale. The advantages of the claimed subject matter will be apparent to those skilled in the art upon reading this specification and the resulting drawings, in which reference numerals are used to represent elements such as:

[0011] Figure 1 A schematic diagram of a SOC having a conventional static access control system is shown;

[0012] Figure 2 A schematic diagram of a dynamic access control system according to an embodiment of the present invention is shown;

[0013] Figure 3 The invention shows an embodiment of the present invention. Figure 2 A schematic diagram of a SOC of a dynamic access control system;

[0014] Figure 4A timing diagram showing two master devices attempting to access the same slave device according to one embodiment of the present invention;

[0015] Figure 5 A flow chart of a time-based dynamic access control method according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0016] Reference Figure 2 , Figure 2 A schematic diagram of a time-based dynamic access control system 20 according to an exemplary embodiment of the present invention is shown. The system 20 may be part of a system on a chip (SOC) in which various semiconductor components are integrated on a single chip.

[0017] The system 20 includes at least one master device 201, at least one slave device 202, a central access control (CAC) circuit 203, and at least one slave access control (SAC) circuit 204. The SAC circuit 204 includes: an access time control (ATC) circuit 205 and a dedicated timer 206. The SAC circuit 204 is configured to allow or prevent a transaction from reaching the slave device 202 according to the security attributes of the transaction and the configured security policy.

[0018] When the master device 201 wants to access the slave device 202, the master device 201 first sends a time-based access request to the CAC circuit 203. The time-based access request includes a slave device identification (ID) and a requested access time. The requested access time represents the time span of the transaction request from the master device 201 to the slave device 202. In one embodiment, the access request also includes the master device ID.

[0019] When the CAC circuit 203 receives a time-based access request from the master device 201, the CAC circuit 203 uses a conventional circuit to check the security state of the SOC before triggering the ATC circuit 205 of the SAC circuit 204. In one embodiment, if the SOC is in a secure state, the CAC circuit 203 sends an ACK signal to the master device 201, and if the SOC is not in a secure state, the CAC circuit 203 sends a NACK signal to the master device 201. The NACK signal indicates to the master device 201 that it cannot currently access the slave device 202.

[0020] In addition, if the SOC is in a safe state, the CAC circuit 203 will trigger the ATC circuit 205 in the SAC circuit 204 associated with the slave device 202 to record the arrival time of the access request (m_n_arrival_time) and the requested access time (m_n_request_time). The CAC circuit 203 also triggers the ATC circuit 205 to generate an authorized time slot for the master device 201 to access the slave device 202, where the authorized time slot is the requested access time.

[0021] In the currently preferred embodiment, the timer 206 is a real-time timer. As described below, the access request arrival time and the requested access time from the master device 201 can be received by the timer 206.

[0022] The ATC circuit 205 continuously checks to determine whether the time generated by the timer 206 is less than the sum of the time of m_n_arrival_time and m_n_request_time. When the time generated by the timer 206 is less than the sum of the access request arrival time (m_n_arrival_time) and the requested access time (m_n_request_time), the ATC circuit 205 generates an authorized access signal for allowing the master device 201 to access the slave device 202. In one embodiment, the SAC circuit 204 can also check whether the transaction from the master device 201 meets the static security policy within the authorized time slot. When the time generated by the timer 206 is within the sum of the time of m_n_arrival_time and m_n_request_time and the transaction from the master device 201 meets the static security policy within the authorized time, the SAC circuit 204 allows the transaction from the master device 201 to the slave device 202. When the time generated by the timer 206 exceeds the sum of the m_n_arrival_time and m_n_request_time, the SAC circuit 204 blocks the transaction from the master device 201 to the slave device 202. In this way, the SAC circuit 204 can dynamically limit the allowed access time.

[0023] Figure 3 FIG. 1 is a schematic diagram of a SOC 30 having a static and dynamic access control system according to an exemplary embodiment of the present invention. The components of the static access control circuit are similar to Figure 1 Therefore, the components shown in FIG. are not described again.

[0024] The system 30 includes a plurality of master devices, of which two are shown (master device 1 301 and master device 2 302), and a plurality of slave devices, of which three are shown (slave device 1 303, slave device 2 304, slave device 3 305). The master devices 301 and 302 each have an associated master security control (MSC) circuit (MSC1 306 and MSC2 307), and each slave device has an associated slave access control (SAC) circuit (SAC1 308, SAC2 309, and SAC3 310). There is a crossbar switch 311 connecting the master devices to the slave devices, and a central access control (CAC) circuit 312. Each SAC circuit 308-310 includes an access time control (ATC) circuit 316-318 and a dedicated timer 313-315. Although Figure 3 Two master devices and three slave devices are shown, but this is merely an example, as the inventive concept is not limited to any particular number of master devices or slave devices.

[0025] The master devices 301, 302 are connected to the crossbar switch 311 through a corresponding one of the MSC circuits 306 and 307, and the slave devices 303, 304, 305 are connected to the crossbar switch 311 through corresponding SAC circuits 308, 309 and 310. The CAC circuit 312 configures and controls the MSC circuits 306 and 307 and the SAC circuits 308-310 according to the security policy of the system 30.

[0026] When the master device wants to access the slave device, the master device sends a time-based access request to the CAC circuit 312. The CAC circuit 312 controls the ATC circuits 316-318 to limit the allowed access time of the master device to the slave device. As is known in conventional systems, the CAC circuit 312 communicates with the MSC circuit to check the static security state of the SOC. However, according to the present invention, the CAC circuit 312 also communicates with the corresponding SAC circuits 308-310 to perform a dynamic, time-based security check that only allows the master device to perform transactions with the slave device within a limited time period.

[0027] More specifically, the ATC circuit 316-318 in the SAC circuit 308, 309 or 310 associated with the slave device requesting access records the access request arrival time and the requested access time, and then continuously checks whether the time generated by the timer is less than the sum of the access request arrival time and the requested access time. The SAC circuit 308, 309 or 310 allows or blocks the transaction from the master device to the slave device based on the check result of the ATC circuit.

[0028] When the time generated by the timer 313, 314 or 315 is less than the sum of the access request arrival time and the requested access time (m_n_arrival_time+m_n_request_time), the SAC circuit will allow the master device to access the slave device through it. On the other hand, if dynamic security is not satisfied, the SAC circuit will block the transaction from the master device to the slave device. That is, the CAC circuit 312 controls the ATC circuits 316, 317 and 318 to limit the access permission of the master device 301, 302 to the slave devices 303, 304, 305 by checking whether the requested access time has expired.

[0029] In the current preferred embodiment, each of the plurality of master devices 301, 302 is coupled to a corresponding one of the MSC circuits 306 and 307. According to the static security policy of the SOC for each master device, the MSC circuits 306 and 307 assign corresponding attributes to each bus transaction for each master device. The assigned attributes are transmitted to the crossbar switch 311 together with the bus signal, and then transmitted to the SAC circuits 308, 309 and 310. When the time generated by the timer 313-315 is less than the sum of the access request arrival time and the requested access time, and the transaction satisfies the static security policy of the SOC, the SAC circuits 308, 309 and 310 allow the transaction from the master device 301, 302 to the slave device 303-305. On the other hand, if the time generated by the corresponding timer 313-315 exceeds the sum of the access request arrival time and the requested access time or the transaction does not comply with the static security policy of the SOC, the SAC circuits 308, 309 and 310 block the transaction from the master device 301, 302 to the selected one of the slave devices 304-306.

[0030] Figure 4 is a timing diagram of two master devices requesting to access the same slave device according to an embodiment of the present invention.

[0031] like Figure 4 As shown, master device 1 and master device 2 request to access the same slave device 2 at different times. Times t1 and t3 represent the access arrival time M_1_arrival_time of master device 1 and the sum of the access arrival time (M_1_arrival_time) and the request access time (M_1_request_time) of master device 1. The authorized time slot for master device 1 to access slave device 2 is the time span from t1 to t3. Times t2 and t4 represent the access arrival time (M_2_arrival_time) of master device 2 and the sum of the access arrival time (M_2_arrival_time) and the request access time (M_2_request_time) of master device 2. The authorized time slot for master device 2 to access slave device 2 is the time span from t2 to t4.

[0032] For master device 1, the ATC circuit checks whether the time generated by the timer has reached the sum of M_1_arrival_time and M_1_request_time. For master device 2, the associated ATC circuit checks whether the time output from its timer has reached the sum of M_2_arrival_time and M_2_request_time. For example, with respect to master device 1, when the time generated by the timer is less than the sum of (M_1_arrival_time + M_1_request_time) and the transaction satisfies the static security policy, the SAC circuit will generate an authorized access signal. The authorized access signal allows master device 1 to access slave device 2. When the time generated by the timer exceeds the sum of (M_1_arrival_time + M_1_request_time), the SAC circuit will block the transaction from master device 1 to slave device 2. Similarly, with respect to master device 2, when the time generated by the timer is less than the sum of (M_2_arrival_time + M_2_request_time) and the transaction satisfies the static security policy, the ATC circuit will generate an authorized access signal for master device 2 to access slave device 2. When the time generated by the timer exceeds the sum of (M_2_arrival_time + M_2_request_time), the SAC circuit blocks any transaction from master 2 to slave 2. Note that both master 1 and master 2 are allowed to access slave 2 simultaneously because one ATC can have several channels that handle different masters. In addition, since the timer is a real-time timer, the output of the timer can be compared with the sum of the arrival time and request time of master 1 request and master 2 request, respectively.

[0033] Figure 5 is a flow chart illustrating a time-based dynamic access control method according to an embodiment of the present invention.

[0034] In step S501, the CAC circuit receives an access request from the master device n to the slave device m. In step S502, in the current preferred embodiment, the CAC circuit checks whether the SOC is in a safe state in conjunction with the corresponding MSC circuit. If the SOC is not in a safe state, the SAC circuit prohibits the master device n from accessing the slave device m by sending a NACK to the master device n. If the SOC is in a safe state, in step 503a, the CAC circuit sends an ACK to the master device n and triggers the ATC circuit associated with the slave device m to record the arrival time of the request (m_n_arrival_time) and the requested access time (m_n_request_time). In step S503b, the ATC of the associated SAC records the time m_n_arrival_time and m_n_request_time. In step S504, the ATC circuit checks whether the time output by the timer exceeds the sum of the m_n_arrival_time and the m_n_request_time. In step S505, if not, the ATC circuit grants the access time slot to the master device n to access the slave device m. In step S506, if yes, the SAC circuit prevents the master device n from accessing the slave device m.

[0035] Therefore, the present invention provides a time-based dynamic access control system, which introduces an access time control unit before each slave device to dynamically limit the access permission of the master device to the slave device based on the requested access time.

[0036] "A" and "this" and similar terms describing the subject matter herein (especially in the claims) are considered to cover both the singular and the plural, unless otherwise indicated or clearly contradicted by the context. The numerical ranges recorded here are merely a convenient way to represent discrete values ​​falling within the range, and unless otherwise indicated, each discrete value is included in the specification as if it were recorded separately. In addition, the above description is only an embodiment and is not intended to be limiting, and the scope of protection is defined by the claims. Any and all embodiments provided herein, or the use of illustrative terms (such as "for example"), are only for the purpose of better illustrating the subject matter, and unless otherwise claimed, this is not a limitation on the scope of the subject matter. The use of the term "based on" and other similar phrases recorded in the claims and the specification indicates conditions for producing a result, and is not intended to exclude any other conditions for producing the result. Any term in the specification is not considered to indicate an element that is not necessarily claimed as an implementation claimed by the present invention.

[0037] Preferred embodiments are described herein. Of course, variations of those preferred embodiments are apparent to those skilled in the art based on what is described herein. Those skilled in the art appropriately use these variations, and the inventors intend to implement the claimed claims in different ways specifically described herein. Therefore, the claimed subject matter includes all modifications of the subject matter described in the claims and their equivalents as permitted by applicable law. In addition, unless otherwise specified or explicitly contradicted herein, combinations of the elements described above in all possible variations are encompassed herein.

Claims

1. A time-based security access control system, comprising: A plurality of slave devices, each of which has a slave device identification ID; a plurality of master devices, each having a master device ID, wherein each master device is configured to generate a time-based access request, each time-based access request including a slave device ID and a requested access time to access a selected one of the slave devices; a central access control (CAC) circuit in communication with each master device, wherein the CAC circuit receives a time-based access request from the master device; and a plurality of slave access control (SAC) circuits, wherein each SAC circuit is coupled to a corresponding one of the slave devices, wherein each SAC circuit includes a timer and an access time control (ATC) circuit, and wherein each SAC circuit is in communication with the CAC circuit, When the master device sends a time-based access request for accessing a selected slave device to the CAC circuit, the CAC circuit controls the ATC circuit of the selected slave device to check whether the requested access time has expired to limit the master device to the selected access permission.

2. The system of claim 1, wherein the time-based access request further includes a master device ID. 3 . The system of claim 1 , wherein the ATC circuit is triggered by the CAC circuit, and the ATC circuit records an access request arrival time and a requested access time.

4. The system according to claim 3, wherein: The system is in a system on chip (SOC), and the CAC circuit checks a safety status of the SOC before triggering the ATC circuit.

5. The system of claim 4, wherein if the SOC is not in a safe state, the CAC circuit sends a NACK to the master device, wherein the NACK indicates that the master device cannot access the selected slave device. 6 . The system of claim 3 , wherein if the SOC is in a safe state, the CAC circuit sends an ACK to the master device, wherein the ACK indicates that the requested access is granted at the requested access time.

7. The system of claim 6, wherein the ATC circuit generates an access granted signal when the time generated by the timer is less than the sum of the access request arrival time and the requested access time, wherein The access-granted signal allows the master device's access request to access the slave device.

8. The system of claim 7, wherein if the time generated by the timer exceeds the sum of the access request arrival time and the requested access time, the SAC circuit blocks access to the corresponding slave device.

9. The system of claim 8, wherein the timer is used as a real-time timer and the ATC circuit continuously checks whether the requested access time has expired.

10. The system of claim 1, wherein the plurality of master devices include a first master device and a second master device, wherein the first master device and the second master device request access to the same slave device at different times.

11. The system according to claim 10, wherein: The first master device has a first access request arrival time and a first requested access time, and the second master device has a second access request arrival time and a second requested access time. If the time generated by the timer is within the sum of the first access request arrival time and the first requested access time, the ATC circuit of the requested slave device allows the first master device to access the slave device for an authorized time, and if the time generated by the timer is within the sum of the second access request arrival time and the second requested access time, the ATC circuit allows the second master device to access the slave device for another authorized time.

12. A system on chip (SOC) having a plurality of master devices and a plurality of slave devices and a time-based access control system, wherein the master devices communicate with the slave devices via a crossbar switch, the system on chip comprising: a central access control (CAC) circuit in communication with a plurality of master devices, wherein the CAC circuit manages requests by master devices to access slave devices, and wherein when the CAC circuit receives an access request from a master device, the CAC circuit provides an acknowledgement of the access request to the master device; a plurality of slave access control (SAC) circuits corresponding to the plurality of slave devices, wherein each slave device is coupled to a respective one of the SAC circuits, wherein each SAC circuit includes a dedicated timer and access time control (ATC) circuit, and wherein each SAC circuit is in communication with the CAC circuit, wherein (i) the master device makes a time-based request to the slave device by issuing a time-based access request including a master device identification ID, a slave device ID and a requested access time, (ii) the CAC circuit receives the time-based access request and triggers an ATC circuit in a SAC circuit associated with the slave device circuit to record the access request arrival time and the requested access time and check whether the time generated by a dedicated timer in the SAC circuit is less than the sum of the access request arrival time and the requested access time, the slave device being identified by the slave device ID of the time-based access request, and (iii) the SAC circuit allows or blocks a transaction from the master device to the selected slave device based on the time check performed by the ATC circuit, The CAC circuit controls the ATC circuit to check whether the requested access time has expired to limit the access permission from the master device to the slave device.

13. The system on chip according to claim 12, further comprising: A plurality of master security control MSC circuits corresponding to the plurality of master devices, wherein each of the plurality of master devices is coupled to a respective one of the MSC circuits, and wherein the MSC circuits assign respective static security attributes to each transaction from the respective master device according to a static security policy of the SOC for the respective master device, wherein the assigned attributes are sent to the SAC circuit via a crossbar switch.

14. A method for controlling access of a master device to a slave device in a time-based security access control system, wherein the system comprises a central access control (CAC) circuit and a slave access control (SAC) circuit, wherein the SAC circuit comprises an access time control (ATC) circuit and a timer, the method comprising: generating a time-based access request including an access time requested by the master device to access the slave device; receiving and confirming the access request by the CAC circuit; as well as By controlling the ATC circuit to check whether the requested access time has expired to limit access permission to the slave device, The system is in a system on chip (SOC), and the CAC first checks that the SOC is in a safe state, and then triggers the ATC circuit to record the access request arrival time and the requested access time.

15. The method according to claim 14, wherein: If the time generated by the timer is within the range of the sum of the access request arrival time and the requested access time, the CAC circuit controls the ATC circuit to allow an authorization period to be given to the slave device.

16. The method according to claim 15, wherein: If the time generated by the timer exceeds the sum of the access request arrival time and the requested access time, the CAC circuit controls the ATC circuit to block the access to the slave device.

Images