Method and device for system firewall

Abstract

The invention relates to a method and device for a system firewall. Systems, apparatus, articles of manufacture, and methods of generating and managing firewall policies are disclosed. An example includes interface circuitry, machine readable instructions, and programmable circuitry at least one of instantiating or executing the machine readable instructions to determine whether to allow operation between a first component on a system on a chip (SoC) and a second component on the SoC, an interconnect between a first component on the SoC and a second component on the SoC is detected such that the interconnect filters an operation based on a determination of whether operation is permitted between the first component and the second component, and a request to filter the operation is sent based on the determination of whether operation is permitted between the first component and the second component.

Description

Technical Field

[0001] The present disclosure relates generally to computing device security and, more particularly, to methods and apparatus for system firewalls to improve security. Background Art

[0002] In computing, security and privacy are important to ensure that operations are performed efficiently and effectively without interference. Lack of security measures or insufficient security measures can make applications vulnerable to cyber attacks and data loss. Firewall policies attempt to reduce the risk of cyber attacks and data loss by restricting operations. Summary of the invention

[0003] According to an embodiment of the present disclosure, a device is provided, comprising: an interface circuit; machine-readable instructions; and a programmable circuit for instantiating or executing at least one of the machine-readable instructions to: determine whether an operation is allowed to pass between a first component on a system on a chip (SoC) and a second component on the SoC; detect the interconnection between the first component on the SoC and the second component on the SoC; cause the interconnection to filter the operation based on the determination of whether the operation is allowed to pass between the first component and the second component; and send a request to filter the operation based on the determination of whether the operation is allowed to pass between the first component and the second component.

[0004] According to an embodiment of the present disclosure, a device is provided, comprising: a first component; a second component, the second component being communicatively coupled to the first component via an interconnect; machine-readable instructions; and a programmable circuit for instantiating or executing at least one of the machine-readable instructions to: retrieve a request for a filtering operation, the request indicating whether the operation is allowed to pass between the first component and the second component; and perform a filtering action on the operation, the filtering action performing at least one of the following based on the request: preventing the operation from passing between the first component and the second component at the interconnect, or allowing the operation to pass between the first component and the second component at the interconnect.

[0005] According to an embodiment of the present disclosure, a machine-readable storage medium is provided, which includes instructions to enable a programmable circuit to perform at least the following operations: determine whether an operation is allowed to pass between a first component on a system on a chip (SoC) and a second component on the SoC; detect the interconnection between the first component on the SoC and the second component on the SoC; enable the interconnection to filter the operation based on the determination of whether the operation is allowed to pass between the first component and the second component; and send a request to filter the operation based on the determination of whether the operation is allowed to pass between the first component and the second component.

[0006] According to an embodiment of the present disclosure, a method is provided, comprising: determining whether an operation is allowed to pass between a first component on a system on a chip (SoC) and a second component on the SoC; detecting an interconnection between the first component on the SoC and the second component on the SoC; causing the interconnection to filter the operation based on the determination of whether the operation is allowed to pass between the first component and the second component; and sending a request to filter the operation based on the determination of whether the operation is allowed to pass between the first component and the second component. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 is a block diagram of an example computing environment in which an example firewall coordinator operates to generate and manage firewall policies in computing devices.

[0008] Figure 2 yes Figure 1 A block diagram of an example implementation of a firewall coordination circuit.

[0009] Figure 3-Figure 6 The flowcharts are representative of examples that can be performed, instantiated and / or implemented by example programmable circuits. Figure 2 Example machine-readable instructions and / or example operations for firewall coordination circuitry.

[0010] Figure 7 is a block diagram of an example implementation of a firewall policy operating at an intra-chip level on a SoC.

[0011] Fig. 8A is an example table indicating firewall policy rules that apply to an interconnect on a computing device.

[0012] Figure 8B is an example table indicating resource limits for operations on computing devices for which firewall policies are to be executed.

[0013] Fig. 9is a block diagram of an example processing platform including programmable circuitry configured to execute, instantiate, and / or perform Figure 3-Figure 6 Example machine readable instructions and / or execution Figure 3-Figure 6 Example operation to achieve Figure 2 Firewall coordination circuit.

[0014] Fig.10 yes Fig. 9 A block diagram of an example implementation of a programmable circuit.

[0015] Fig.11 yes Fig. 9 A block diagram of another example implementation of a programmable circuit.

[0016] Fig.12 is a block diagram of an example software / firmware / instruction distribution platform (e.g., one or more servers) for distributing software, instructions and / or firmware (e.g., with Figure 3-Figure 6 The invention is distributed to client devices associated with end users and / or consumers (e.g., for licensing, sale, and / or use), retailers (e.g., for sale, resale, licensing, and / or sub-licensing), and / or original equipment manufacturers (OEMs) (e.g., for inclusion in products to be distributed to, for example, retailers and / or other end users such as direct purchasing customers).

[0017] In general, the same reference numerals will be used throughout the various drawings and the accompanying written description to refer to the same or similar components. The drawings are not necessarily to scale. Instead, the thickness of a layer or region may be exaggerated in the drawings. Although layers and regions with clear lines and boundaries are shown in the drawings, some or all of these lines and / or boundaries may be idealized. In reality, boundaries and / or lines may be imperceptible, mixed, and / or irregular.

[0018] As used herein, unless otherwise indicated, the term "above" describes the relationship of two parts relative to the earth. A first part is above a second part if at least a portion of the second part is between the earth and the first part. Likewise, as used herein, a first part is "below" a second part when the first part is closer to the earth than the second part. As described above, a first part can be above or below a second part in one or more of the following situations: there are other parts in between, there are no other parts in between, the first part and the second part are in contact, or the first part and the second part are not in direct contact with each other.

[0019] As used in this patent, recitation of any component (e.g., layer, film, region, area, or plate) as being on another component in any manner (e.g., positioned on, located on, arranged on, or formed on, etc.) indicates that the referenced component is either in contact with the other component, or that the referenced component is above the other component with one or more intermediate components located therebetween.

[0020] As used herein, reference to connection (e.g., attachment, coupling, connection, engagement) may include reference to intermediate members between the elements referenced by the connection and / or relative movement between the elements, unless otherwise indicated. Thus, reference to connection does not necessarily infer that two elements are directly connected and / or have a fixed relationship to each other. As used herein, a statement that any component is "in contact" with another component is defined to mean that there are no intermediate components between the two components.

[0021] Unless otherwise specifically stated, descriptors such as "first," "second," "third," and the like are used herein without importing or otherwise indicating any priority, physical order, arrangement in a list, and / or meaning of being ordered in any manner, but are merely used as labels and / or arbitrary names to distinguish elements so that the disclosed examples are easily understood. In some examples, the descriptor "first" may be used to refer to an element in the detailed description, while the same element may be referred to in the claims with a different descriptor, such as "second" or "third." In this case, it should be understood that such descriptors are only used to clearly identify these elements within the context of the discussion (e.g., within the claims), which otherwise may share the same name in such a discussion.

[0022] As used herein, the phrase "communicating with..." (including variations thereof) encompasses direct communication and / or indirect communication through one or more intermediate components, without requiring direct physical (e.g., wired) communication and / or constant communication, but also includes selective communication at periodic intervals, scheduled intervals, non-periodic intervals and / or one-time events.

[0023] As used herein, “programmable circuitry” is defined as including (i) one or more special-purpose electrical circuits (e.g., an application-specific circuit (ASIC)) that are constructed to perform (one or more) specific operations and include one or more semiconductor-based logic devices (e.g., electrical hardware implemented by one or more transistors), and / or (ii) one or more general-purpose semiconductor-based electrical circuits that are programmed with instructions to perform (one or more) specific functions and / or operations and include one or more semiconductor-based logic devices (e.g., electrical hardware implemented by one or more transistors). Examples of programmable circuits include a programmable microprocessor, such as a central processor unit (CPU), which can execute a first instruction to perform one or more operations and / or functions; a field programmable gate array (FPGA), which can be programmed with a second instruction so that the FPGA is configured and / or constructed to instantiate one or more operations and / or functions corresponding to the first instruction; a graphics processor unit (GPU), which can execute a first instruction to perform one or more operations and / or functions; a digital signal processor (DSP), which can execute a first instruction to perform one or more operations and / or functions; an XPU; a network processing unit (NPU); one or more microcontrollers, which can execute a first instruction to perform one or more operations and / or functions; and / or an integrated circuit, such as an application specific integrated circuit (ASIC). For example, an XPU may be implemented by a heterogeneous computing system that includes multiple types of programmable circuits (e.g., one or more FPGAs, one or more CPUs, one or more GPUs, one or more DSPs, one or more DSPs, etc., and / or any (one or more) combinations of these), and coordination techniques (e.g., (one or more) application programming interfaces (APIs)) that may assign (one or more) computing tasks to any one (or more) of the multiple types of programmable circuits that is best suited and available to perform the (one or more) computing tasks.

[0024] As used herein, an integrated circuit is defined as one or more semiconductor packages containing one or more circuit elements, such as transistors, capacitors, inductors, resistors, current paths, diodes, etc. For example, an integrated circuit can be implemented as one or more of an ASIC, an FPGA, a chip, a microchip, a programmable circuit, a semiconductor substrate coupling multiple circuit elements, a system on chip (SoC), and the like. DETAILED DESCRIPTION

[0025] Firewall policies attempt to reduce the risk of network attacks and data loss by restricting operations (e.g., by limiting or preventing the execution of operations). Some hardware devices (e.g., CPUs, GPUs, XPUs, etc.) include interconnects that link components within the hardware devices (e.g., core to core, core to memory, etc.). The methods and apparatus disclosed herein generate firewall policies that can be deployed at the interconnect level and above, thereby providing a more robust and universal solution for generating and deploying firewall policies. Some example implementations provide a coordinator to define, request, and influence system-wide firewall features for applications, virtual machines, containers, and the like, thereby providing security and privacy for workloads. Some examples include software-defined mechanisms and platforms to support platform-wide analysis and firewall policy configuration.

[0026] In some examples, resources available on the platform can expose firewall functionality as part of inter-component functionality, such as bus operations and Peripheral Component Interconnect Express (PCIe) device functions. The methods and apparatus disclosed herein register / associate with bus functions and / or PCIe device functions to enable reconfiguration / protection of these functions. Example implementations provide a platform for generating firewall security measures / policies to reconfigure interactions between hardware components and to generate / maintain a list of approved operations / transactions that can occur between hardware components.

[0027] Some methods and apparatus disclosed herein provide protection for data through a system-wide firewall environment, wherein each application is granted a specific set of operations across all computing and interconnect elements, such that computing functions (e.g., read-write to memory) are restricted to a selected (e.g., pre-approved) set of functions. Thus, applications of interest, interfering applications local to the same host, and I / O devices (e.g., accelerators) or network agents that can access the application of interest, and other entities such as the OS kernel can only perform actions that are permitted for their use.

[0028] For example, a telemedicine network flow may pass through network nodes and undergo processing at intermediate nodes that implement various network functions. When a system performs operations on the data of the telemedicine network flow, the data is generally not protected during the computing operation, which can lead to security and privacy vulnerabilities. However, the example methods and apparatus disclosed herein can provide protection to restrict access so that even kernel or hypervisor processes and threads cannot access assigned resources, such as changing process priorities, scheduling intervals, and accessing memory areas used by applications until the application relinquishes the resources, thereby ensuring a higher level of security and privacy.

[0029] In some examples disclosed herein, firewall coordination circuitry controls basic hardware transactions and software processing of applications down to the thread level and / or process level (e.g., such control may mean that software entities such as kernels, hypervisors, etc. do not require additional isolation). In other words, if there are sufficient firewall rules at the hardware and software resources in the system, additional isolation may not be required. Some methods and apparatus disclosed herein enable applications, virtual machines (VMs), containers, and orchestrators to define, request, and / or influence system-wide firewall features that can improve security and privacy for a given workload (e.g., utilizing software-defined mechanisms and platform-wide configurations).

[0030] Figure 1 1 is a block diagram of an example computing environment 100 in which an example firewall coordinator 120 operates to generate and manage firewall policies in a computing device. The example computing environment 100 includes an example computing device 110. In some examples, the example computing environment 100 includes a plurality of computing devices 110. For example, the plurality of computing devices 110 may be included in a data center, a cloud computing environment, and the like. Fig. 9 1 to describe an example computing device in which example computer device 110 may be implemented.

[0031] Figure 1 The example computing device 110 includes a firewall coordinator 120 and a storage device 150. The example firewall coordinator 120 includes an example firewall coordination circuit 130 and an example hardware interface circuit 140.

[0032] The example firewall coordination circuitry 130 manages firewall rules (e.g., inter-component firewall rules) for the computing device 110. The example firewall coordination circuitry provides a central management that can identify workloads and control firewall policies based on the characteristics of the workloads, the historical operation of the workloads, etc. Figure 2-Figure 6 The operation of the firewall coordination circuit 130 is described in further detail.

[0033] In some examples, firewall coordination circuitry 130 is configured to execute firewall coordination instructions and / or to perform, for example, Figure 3-Figure 6 The operations represented by the flowchart(s) are instantiated within a programmable circuit of a surface.

[0034] In some examples, firewall coordinator 120 includes means for firewall coordination. For example, means for firewall coordination may be implemented by firewall coordination circuitry 130. In some examples, firewall coordination circuitry 130 may be instantiated by programmable circuitry, such as Fig. 9 For example, the firewall coordination circuit 130 may be Fig.10 The example microprocessor 1000 executes machine executable instructions (e.g. Figure 3-Figure 6 In some examples, firewall coordination circuit 130 may be instantiated by hardware logic circuitry that may be configured and / or constructed to perform operations corresponding to machine-readable instructions. Fig.11 The firewall coordination circuit 130 may be implemented by an ASIC, XPU, or FPGA circuit 1100. Additionally or alternatively, the firewall coordination circuit 130 may be instantiated by any other combination of hardware, software, and / or firmware. For example, the firewall coordination circuit 130 may be implemented by at least one or more hardware circuits (e.g., processor circuits, discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, XPUs, comparators, operational amplifiers (op-amps), logic circuits, etc.) that are configured and / or constructed to execute some or all machine-readable instructions and / or to execute some or all operations corresponding to the machine-readable instructions without executing software or firmware, but other structures are also suitable.

[0035] Example hardware interface circuitry 140 communicatively couples firewall coordination circuitry 130 with storage device 150 and with computing resources (e.g., processor(s), memory, interfaces, etc.) of computing device 110. Example hardware interface circuitry 140 is a wired data connection, such as a Serial Advanced Technology Attachment (SATA) connection, a controller area network (CAN) connection, or any other type of wired or wireless data connection link. In some examples, hardware interface circuitry 140 controls data communications between firewall coordination circuitry 130 and storage device 150 to reduce computing resources required by firewall coordination circuitry 130. In other examples, hardware interface circuitry 140 is integrated with firewall coordination circuitry 130.

[0036] An example storage device 150 is a database that stores firewall policies and / or additional data related to the operation of the firewall coordinator, such as application information, information about the operating environment of the computing device 110, and the like.

[0037] In operation, firewall coordinator 120 analyzes computing device 110 to determine the hardware present on computing device 110, to determine where to apply firewall policies, etc. In some examples, firewall policies are applied to the hardware via hardware interface circuitry 140. Firewall coordinator 120 stores information by communicating with storage 150 to maintain a record of previous iterations of firewall policies, attempted network attacks, and the like.

[0038] The firewall coordinator 120 analyzes the hardware on the computing device 110 to detect the interconnects that exist. In the examples disclosed herein, the interconnects are hardware connections that connect components on a system on a chip (SoC). These interconnects allow operations to be performed between components on the SoC, and the firewall coordinator 120 determines where the interconnects exist and which components the interconnects communicate with (e.g., CPU core to memory, CPU core to CPU core, etc.).

[0039] The firewall policy generated by firewall coordinator 120 allows or restricts the execution of operations at the interconnect. In some examples, the firewall policy is generated by analysis of the interconnect on computing device 110. In other examples, the firewall policy has been generated and one or more operations have been executed on computing device 110 through the interconnect. In such examples, the firewall policy is regenerated by analyzing the execution of the one or more operations on computing device 110. Such analysis can be done by using a machine learning model to determine which operations to restrict / allow.

[0040] There may be an example system of computing devices 110. In such a system, each computing device 110 includes a firewall coordinator 120 for executing a firewall policy. In some examples, each computing device 110 includes a different firewall policy for execution based on an application to be executed on the computing device 110. In other examples, each computing device 110 includes the same firewall policy applied to each computing device 110.

[0041] The platform resources (e.g., memory availability, CPU utilization, etc.) on the computing device 110 may expose firewall functionality as part of the computing agent, bus functionality, and PCIe device functionality. Example BIOS agents, Unified Extensible Firmware Interface (UEFI) architectures, applications, orchestrators, and OS and hypervisor services register with the computing device(s) 110, bus functionality, and PCIe device functionality for platform reconfiguration (e.g., generating / regenerating firewall policies).

[0042] Applications, VMs, and containers interact with the firewall policy running on the computing device 110 (e.g., OS / hypervisor) and make requests to the hardware firewall function to allow or restrict certain operations. The firewall function can come from multiple parties / sources that design the hardware and can therefore take the form of heterogeneous functions. Each hardware function may have its own firewall capabilities that are leveraged to enforce isolation, security, and privacy features.

[0043] BIOS, UEFI, and device-specific drivers can interact with coordinators, applications, and OS agents to determine the configuration required for firewall policy enforcement. Interfaces within the hardware (e.g., Advanced Configuration and Power Interface (ACPI)) can be extended (e.g., added, modified, swapped, etc.) to interact with hardware firewall functions to enforce policies on the hardware and reconfigure hardware policies. This functionality enables transparent firewall operations so that transactions and operations are included in the list of permitted operations. In some examples, firewall policies can perform compile-time extraction of dependency graphs on transactions and compute operations.

[0044] Figure 2 yes Figure 1 1 is a block diagram of an example implementation in which firewall coordination circuitry 130 generates and manages firewall policies within computing device 110. Figure 2 The firewall coordination circuit 130 may be instantiated (e.g., creating an instance of it, causing it to exist for any length of time, materialize, realize, etc.) by executing a first instruction by a programmable circuit such as a central processing unit (CPU). Additionally or alternatively, Figure 2 The firewall coordination circuit 130 may be instantiated (e.g., an instance of it is created, it exists for any length of time, is materialized, implemented, etc.) by (i) an application specific integrated circuit (ASIC) and / or (ii) a field programmable gate array (FPGA) that is constructed and / or configured to perform operations corresponding to the first instruction in response to the execution of the second instruction. It should be understood that Figure 2Some or all of the circuits may thus be instantiated at the same or different times. Figure 2 Some or all of the circuits of may be instantiated, for example, in one or more threads that execute concurrently on hardware and / or serially on hardware. Furthermore, in some examples, Figure 2 Some or all of the circuits may be implemented by microprocessor circuits executing instructions and / or FPGA circuits performing operations to implement one or more virtual machines and / or containers.

[0045] Component dependencies can be evaluated by hardware and software performance analyzers on the OS so that application-specific dependencies can be evaluated. Based on certain dependency factors, firewall rules and policies can be generated. These policies are learned for each application during runtime, and the firewall learning circuit 250 recommends that the firewall coordinator and OS management functions adopt the learned firewall policies.

[0046] It is expected that components (e.g., processors, interconnects, interfaces, I / O devices, memory, etc.) will follow generated software-defined principles, where existing rules and policies are reported to a management software agent where policies are re-evaluated and tracked, and metrics based on the implementation of firewall policies are reported to a coordination service for application-level control and feedback.

[0047] Components can accept, reject, or request reconfiguration based on component capabilities. In some examples disclosed herein, the generation and / or application of firewall policies is not limited by dominant factors, such as the entire process is based on core behavior or component behavior, but is evaluated in a connected and related manner. The relationship can be learned by learning the relative characteristics of the time series data of each individual component.

[0048] The firewall coordination circuit 130 includes a hardware identification circuit 210 , an interconnect detection circuit 220 , a firewall generation circuit 230 , a firewall application circuit 240 , a firewall learning circuit 250 , and an interconnect communication circuit 260 .

[0049] Hardware identification circuit 210 identifies hardware within computing device 110 for performing operations and / or implementing firewall policies. In some examples, hardware identification circuit 210 is executed by executing hardware identification instructions and / or is configured to perform, for example, Figure 3 The operations represented by the flowchart(s) are instantiated by programmable circuitry.

[0050] In some examples, firewall coordination circuit 130 includes means for identifying hardware within a computing device. For example, means for identifying may be implemented by hardware identification circuit 210. In some examples, hardware identification circuit 210 may be instantiated by a programmable circuit, such as Fig. 9For example, the hardware identification circuit 210 can be Fig.10 The example microprocessor 1000 executes machine executable instructions (e.g., at least Figure 3 In some examples, the hardware identification circuit 210 may be instantiated by a hardware logic circuit that is configured and / or constructed to perform operations corresponding to the machine-readable instructions. Fig.11 ASIC, XPU or FPGA circuit 1100. Additionally or alternatively, the hardware identification circuit 210 can be instantiated by any other combination of hardware, software and / or firmware. For example, the hardware identification circuit 210 can be implemented by at least one or more hardware circuits (e.g., processor circuits, discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, XPUs, comparators, operational amplifiers (op-amps), logic circuits, etc.) that are configured and / or constructed to execute some or all machine-readable instructions and / or perform some or all operations corresponding to machine-readable instructions without executing software or firmware, but other structures are also suitable.

[0051] The interconnect detection circuit 220 detects interconnections within the hardware identified from the hardware identification circuit 210. In some examples, the interconnect detection circuit 220 is configured to execute interconnect detection instructions and / or to perform the following steps: Figure 3 The operations represented by the flowchart(s) are instantiated by programmable circuitry.

[0052] In some examples, firewall coordination circuit 130 includes means for detecting interconnections within the identified hardware. For example, means for detecting may be implemented by interconnect detection circuit 220. In some examples, interconnect detection circuit 220 may be instantiated by programmable circuitry, such as Fig. 9 Example programmable circuit 912. For example, interconnect detection circuit 220 may be Fig.10 The example microprocessor 1000 performs at least Figure 3 In some examples, interconnect detection circuit 220 may be instantiated by hardware logic circuitry that is configured and / or constructed to perform operations corresponding to machine-readable instructions. Fig.11The interconnect detection circuit 220 may be implemented by any other combination of hardware, software, and / or firmware. In addition or alternatively, the interconnect detection circuit 220 may be instantiated by any other combination of hardware, software, and / or firmware. For example, the interconnect detection circuit 220 may be implemented by at least one or more hardware circuits (e.g., processor circuits, discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, XPUs, comparators, operational amplifiers (op-amps), logic circuits, etc.) that are configured and / or constructed to execute some or all machine-readable instructions and / or to execute some or all operations corresponding to the machine-readable instructions without executing software or firmware, but other structures are equally appropriate.

[0053] The firewall generation circuit 230 generates a firewall policy for the application. In some examples, the firewall generation circuit 230 is configured to execute firewall generation instructions and / or to execute, for example, Figure 3 , Figure 4 and / or Figure 5 The operations represented by the flowchart(s) are instantiated by programmable circuitry.

[0054] In some examples, firewall coordination circuit 130 includes means for generating a firewall policy for an application. For example, the means for generating may be implemented by firewall generation circuit 230. In some examples, firewall generation circuit 230 may be instantiated by a programmable circuit, such as Fig. 9 Example programmable circuit 912. For example, the firewall generation circuit 230 can be Fig.10 The example microprocessor 1000 performs at least Figure 3 Block 330, Figure 4 Blocks 410, 420, 430 and 440 and Figure 5 In some examples, the firewall generation circuit 230 may be instantiated by hardware logic circuits that are configured and / or constructed to perform operations corresponding to the machine-readable instructions. Fig.11The firewall generation circuit 230 may be implemented by any other combination of hardware, software, and / or firmware. In addition or alternatively, the firewall generation circuit 230 may be instantiated by any other combination of hardware, software, and / or firmware. For example, the firewall generation circuit 230 may be implemented by at least one or more hardware circuits (e.g., processor circuits, discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, XPUs, comparators, operational amplifiers (op-amps), logic circuits, etc.) that are configured and / or constructed to execute some or all machine-readable instructions and / or to execute some or all operations corresponding to the machine-readable instructions without executing software or firmware, but other structures are equally appropriate.

[0055] Firewall application circuitry 240 determines whether to allow an operation to pass between a first component and a second component (e.g., a first component on a SoC and a second component on a SoC) on computing device 110. In some examples, firewall application circuitry 240 is configured to execute firewall application instructions and / or to execute, for example, Figure 3 The operations represented by the flowchart(s) are instantiated by programmable circuitry.

[0056] In some examples, firewall coordination circuit 130 includes means for determining whether to allow operation to pass between a first component on the SoC and a second component on the SoC. For example, the means for determining may be implemented by firewall application circuit 240. In some examples, firewall application circuit 240 may be instantiated by a programmable circuit, such as Fig. 9 Example programmable circuit 912. For example, firewall application circuit 240 can be Fig.10 The example microprocessor 1000 performs at least Figure 3 In some examples, firewall application circuit 240 may be instantiated by hardware logic circuitry that may be configured and / or constructed to perform operations corresponding to machine-readable instructions. Fig.11 The firewall application circuit 240 may be implemented by an ASIC, XPU, or FPGA circuit 1100. Additionally or alternatively, the firewall application circuit 240 may be instantiated by any other combination of hardware, software, and / or firmware. For example, the firewall application circuit 240 may be implemented by at least one or more hardware circuits (e.g., processor circuits, discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, XPUs, comparators, operational amplifiers (op-amps), logic circuits, etc.) that are configured and / or constructed to execute some or all machine-readable instructions and / or to execute some or all operations corresponding to the machine-readable instructions without executing software or firmware, but other structures are equally appropriate.

[0057] Firewall learning circuitry 250 trains a machine learning model based on the performance / execution of operations. In some examples, firewall learning circuitry 250 is configured to execute firewall learning instructions and / or to perform, for example, Figure 3 and / or Figure 6 The operations represented by the flowchart(s) are instantiated by programmable circuitry.

[0058] In some examples, firewall coordination circuitry 130 includes means for training a machine learning model based on the execution / performance of the operation. For example, the means for training can be implemented by firewall learning circuitry 250. In some examples, firewall learning circuitry 250 can be instantiated by programmable circuitry, such as Fig. 9 For example, the firewall learning circuit 250 may be configured to: Fig.10 The example microprocessor 1000 performs at least Figure 3 Block 350 and Figure 6 In some examples, the firewall learning circuit 250 may be instantiated by hardware logic circuits that are configured and / or constructed to perform operations corresponding to the machine-readable instructions. Fig.11 The firewall learning circuit 250 may be implemented by an ASIC, XPU, or FPGA circuit 1100. Additionally or alternatively, the firewall learning circuit 250 may be instantiated by any other combination of hardware, software, and / or firmware. For example, the firewall learning circuit 250 may be implemented by at least one or more hardware circuits (e.g., processor circuits, discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, XPUs, comparators, operational amplifiers (op-amps), logic circuits, etc.) that are configured and / or constructed to execute some or all machine-readable instructions and / or to execute some or all operations corresponding to the machine-readable instructions without executing software or firmware, but other structures are equally appropriate.

[0059] Interconnect communication circuit 260 sends instructions to the detected interconnects to filter operations. In some examples, interconnect communication circuit 260 is configured to execute interconnect communication instructions and / or is configured to perform, for example, Figure 3 The operations represented by the flowchart(s) are instantiated by programmable circuitry.

[0060] In some examples, firewall coordination circuit 130 includes means for sending instructions for filtering operations. For example, the means for sending can be implemented by interconnect communication circuit 260. In some examples, interconnect communication circuit 260 can be instantiated by programmable circuits, such as Fig. 9 For example, the interconnect communication circuit 260 can be Fig.10 The example microprocessor 1000 performs at least Figure 3 In some examples, the interconnect communication circuit 260 may be instantiated by hardware logic circuits that are configured and / or constructed to perform operations corresponding to the machine-readable instructions. Fig.11 The interconnect communication circuit 260 may be implemented by any other combination of hardware, software, and / or firmware. In addition or alternatively, the interconnect communication circuit 260 may be instantiated by any other combination of hardware, software, and / or firmware. For example, the interconnect communication circuit 260 may be implemented by at least one or more hardware circuits (e.g., processor circuits, discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, XPUs, comparators, operational amplifiers (op-amps), logic circuits, etc.) that are configured and / or constructed to execute some or all machine-readable instructions and / or to execute some or all operations corresponding to machine-readable instructions without executing software or firmware, but other structures are equally appropriate.

[0061] Although in Figure 2 The implementation is shown in the figure Figure 1 The firewall coordination circuit 130 is an example of a method, but Figure 2 One or more of the elements, processes and / or devices shown in the drawings may be combined, divided, rearranged, omitted, eliminated and / or implemented in any other manner. Figure 2The example hardware identification circuit 210, the example interconnect detection circuit 220, the example firewall generation circuit 230, the example firewall application circuit 240, the example firewall learning circuit 250, the example interconnect communication circuit 260, and / or more generally, the example firewall coordination circuit 130, can be implemented in hardware alone, or in combination with software and / or firmware. Thus, for example, any of the example hardware identification circuit 210, the example interconnect detection circuit 220, the example firewall generation circuit 230, the example firewall application circuit 240, the example firewall learning circuit 250, the example interconnect communication circuit 260, and / or more generally the example firewall coordination circuit 130 may be implemented by programmable circuitry in combination with machine-readable instructions (e.g., firmware or software), processor circuitry, analog circuit(s), digital circuit(s), logic circuit(s), programmable processor(s), programmable microcontroller(s), graphics processing unit(s) (GPUs), digital signal processor(s) (DSPs), ASIC(s), programmable logic device(s) (PLDs), and / or field programmable logic device(s) (FPLDs) (e.g., FPGAs). In addition, Figure 2 An example firewall coordination circuit 130 may include in addition to Figure 2 In addition to or in place of those shown in Figure 2 One or more of the elements, processes and / or devices shown in the drawings, and / or may include any or all of more than one of the illustrated elements, processes and devices.

[0062] Resource firewalls span hardware and software service components that applications can use to complete tasks. In some implementations, the goal is to allow applications to run on the platform while meeting all requirements, while strictly enforcing application execution and transactions.

[0063] Computational restrictions involve a limited set of instructions for applications to meet their requirements. Instructions can be verified before an application can run on a given platform. For example, the CPU will not be able to initiate requests to I / O devices that are not pre-approved or authorized for these transactions. The CPU will also not be able to request hardware reads and writes to both system memory and I / O domains such as memory-mapped input and output (MMIO). This scheme can be applied to any type of computing environment, such as an XPU domain or an I / O domain. The firewall function of (one or more) computing devices 110 may involve function execution control, where instructions are limited to certain executions, and credit-based operations, thereby allowing applications to run calculations within predetermined limits.

[0064] The software agent is responsible for analyzing workloads (e.g., applications, VMs, containers, threads, functions, processes, etc.) based on identifiers such as process IDs, thread IDs, contexts, and source and destination IDs within the interconnect. These identifiers can be tracked to analyze usage statistics and understand the connectivity (connection graphs) and paths (link lists) of individual workloads. In some examples, the firewall generation circuitry 230 utilizes a path identification process to generate firewall rules by management entities in the OS, hypervisors, and coordinators.

[0065] Resource constraints apply not only to compute functions, but also to the interconnects that connect the compute and memory functions in the system. Compute functions / transactions can range from standard PCIe interfaces to on-chip and chip-to-chip interconnects such as embedded multi-die interconnect bridges (EMIB). For each of these transactions, there may be standard source and destination identifiers, packet identifiers, and action identifiers under which firewall functions can be implemented with limited hardware design effort. Fig. 8A and 8B The example table of provides example parameters that can be used as firewall actions to provide security and privacy. In some examples, performance gains can be achieved because transactions are guaranteed to occur without congestion or interference causing saturation.

[0066] The disclosed implementations can be utilized with virtualization technologies such as single-root input / output virtualization (SR-IOV) and scalable input / output virtualization (S-IOV). In some such implementations, no additional hardware and software overhead is incurred for virtualization management.

[0067] exist Figure 3-Figure 6 (One or more) flow charts are shown in the figure, which represent the flow charts that can be executed by programmable circuits to implement and / or instantiate Figure 2 Example machine-readable instructions of the firewall coordination circuit 130, and / or representative instructions executable by programmable circuitry to implement and / or instantiate Figure 2 The machine-readable instructions may be one or more executable programs or (one or more) parts of one or more executable programs for execution by programmable circuits, such as the following connection Fig. 9 The programmable circuit 912 shown in the example processor platform 900 discussed below and / or may be Fig.10 and / or Fig.11 The example programmable circuit (e.g., FPGA) discussed herein is one or more functions or (one or more) parts of functions to be performed. In some examples, machine-readable instructions cause operations, tasks, etc. to be performed and / or executed in an automated manner in the real world. As used herein, "automation" means without human involvement.

[0068] The program may be embodied as instructions (e.g., software and / or firmware) stored on one or more non-transitory computer-readable and / or machine-readable storage media, such as cache memory, magnetic storage devices or disks (e.g., floppy disks, hard disk drives (HDD), etc.), optical storage devices or disks (e.g., Blu-ray disks, compact disks (CD), digital versatile disks (DVD), etc.), redundant arrays of independent disks (RAID), registers, ROM, solid-state drives (SSD), SSD memory, non-volatile memory (e.g., electrically erasable programmable read-only memory (EEPROM), flash memory, etc.), volatile memory (e.g., any type of random access memory (RAM), etc.), and / or any other storage device or storage disk. Instructions of a non-transitory computer-readable and / or machine-readable medium may program programmable circuits located in one or more hardware devices and / or be executed by such circuits, but the entire program and / or portions thereof may also be executed and / or instantiated by one or more hardware devices other than programmable circuits, and / or embodied in dedicated hardware. Machine-readable instructions may be distributed across multiple hardware devices and / or executed by two or more hardware devices (e.g., a server and a client hardware device). For example, a client hardware device may be implemented by an endpoint client hardware device (e.g., a hardware device associated with a human and / or machine user) or an intermediate client hardware device gateway (e.g., a radio access network (RAN)) that facilitates communication between a server and an endpoint client hardware device. Similarly, a non-transitory computer-readable storage medium may include one or more media. In addition, although reference is made to Figure 3-Figure 6The example program is described using the flowchart(s) shown in the example, but many other methods of implementing the example firewall coordination circuit 130 may alternatively be used. For example, the order of execution of the blocks of the flowchart(s) may be changed, and / or some of the described blocks may be changed, eliminated, or combined. Additionally or alternatively, any or all of the blocks of the flowchart may be implemented by one or more hardware circuits (e.g., processor circuits, discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, comparators, operational amplifiers (op-amps), logic circuits, etc.) that are constructed to perform the corresponding operations without executing software or firmware. The programmable circuits may be distributed at different network locations and / or local to one or more hardware devices (e.g., single-core processors (e.g., single-core CPUs), multi-core processors (e.g., multi-core CPUs, XPUs, etc.)). For example, the programmable circuit may be a CPU and / or FPGA located in the same package (e.g., the same integrated circuit (IC) package or two or more separate housings), one or more processors in a single machine, multiple processors distributed across multiple servers in a server rack, multiple processors distributed across one or more server racks, etc., and / or any combination (one or more) of these.

[0069] The machine-readable instructions described herein may be stored in one or more of a compressed format, an encrypted format, a segmented format, a compiled format, an executable format, a packaged format, and the like. The machine-readable instructions as described herein may be stored as data (e.g., computer-readable data, machine-readable data, one or more bits (e.g., one or more computer-readable bits, one or more machine-readable bits, and the like), a bitstream (e.g., a computer-readable bitstream, a machine-readable bitstream, and the like), and the like) or a data structure (e.g., as part(s) of instructions, code, code representation, and the like) that may be utilized to create, manufacture, and / or generate machine-executable instructions. For example, the machine-readable instructions may be segmented and stored on one or more storage devices, disks, and / or computing devices (e.g., servers) located at the same or different locations of a network or collection of networks (e.g., in the cloud, in an edge device, and the like). The machine-readable instructions may require one or more of installation, modification, adaptation, updating, combination, supplementation, configuration, decryption, decompression, unpacking, distribution, reassignment, compilation, and the like, so that they may be directly readable, interpretable, and / or executable by a computing device and / or other machine. For example, machine-readable instructions may be stored as multiple parts that are individually compressed, encrypted, and / or stored on separate computing devices, where the parts, when decrypted, decompressed, and / or combined, form a set of computer-executable and / or machine-executable instructions that implement one or more functions and / or operations that may together form a program, such as that described herein.

[0070] In another example, machine-readable instructions may be stored in a state in which they can be read by programmable circuitry, but require the addition of a library (e.g., a dynamic link library (DLL)), a software development kit (SDK), an application programming interface (API), etc., in order to execute the machine-readable instructions on a particular computing device or other device. In another example, the machine-readable instructions and / or corresponding program(s) may need to be configured (e.g., to store settings, input data, record network addresses, etc.) before the machine-readable instructions and / or corresponding program(s) can be executed in whole or in part. Thus, as used herein, a machine-readable, computer-readable, and / or machine-readable medium may include instructions and / or program(s) regardless of the specific format or state of the machine-readable instructions and / or program(s).

[0071] The machine-readable instructions described herein may be represented by any past, current, or future instruction language, scripting language, programming language, etc. For example, the machine-readable instructions may be represented by any of the following languages: C, C++, Java, C#, Perl, Python, JavaScript, HyperText Markup Language (HTML), Structured Query Language (SQL), Swift, etc.

[0072] As mentioned above, Figure 3-Figure 6The example operations of can be implemented using executable instructions (e.g., computer-readable and / or machine-readable instructions) stored on one or more non-transient computer-readable and / or machine-readable media. As used herein, the terms non-transient computer-readable medium, non-transient computer-readable storage medium, non-transient machine-readable medium, and / or non-transient machine-readable storage medium are explicitly defined to include any type of computer-readable storage device and / or storage disk, and exclude propagation signals and exclude transmission media. Examples of such non-transient computer-readable media, non-transient computer-readable storage media, non-transient machine-readable media, and / or non-transient machine-readable storage media include optical storage devices, magnetic storage devices, HDDs, flash memory, read-only memory (ROM), CDs, DVDs, caches, any type of RAM, registers, and / or any other storage device or storage disk in which information can be stored for any duration (e.g., storage for a longer period of time, permanent storage, short-term storage, for temporary buffering, and / or for caching of information). As used herein, the terms "non-transitory computer-readable storage device" and "non-transitory machine-readable storage device" are defined to include any physical (mechanical, magnetic, and / or electrical) hardware that retains information over a period of time, but excludes propagating signals and excludes transmission media. Examples of non-transitory computer-readable storage devices and / or non-transitory machine-readable storage devices include any type of random access memory, any type of read-only memory, solid-state memory, flash memory, optical disks, magnetic disks, disk drives, and / or redundant arrays of independent disks (RAID) systems. As used herein, the term "device" refers to a physical structure, such as a mechanical and / or electrical device, hardware, and / or circuit, which may or may not be configured by computer-readable instructions, machine-readable instructions, etc., and / or manufactured to execute computer-readable instructions, machine-readable instructions, etc.

[0073] "Include" and "comprising" (and all forms and tenses thereof) are used as opening terms herein. Thus, whenever a claim employs any form of "include" or "comprising" (e.g., includes, comprises, has, etc.) as a preamble or used in any type of claim recitation, it is to be understood that additional elements, terms, etc. may be present without falling outside the scope of the corresponding claim or recitation. As used herein, when the phrase "at least" is used as a transitional term, such as in the preamble of a claim, it is opening in the same way that the terms "include" and "comprising" are opening. The term "and / or" when used, for example, in a form such as A, B, and / or C, refers to any combination or subset of A, B, and C, such as (1) A alone, (2) B alone, (3) C alone, (4) A and B, (5) A and C, (6) B and C, or (7) A and B and C. As used herein in the context of describing structures, components, items, objects, and / or things, the phrase “at least one of A and B” is intended to refer to implementations that include any of the following: (1) at least one A, (2) at least one B, or (3) at least one A and at least one B. Similarly, as used herein in the context of describing structures, components, items, objects, and / or things, the phrase “at least one of A or B” is intended to refer to implementations that include any of the following: (1) at least one A, (2) at least one B, or (3) at least one A and at least one B. As used herein in the context of describing the performance and / or execution of processes, instructions, acts, and / or activities, the phrase “at least one of A and B” is intended to refer to implementations that include any of the following: (1) at least one A, (2) at least one B, or (3) at least one A and at least one B. Similarly, as used herein in the context of describing the performance or execution of a process, instruction, action, and / or activity, the phrase "at least one of A or B" is intended to refer to an implementation that includes any of the following: (1) at least one A, (2) at least one B, or (3) at least one A and at least one B.

[0074] As used herein, singular references (e.g., "a," "a," "a first," "a second," etc.) do not exclude a plurality. As used herein, the term "an" or "an" object refers to one or more of that object. The terms "a," "one or more," and "at least one" are used interchangeably herein. Furthermore, although listed separately, multiple means, elements, or actions may be implemented, for example, by the same entity or object. Furthermore, although individual features may be included in different examples or claims, they may be combined, and inclusion in different examples or claims does not imply that a combination of features is not feasible and / or not advantageous.

[0075] Figure 3 is a flow chart representing example machine-readable instructions and / or example operations 300 that may be executed, instantiated, and / or performed by programmable circuitry to generate and manage firewall policies on a computing device. Figure 3 The example machine-readable instructions and / or example operations 300 begin at block 310, where the hardware identification circuit 210 identifies hardware on the computing device 110 for implementing a firewall policy. In some examples, the hardware identified on the computing device 110 includes hardware capable of executing the firewall policy (e.g., a CPU, SoC, or any other kind of component capable of receiving and executing instructions). In examples disclosed herein, the hardware identified on the computing device 110 results in a determination of where the firewall policy may be applied (e.g., applying the firewall policy at the identified hardware). In such examples, the firewall policy is run / executed at the hardware to restrict / allow operations to occur.

[0076] Once the hardware identification circuit 210 identifies the hardware for implementing the firewall policy, the interconnect detection circuit 220 detects the interconnect on the identified hardware (block 320). In some examples, an interconnect is a hardware path for transmitting data between two pieces of hardware. Such examples act as a "toll booth" or "security checkpoint" to verify the operation scheduled to be executed / performed to allow or restrict the execution of the operation. In some examples, the interconnect detection circuit 220 queries the computing device 110 to detect the interconnect (e.g., the computing device 110 returns the location / status / etc. of the interconnect). In some examples, the identified hardware does not have an interconnect, and determining that there is no interconnect helps determine the appropriate firewall policy to be generated to ensure increased security.

[0077] Once the interconnect detection circuit 220 identifies the interconnects on the identified hardware, the firewall generation circuit 230 generates a firewall policy based on the identified hardware and the detected interconnects. (Block 330). In some examples, the firewall policy is generated based on the understanding that some hardware lacks interconnects, and can be generated by applying additional security checks based on the lack of interconnects to mitigate potential security risks. In other examples, if interconnects do exist, a firewall policy is generated to utilize these interconnects to filter / not perform operations. In combination with Figure 4 An example process for implementing block 330 is described.

[0078] Once the firewall generation circuit 230 generates the firewall policy, the firewall application circuit 240 applies the firewall policy to the identified hardware (block 340). In some examples, the firewall policy is applied by storing the policy in a memory (e.g., local memory, RAM, SSD, HDD, etc. of a system on a chip (SoC)) so that it can be accessed by the SoC when the operation is to be performed. In other examples, when the operation is to be performed, the SoC accesses the firewall policy from a global storage device (e.g., storage device 150). In some examples, the firewall application circuit 240 determines whether the operation is allowed to pass through the interconnect. This determination includes the amount / number of available computing resources, whether an unauthorized transaction / operation is detected, and the like.

[0079] In some examples, applying the firewall policy includes sending instructions to the identified hardware to filter the operation. In such an example, the interconnect communication circuit 260 sends instructions to the identified hardware to allow or restrict the execution of the operation.

[0080] Once the firewall application circuitry 240 and the interconnect communication circuitry 260 apply the firewall policy, the firewall learning circuitry 250 trains the machine learning model by analyzing the application of the firewall policy (block 350). In some examples, the machine learning model is trained to assist the firewall generation circuitry 230 in generating subsequent firewall policies. In some such examples, the firewall learning circuitry 250 monitors / analyzes the execution of operations to determine whether to change the existing firewall policy.

[0081] Figure 4 is a flow chart representing example machine readable instructions and / or example operations that may be executed, instantiated, and / or performed by programmable circuitry to identify whether to generate a firewall policy. Figure 4 The example machine readable instructions and / or example operations begin at block 410, where the firewall generation circuit 230 determines whether a firewall policy exists for the application to be executed. In some examples, a firewall policy already exists for an application, whether the firewall policy is previously generated or based on a template (e.g., a predefined list of allowed operations, such as a whitelist).

[0082] When the firewall generation circuit 230 determines that the firewall policy already exists (eg, block 410 returns a "yes" result), the firewall generation circuit 230 accesses the firewall policy (block 420). In some examples, the firewall policy is stored in the storage device 150 and is thereafter accessed via the storage device 150.

[0083] When the firewall generation circuit 230 determines that a firewall policy does not exist (e.g., block 410 returns a "no" result), the firewall generation circuit 230 generates a firewall policy (block 430). In some examples, the generation of the firewall policy is based on a predetermined template or whitelist of restricted / approved operations. In other examples, all operations are restricted until the firewall policy is generated.

[0084] Once the firewall generation circuitry 230 accesses the firewall policy or generates a new firewall policy, the firewall generation circuitry 230 associates the firewall policy with the identified hardware and detected interconnects (block 440). In some examples, the firewall policy is generated based on the identified hardware and detected interconnects, and the firewall policy is associated (e.g., matched / correlated / linked / etc.) with the identified hardware and detected interconnects to ensure that the firewall policy operates on the appropriate hardware / interconnects.

[0085] Figure 5 is a flow chart representing example machine-readable instructions and / or example operations that may be executed, instantiated, and / or performed by programmable circuitry to generate a firewall policy. Figure 5 The example machine readable instructions and / or example operations of start at block 510, where the firewall generation circuit 230 determines a global policy for firewall generation. In some examples, the application includes global policies that include predefined allow / restrict operations, and the firewall policy can utilize these global policies to generate the firewall policy.

[0086] Once the firewall generation circuit 230 determines the global policy, the firewall generation circuit 230 determines whether the application has vulnerabilities / weaknesses that may make the application vulnerable to attacks (e.g., network attacks) (block 520). In some examples, the vulnerabilities include lack of security for read / write operations, lack of restrictions on parallel operations (e.g., writing data to multiple destinations at once), or any other form of operation.

[0087] Once the firewall generation circuitry 230 determines whether the application has vulnerabilities / weaknesses, the firewall generation circuitry 230 determines whether these vulnerabilities require additional security measures (block 530). In some examples, a lack of restrictions on parallel operations (e.g., reading / writing data to multiple destinations / sources simultaneously) is identified, requiring a dedicated firewall policy to restrict such operations. In other examples, the application is unable to perform parallel operations (or other types of operations) and does not require a dedicated firewall policy to restrict such operations.

[0088] When the firewall generation circuitry 230 determines that the vulnerability requires additional security measures (e.g., block 530 returns a "yes" result), the firewall generation circuitry 230 identifies additional firewall security measures to address the vulnerability / weakness (block 540). Some such security measures may include restricting certain operations, adding / removing certain operations from a template / whitelist of operations, providing notifications when a certain operation is performed, and the like.

[0089] Once the firewall generation circuit 230 identifies additional security measures, or when the firewall generation circuit 230 determines that the vulnerability / weakness does not require additional security measures (e.g., block 530 returns a "no" result), the firewall generation circuit 230 generates a firewall policy based on the determined vulnerability, the identified additional security measures, and the determined global policy (block 550). In some examples, the generated firewall policy is stored in the storage device 150 for access by the identified hardware when the operation is to be performed. In other examples, the firewall policy is stored locally in the SoC (e.g., in a memory module).

[0090] Figure 6 is a flow chart representing example machine-readable instructions and / or example operations that may be executed, instantiated, and / or performed by programmable circuitry to generate a trained machine learning model for subsequent firewall policies. Figure 6 The example machine readable instructions and / or example operations begin at block 610, where the firewall learning circuit 250 determines whether to access results from a previous iteration of the firewall policy. In some examples, after each iteration of the firewall policy is executed, the results (e.g., whether any unauthorized operations were detected, the delay in executing the operation using the firewall policy, etc.) are stored in the storage device 150.

[0091] When the firewall learning circuit 250 determines that the result is to be accessed (e.g., block 610 returns a result of "yes"), the firewall learning circuit 250 accesses the result from the storage device 150 (block 620). In some examples, the result is used to determine whether the operation is performed appropriately for a given application. Such a determination may include determining whether the operation is performed according to system constraints (e.g., resource utilization, latency requirements, etc.).

[0092] Once the firewall learning circuitry 250 has accessed the results from the storage device 150, or when the firewall learning circuitry 250 determines that no previous results will be accessed from the storage device 150 (e.g., block 610 returns a "no" result), the firewall learning circuitry 250 identifies the resources allocated for applying the firewall policy (block 630). In some examples, the firewall policy is to use a predefined amount of computing resources (e.g., CPU percentage, RAM bandwidth, etc.), and the efficiency of a given application is based on the resources used.

[0093] Once the firewall learning circuitry 250 identifies the resources allocated for applying the firewall policy, the firewall training circuitry 250 assigns a score to the execution of the operation (block 640). In some examples, the firewall learning circuitry 250 calculates the score based on the allocated resources, application vulnerabilities / weaknesses, and / or previous iteration results. Additional factors may also be included in the score calculation that evaluate the success / efficiency of the firewall policy applied to the operation.

[0094] Once the firewall learning circuitry 250 has assigned a score to the execution of the operation based on the firewall policy, the firewall learning circuitry 250 determines whether new vulnerabilities in the application were discovered during the execution of the operation (block 650). In some examples, the execution of the operation may discover previously unknown vulnerabilities / weaknesses that were not considered when the firewall policy was generated. Such newly discovered vulnerabilities may be discovered due to the detection of a malicious attack, the execution of an unauthorized operation, etc. Such examples may require the firewall policy to be regenerated.

[0095] When the firewall learning circuit 250 determines that a new vulnerability has been discovered (e.g., block 650 returns a "yes" result), the firewall learning circuit 250 weights the assigned score based on the newly discovered vulnerability (block 660). In some examples, the score can be weighted to support regenerating firewall policies to improve security if the newly discovered vulnerability presents a security risk. In other examples, the score can be weighted so that the firewall policy is not regenerated to save computing resources if the newly discovered vulnerability does not present a security risk.

[0096] Once the score is weighted based on the newly discovered vulnerabilities, or when the firewall learning circuitry 250 determines that no new vulnerabilities have been discovered (e.g., block 650 returns a "no" result), the firewall learning circuitry 250 determines whether the final score meets a given threshold (block 670). In some examples, the threshold defines whether to regenerate the firewall policy. In some examples, the threshold is dynamically set based on the scale of the score, the global policy, a given application, etc.

[0097] When the firewall learning circuitry 250 determines that the score does not meet the threshold (e.g., block 670 returns a "no" result), the firewall learning circuitry 250 instructs the firewall generation circuitry 230 to regenerate the firewall policy (block 680). In some examples, the instructions to regenerate the firewall policy include the newly discovered vulnerability, the weighted score, and / or the previous results. However, additional factors may also be included in the instructions to regenerate the firewall policy. In some examples, the instructions to regenerate the firewall policy include instructing the firewall generation circuitry 230 to restrict previously allowed operations based on the results of executing the firewall policy.

[0098] Once the instruction to regenerate the firewall policy is sent, or when the firewall learning circuit 250 determines that the score does meet the threshold (e.g., block 670 returns a "yes" result), the firewall learning circuit 250 generates a new firewall policy based on the firewall learning circuit 250. Figure 6 The training sequence updates the machine learning model (block 690). In some examples, the machine learning model is stored in the storage device 150, and each time the training sequence is executed, the machine learning model is updated (block 690). Figure 6 The example operation is accessed whenever Figure 6 The machine learning model is updated and trained whenever a learning sequence is generated.

[0099] Figure 7 is a block diagram of an example implementation of a firewall policy operating at the intra-chip level on SoC 700. Figure 7 In an example implementation of , SoC 700 includes a first XPU / CPU 710 and a second XPU / CPU 720. The first and second XPU / CPUs 710, 720 communicate with the firewall coordinator circuit 130 via a network input / output (I / O) device 730 using a network 732 or via an external I / O device 735.

[0100] The first XPU / CPU 710 includes a first interconnect 740 ( Figure 7 ). The first interconnect 740 controls intra-socket communication between components on the first XPU / CPU 710. In the examples disclosed herein, a firewall policy applied to the SoC 700 determines whether an operation is to be performed at the first interconnect 740 (e.g., whether communication between components on the first XPU / CPU 710 is allowed).

[0101] The second XPU / CPU 720 includes a second interconnect 750 ( Figure 7 In some examples, the first interconnect 740 and the second interconnect 750 are identical (eg, have no difference in their functionality) and allow / restrict the same operations. In other examples, such as Figure 7 As shown, the operations allowed / restricted by the second interconnect 750 for the second XPU / CPU 720 are different from the operations allowed / restricted by the first interconnect 740 for the first XPU / CPU 710. In some examples, the point in time at which the second interconnect 750 is utilized is different from the point in time at which the first interconnect 740 is utilized. Such an example shows that when the firewall policy is applied to the SoC 700, the second interconnect 750 is not utilized. Once a subsequent firewall policy is generated to utilize the second interconnect 750, the second interconnect 750 will be utilized.

[0102] exist Figure 7In the example of FIG. 1 , the first and second interconnects 740 , 750 also control intra-socket communications (eg, control communications between the first and second XPU / CPUs 710 , 720 , respectively).

[0103] In some examples, SoC 700 includes additional chipsets. Figure 7 In the example of , SoC 700 includes a network-on-chip (NoC) 760 communicatively coupled to the first and / or second XPU / CPU 710, 720, a network input / output device 730, or an external I / O device 735. SoC 700 may include a hierarchy of buses. Figure 7 In the example of SoC 700, SoC 700 may include a primary bus 770, a secondary bus 772, a tertiary bus 774, and any additional buses for operatively communicating with components within SoC 700. Each bus 770, 772, 774 may include individual interconnects 740, 750, or as shown in FIG. Figure 7 As shown in FIG. 1 , only the primary bus 770 includes the interconnects 740 , 750 , while the downstream buses rely on the interconnects 740 , 750 on the primary bus 770 .

[0104] Fig. 8A is a first example table 800 indicating firewall policy rules applied to an interconnect on a computing device. Fig. 8A In the first example table 800 of FIG. 8 , each processor and interconnect is assigned a unique identifier. These identifiers are used to determine whether the processor / interconnect is approved to perform an operation. If an operation is requested to be performed on an interconnect / processor, and the operation is not approved (e.g., is not among the whitelisted operations to be performed), the operation can be denied execution. Similarly, if an operation is requested to be performed and the operation is a whitelisted operation to be performed at an approved processor / interconnect, the operation can be allowed to be performed. The first example table 800 of FIG. 8 illustrates that each processor / interconnect is identifiable and that a list of approved operations is associated with a list of identifiable components that can perform the operation.

[0105] Figure 8BIt is a second example table 810, indicating the resource limits of the operations on the computing device for which the firewall policy is to be executed. In some examples, the computing device is limited in the resources available for executing the operation. In such an example, the process can be organized according to the credit limit and priority for executing such an operation. Credit ensures that every operation, every resource access and every transaction (including inter-process and inter-thread communication) is provided in the credit system, wherein each credit is granted for a special reason. Weights can be assigned to the combination of credit and priority to determine which operation should be executed / performed first. Especially in a computing environment with limited resources, weighting the execution of operations can improve security and ensure that more important security / firewall operations are executed first.

[0106] In some examples, a hacker may gain access to the system, for example, due to incomplete access credentials on the computing device 110 or by bypassing the system security protocol. Even if encryption is activated on the computing device 110, sufficient privileges of the compromised application may increase the security risk in the entire system. Therefore, each access can be combined (or replaced) by a credit system. The credit system can ensure that operations, resource access, transactions (e.g., including inter-process, inter-thread communication), etc. are provided in the credit system, where each credit is granted for a specific reason. In such an example, even if a hacker gains access to the system, the hacker cannot copy, infer, or transfer data from the system.

[0107] Implementations disclosed herein may establish a limited set of rules within interconnects and system components (e.g., components within computing device(s) 110). Such implementations may eliminate the need for special encryption and decryption processes that protect data within a given system. As long as resource access is fully regulated for both (1) applications of interest and (2) attacker applications, and a credit-based approach is employed, additional security features may not be required. For example, if database read / writes are combined with credits along with access control, security can be increased with greater certainty. That is, even if, for example, a password is stolen by a hacker, the hacker cannot execute harmful instructions if the application does not have sufficient credit.

[0108] Fig. 9 is constructed to execute and / or instantiate Figure 3-Figure 6 Example machine readable instructions and / or example operations to implement Figure 2 1 is a block diagram of an example programmable circuit platform 900 of the firewall coordination circuit 130. The programmable circuit platform 900 can be, for example, a server, a personal computer, a workstation, a self-learning machine (e.g., a neural network), a mobile device (e.g., a cellular phone, a smart phone, an iPad, etc.) TM), a personal digital assistant (PDA), an Internet appliance, a digital video recorder, a personal video recorder, a set-top box, headphones (e.g., an augmented reality (AR) headset, a virtual reality (VR) headset, etc.) or other wearable device, or any other type of computing and / or electronic device.

[0109] The programmable circuit platform 900 of the illustrated example includes a programmable circuit 912. The programmable circuit 912 of the illustrated example is hardware. For example, the programmable circuit 912 may be implemented by one or more integrated circuits, logic circuits, FPGAs, microprocessors, CPUs, GPUs, DSPs, and / or microcontrollers from any desired family or manufacturer. The programmable circuit 912 may be implemented by one or more semiconductor-based (e.g., silicon-based) devices. In this example, the programmable circuit 912 implements the example hardware identification circuit 210, the example interconnect detection circuit 220, the example firewall generation circuit 230, the example firewall application circuit 240, the example firewall learning circuit 250, and the example interconnect communication circuit 260.

[0110] The programmable circuit 912 of the illustrated example includes a local memory 913 (e.g., cache, register, etc.). The programmable circuit 912 of the illustrated example communicates with a main memory 914, 916 including a volatile memory 914 and a non-volatile memory 916 via a bus 918. The volatile memory 914 may be a synchronous dynamic random access memory (SDRAM), a dynamic random access memory (DRAM), Dynamic Random Access Memory Dynamic Random AccessMemory, The non-volatile memory 916 may be implemented by flash memory and / or any other desired type of memory device. Access to the main memory 914, 916 of the illustrated example is controlled by a memory controller 917. In some examples, the memory controller 917 may be implemented by one or more integrated circuits, logic circuits, microcontrollers from any desired family or manufacturer, or any other type of circuit to manage the flow of data into and out of the main memory 914, 916.

[0111] The programmable circuit platform 900 of the illustrated example further includes an interface circuit 920. The interface circuit 920 may be implemented by hardware according to any type of interface standard, such as an Ethernet interface, a universal serial bus (USB) interface, interface, a near field communication (NFC) interface, a peripheral component interconnect (PCI) interface, and / or a peripheral component interconnect Express (PCIe) interface.

[0112] In the illustrated example, one or more input devices 922 are connected to the interface circuit 920. The input device(s) 922 allow a user (e.g., a human user, a machine user, etc.) to input data and / or commands into the programmable circuit 912. The input device(s) 922 may be implemented by, for example, an audio sensor, a microphone, a camera (still or video), a keyboard, buttons, a mouse, a touch screen, a trackpad, a trackball, an isopoint device, and / or a voice recognition system.

[0113] One or more output devices 924 are also connected to the interface circuit 920 of the illustrated example. The output device(s) 924 may be implemented, for example, by a display device (e.g., a light emitting diode (LED), an organic light emitting diode (OLED), a liquid crystal display (LCD), a cathode ray tube (CRT) display, an in-place switching (IPS) display, a touch screen, etc.), a tactile output device, a printer, and / or a speaker. The interface circuit 920 of the illustrated example thus typically includes a graphics driver card, a graphics driver chip, and / or a graphics processor circuit, such as a GPU.

[0114] The interface circuitry 920 of the illustrated example also includes communication devices, such as transmitters, receivers, transceivers, modems, residential gateways, wireless access points, and / or network interfaces, to facilitate data exchange with external machines (e.g., any kind of computing device) over the network 926. Communications may be made through, for example, an Ethernet connection, a digital subscriber line (DSL) connection, a telephone line connection, a coaxial cable system, a satellite system, a beyond-line-of-sight wireless system, a line-of-sight wireless system, a cellular telephone system, an optical connection, and the like.

[0115] The programmable circuit platform 900 of the illustrated example also includes one or more mass storage disks or devices 928 to store firmware, software and / or data. Examples of such mass storage disks or devices 928 include magnetic storage devices (e.g., floppy disks, drives, HDDs, etc.), optical storage devices (e.g., Blu-ray disks, CDs, DVDs, etc.), RAID systems, and / or solid-state storage disks or devices (e.g., flash memory devices and / or SSDs).

[0116] can be Figure 3-Figure 6 The machine-readable instructions 932 implemented by the machine-readable instructions may be stored in the mass storage device 928, in the volatile memory 914, in the non-volatile memory 916, and / or on at least one removable non-transitory computer-readable storage medium such as a CD or DVD.

[0117] Fig.10 yes Fig. 9 912. In this example, Fig. 9 The programmable circuit 912 is implemented by the microprocessor 1000. For example, the microprocessor 1000 may be a general-purpose microprocessor (eg, a general-purpose microprocessor circuit). The microprocessor 1000 executes Figure 3-Figure 6 A portion or all of a flowchart of machine-readable instructions to effectively Figure 2 The circuits are instantiated as logic circuits to perform operations corresponding to these machine-readable instructions. In some such examples, Figure 2 The circuits are instantiated by hardware circuits of the microprocessor 1000 in combination with machine-readable instructions. For example, the microprocessor 1000 may be implemented by multi-core hardware circuits, such as a CPU, DSP, GPU, XPU, and the like. Although it may include any number of example cores 1002 (e.g., 1 core), the microprocessor 1000 of this example is a multi-core semiconductor device including N cores. The cores 1002 of the microprocessor 1000 may operate independently, or may cooperate to execute machine-readable instructions. For example, machine code corresponding to a firmware program, an embedded software program, or a software program may be executed by one of the cores 1002, or may be executed by multiple cores in the cores 1002 at the same or different times. In some examples, the machine code corresponding to the firmware program, the embedded software program, or the software program is divided into threads and executed in parallel by two or more cores in the cores 1002. The software program may correspond to Figure 3-Figure 6 The flowchart may represent part or all of the machine-readable instructions and / or operations.

[0118] The core 1002 can communicate via a first example bus 1004. In some examples, the first bus 1004 can be implemented by a communication bus to implement communications associated with one (or more) of the cores 1002. For example, the first bus 1004 can be implemented by at least one of an Inter-Integrated Circuit (IC) bus, a Serial Peripheral Interface (SPI) bus, a PCI bus, or a PCIe bus. Additionally or alternatively, the first bus 1004 can be implemented by any other type of computing or electrical bus. The core 1002 can obtain data, instructions, and / or signals from one or more external devices via an example interface circuit 1006. The core 1002 can output data, instructions, and / or signals to one or more external devices via the interface circuit 1006. While the core 1002 of this example includes an example local memory 1020 (e.g., a level 1 (L1) cache that can be partitioned into an L1 data cache and an L1 instruction cache), the microprocessor 1000 also includes an example shared memory 1010 (e.g., a level 2 (L2 cache)) that can be shared by the cores for high-speed access to data and / or instructions. Data and / or instructions can be transferred (e.g., shared) by writing to and / or reading from the shared memory 1010. The local memory 1020 and shared memory 1010 of each core 1002 can be a plurality of levels of cache memory and main memory (e.g., Fig. 9 Caches are part of a hierarchy of storage devices (main memory 914, 916). Typically, higher level memories in the hierarchy exhibit lower access times and have smaller storage capacities than lower level memories. Changes in the various levels of the cache hierarchy are managed (e.g., coordinated) by cache coherence policies.

[0119] Each core 1002 may be referred to as a CPU, DSP, GPU, etc., or any other type of hardware circuit. Each core 1002 includes a control unit circuit 1014, an arithmetic and logic (AL) circuit (sometimes referred to as an ALU) 1016, a plurality of registers 1018, a local memory 1020, and a second example bus 1022. Other structures may also exist. For example, each core 1002 may include a vector unit circuit, a single instruction multiple data (SIMD) unit circuit, a load / store unit (LSU) circuit, a branch / jump unit circuit, a floating-point unit (FPU) circuit, and the like. The control unit circuit 1014 includes a semiconductor-based circuit configured to control (e.g., coordinate) data movement within the corresponding core 1002. The AL circuit 1016 includes a semiconductor-based circuit configured to perform one or more mathematical and / or logical operations on data within the corresponding core 1002. Some examples of the AL circuit 1016 perform integer-based operations. In other examples, AL circuit 1016 also performs floating point operations. In other examples, AL circuit 1016 may include a first AL circuit that performs integer-based operations and a second AL circuit that performs floating point operations. In some examples, AL circuit 1016 may be referred to as an Arithmetic Logic Unit (ALU).

[0120] Registers 1018 are semiconductor-based structures for storing data and / or instructions, such as the results of one or more operations performed by the AL circuit 1016 of the corresponding core 1002. For example, registers 1018 may include vector register(s), SIMD register(s), general register(s), flag register(s), segment register(s), machine-specific register(s), instruction pointer register(s), control register(s), debug register(s), memory management register(s), machine check register(s), etc. Registers 1018 may include vector register(s), SIMD register(s), general register(s), flag register(s), segment register(s), machine-specific register(s), instruction pointer register(s), control register(s), debug register(s), memory management register(s), machine check register(s), etc. Fig.10 The registers 1018 are shown arranged as a bank group. Alternatively, the registers 1018 may be organized in any other arrangement, format, or structure, such as by being distributed throughout the core 1002 to reduce access time. The second bus 1022 may be implemented by at least one of an I2C bus, an SPI bus, a PCI bus, or a PCIe bus.

[0121] Each core 1002 and / or more generally the microprocessor 1000 may include additional and / or alternative structures to those shown and described above. For example, there may be one or more clock circuits, one or more power supplies, one or more power gates, one or more cache home agents (CHAs), one or more converged / common mesh stops (CMSs), one or more shifters (e.g., (one or more) barrel shifters), and / or other circuits. The microprocessor 1000 is a semiconductor device that is manufactured to include many interconnected transistors to implement the above-described structures in one or more integrated circuits (ICs) contained in one or more packages.

[0122] The microprocessor 1000 may include and / or cooperate with one or more accelerators (e.g., acceleration circuits, hardware accelerators, etc.). In some examples, the accelerator is implemented by logic circuits to perform certain tasks faster and / or more efficiently than a general-purpose processor. Examples of accelerators include ASICs and FPGAs, such as those discussed herein. GPUs, DSPs, and / or other programmable devices may also be accelerators. The accelerator may be on board the microprocessor 1000, in the same chip package as the microprocessor 1000, and / or in one or more packages separate from the microprocessor 1000.

[0123] Fig.11 yes Fig. 9 1 is a block diagram of another example implementation of a programmable circuit 912. In this example, the programmable circuit 912 is implemented by an FPGA circuit 1100. For example, the FPGA circuit 1100 can be implemented by an FPGA. For example, the FPGA circuit 1100 can be used to perform operations that would otherwise be performed by Fig.10 The example microprocessor 1000 of the embodiment of the present invention executes the operations performed by the corresponding machine-readable instructions. However, once configured, the FPGA circuit 1100 instantiates the operations and / or functions corresponding to the machine-readable instructions in hardware, thereby often performing the operations / functions faster than the execution speed of the corresponding software executed by a general-purpose microprocessor.

[0124] More specifically, Fig.10 The microprocessor 1000 (which is a general-purpose device that can be programmed to perform Figure 3-Figure 6 Compared to a flow chart (or flow charts) that represent part or all of the machine-readable instructions, but whose interconnections and logic circuits are fixed once they are manufactured, Fig.11 The example FPGA circuit 1100 includes interconnects and logic circuits that can be configured, constructed, programmed, and / or interconnected in different ways after manufacturing to instantiate, for example, Figure 3-Figure 6 The FPGA circuit 1100 may be thought of as an array of logic gates, interconnects, and switches. The switches may be programmed to change the way the logic gates are interconnected by the interconnects, effectively forming one or more dedicated logic circuits (unless and until the FPGA circuit 1100 is reprogrammed). The configured logic circuits enable the logic gates to cooperate in different ways to perform different operations on the data received by the input circuits. These operations may correspond to Figure 3-Figure 6 Thus, FPGA circuit 1100 may be configured and / or constructed to effectively communicate with Figure 3-Figure 6 Part or all of the operations / functions corresponding to the machine-readable instructions of the (one or more) flowcharts are instantiated as dedicated logic circuits to perform the operations / functions corresponding to these software instructions in a dedicated manner similar to ASIC. Figure 3-Figure 6 The speed at which some or all of the machine-readable instructions correspond to operations / functions may be faster than the speed at which a general-purpose microprocessor can execute those instructions.

[0125] exist Fig.11 In the example, the FPGA circuit 1100 is configured and / or constructed in response to being programmed (and / or reprogrammed one or more times) based on a binary file. In some examples, a binary file can be compiled and / or generated based on instructions in a hardware description language (HDL), such as Lucid, Very High Speed ​​Integrated Circuit (VHSIC) Hardware Description Language (VHSIC Hardware Description Language, VHDL), or Verilog. For example, a user (e.g., a human user, a machine user, etc.) can write code or a program corresponding to one or more operations / functions in HDL; the code / program can be translated into a low-level language as needed; and the code / program (e.g., code / program in a low-level language) can be converted into a binary file (e.g., by a compiler, a software application, etc.). In some examples, Fig.11 The FPGA circuit 1100 can access and / or load a binary file so that Fig.11The FPGA circuit 1100 is configured and / or constructed to perform one or more operations / functions. For example, a binary file can be obtained by a bitstream (e.g., one or more computer-readable bits, one or more machine-readable bits, etc.), data (e.g., computer-readable data, machine-readable data, etc.), and / or Fig.11 The FPGA circuit 1100 can be implemented by machine-readable instructions accessible to cause the Fig.11 Configuration and / or construction of FPGA circuit 1100 or (one or more) parts thereof.

[0126] In some examples, the binary file is compiled, generated, transformed, and / or otherwise output from a unified software platform utilized to program the FPGA. For example, the unified software platform may translate a first instruction (e.g., code or program) corresponding to one or more operations / functions in a high-level language (e.g., C, C++, Python, etc.) into a second instruction corresponding to the one or more operations / functions in an HDL. In some such examples, the binary file is compiled, generated, and / or otherwise output from the unified software platform based on the second instruction. In some examples, Fig.11 The FPGA circuit 1100 can access and / or load a binary file so that Fig.11 The FPGA circuit 1100 is configured and / or constructed to perform one or more operations / functions. For example, a binary file can be obtained by a bitstream (e.g., one or more computer-readable bits, one or more machine-readable bits, etc.), data (e.g., computer-readable data, machine-readable data, etc.), and / or Fig.11 The FPGA circuit 1100 can be implemented by machine-readable instructions accessible to cause the Fig.11 Configuration and / or construction of FPGA circuit 1100 or (one or more) parts thereof.

[0127] Fig.11The FPGA circuit 1100 includes an example input / output (I / O) circuit 1102 to obtain data from and / or output data to an example configuration circuit 1104 and / or external hardware 1106. For example, the configuration circuit 1104 can be implemented by an interface circuit that can obtain a binary file, which can be implemented by a bitstream, data, and / or machine-readable instructions to configure the FPGA circuit 1100, or (one or more) parts thereof. In some such examples, the configuration circuit 1104 can obtain the binary file from a user, a machine (e.g., a hardware circuit (e.g., a programmed or dedicated circuit) that can implement an Artificial Intelligence / Machine Learning (AI / ML) model to generate a binary file), etc. and / or any (one or more) combinations of these. In some examples, the external hardware 1106 can be implemented by an external hardware circuit. For example, the external hardware 1106 can be implemented by Fig.10 The microprocessor 1000 is implemented.

[0128] FPGA circuit 1100 also includes an array of example logic gate circuits 1108, a plurality of example configurable interconnects 1110, and example storage circuits 1112. Logic gate circuits 1108 and configurable interconnects 1110 may be configured to instantiate Figure 3-Figure 6 At least some of the machine-readable instructions correspond to one or more operations / functions, and / or other desired operations. Fig.11 The logic gate circuits 1108 shown in are made in blocks or groups. Each block includes semiconductor-based electrical structures that can be configured into logic circuits. In some examples, the electrical structure includes logic gates (e.g., AND gates, OR gates, NOR gates, etc.) that provide basic building blocks for logic circuits. There are electrically controllable switches (e.g., transistors) in each logic gate circuit 1108 so that the electrical structure and / or logic gates can be configured to form a circuit to perform the desired operation / function. The logic gate circuit 1108 may include other electrical structures, such as a look-up table (LUT), a register (e.g., a flip-flop or latch), a multiplexer, and the like.

[0129] The configurable interconnect 1110 of the illustrated example is a conductive path, trace, via, or the like, which may include an electrically controllable switch (e.g., a transistor) whose state can be changed by programming (e.g., using an HDL instruction language) to activate or deactivate one or more connections between one or more logic gate circuits 1108 to program the desired logic circuit.

[0130] The storage circuit 1112 of the illustrated example is configured to store (one or more) results of one or more operations performed by the corresponding logic gates. The storage circuit 1112 can be implemented by registers or the like. In the illustrated example, the storage circuit 1112 is distributed between the logic gate circuits 1108 to facilitate access and improve execution speed.

[0131] Fig.11 The example FPGA circuit 1100 also includes an example dedicated operation circuit 1114. In this example, the dedicated operation circuit 1114 includes a dedicated circuit 1116, which can be called to implement common functions to avoid the need to program these functions on site. Examples of such dedicated circuits 1116 include memory (e.g., DRAM) controller circuits, PCIe controller circuits, clock circuits, transceiver circuits, memories, and multiplier-accumulator circuits. Other types of dedicated circuits may also exist. In some examples, the FPGA circuit 1100 may also include an example general-purpose programmable circuit 1118, such as an example CPU 1120 and / or an example DSP 1122. Other general-purpose programmable circuits 1118 may exist additionally or alternatively, such as GPUs, XPUs, etc., which can be programmed to perform other operations.

[0132] Although Fig.10 and Fig.11 Pictured Fig. 9 Two example implementations of programmable circuit 912 are shown, but many other implementations are also contemplated. For example, an FPGA circuit may include an onboard CPU, such as Fig.10 One or more example CPUs 1120. Therefore, Fig. 9 The programmable circuit 912 may additionally be configured by combining at least Fig.10 An example microprocessor 1000 and Fig.11 In some such hybrid examples, Fig.10 One or more cores 1002 may execute Figure 3-Figure 6 a first portion of machine-readable instructions represented by the flowchart(s) to perform(s) a first operation / function(s), Fig.11 The FPGA circuit 1100 may be configured and / or constructed to perform with Figure 3-Figure 6 The ASIC may be configured and / or constructed to perform the second operation / function corresponding to the second portion of the machine-readable instructions represented by the flowchart of the embodiment of the present invention, and / or the ASIC may be configured and / or constructed to perform the second operation / function corresponding to the second portion of the machine-readable instructions represented by the flowchart of the present invention. Figure 3-Figure 6 The third portion of the machine-readable instructions represented by the flowchart corresponds to (one or more) third operations / functions.

[0133] It should be understood that Figure 2Some or all of the circuits may thus be instantiated at the same or different times. Fig.10 The same and / or different portions of the microprocessor 1000 may be programmed to execute portions of the machine-readable instructions at the same and / or different times. In some examples, Fig.11 The same and / or different portions of the FPGA circuit 1100 may be configured and / or constructed to perform operations / functions corresponding to portions of the machine-readable instructions at the same and / or different times.

[0134] In some examples, the code may be instantiated, for example, in one or more threads that execute simultaneously and / or serially. Figure 2 For example, Fig.10 The microprocessor 1000 can execute machine-readable instructions in one or more threads that execute simultaneously and / or serially. In some examples, Fig.11 The FPGA circuit 1100 can be configured and / or constructed to perform operations / functions simultaneously and / or serially. In addition, in some examples, Figure 2 Some or all of the circuitry may be Fig.10 The microprocessor 1000 is implemented within one or more virtual machines and / or containers.

[0135] In some examples, Fig. 9 The programmable circuit 912 may be in one or more packages. For example, Fig.10 The microprocessor 1000 and / or Fig.11 The FPGA circuit 1100 can be in one or more packages. In some examples, the XPU can be composed of Fig. 9 The XPU may be implemented by programmable circuitry 912, which may be in one or more packages. For example, the XPU may include a CPU in one package (e.g., Fig.10 Microprocessor 1000, Fig.11 CPU 1120, etc.), a DSP in another package (e.g., Fig.11 DSP 1122 in another package), a GPU in another package, and an FPGA in another package (e.g., Fig.11 FPGA circuit 1100).

[0136] exist Fig.12 A block diagram is shown in FIG. 1, which illustrates an example software distribution platform 1205 for distributing software such as Fig. 9The example software distribution platform 1205 may be implemented by any computer server, data facility, cloud service, etc. that is capable of storing software and transmitting it to other computing devices. The third party may be a customer of the entity that owns and / or operates the software distribution platform 1205. For example, the entity that owns and / or operates the software distribution platform 1205 may be a software (e.g., a hardware device owned and / or operated by a third party other than the owner and / or operator of the software distribution platform). Fig. 9 The third party may be a consumer, user, retailer, OEM, etc. who purchases and / or licenses the software for use and / or resale and / or sublicense. In the illustrated example, the software distribution platform 1205 includes one or more servers and one or more storage devices. The storage device stores the machine-readable instructions 932, which may correspond to the instructions described above. Figure 3-Figure 6 The example machine-readable instructions 932 of the example software distribution platform 1205 are provided. One or more servers of the example software distribution platform 1205 communicate with the example network 1210, which may correspond to any one or more of the Internet and / or any of the example networks described above. In some examples, as part of a commercial transaction, one or more servers respond to a request to transfer software to a requesting party. Payment for the delivery, sale, and / or license of the software may be processed by one or more servers of the software distribution platform and / or by a third-party payment entity. These servers enable purchasers and / or licensors to download machine-readable instructions 932 from the software distribution platform 1205. For example, Figure 3-Figure 6 Software corresponding to the example machine-readable instructions of the example programmable circuit platform 900 may be downloaded to the example programmable circuit platform 900, which is to execute the machine-readable instructions 932 to implement the firewall coordination circuit 130. In some examples, one or more servers of the software distribution platform 1205 periodically provide, transmit and / or force software updates (e.g., Fig. 9 Example machine readable instructions 932) to ensure that improvements, patches, updates, etc. are distributed and applied to the software at the end-user device. Although referred to as software above, the distributed "software" may also be firmware.

[0137] As will be appreciated from the foregoing, example systems, apparatus, articles, and methods have been disclosed that generate and manage firewall policies that can be deployed at the interconnect level of computing devices. The disclosed systems, apparatus, articles, and methods improve the efficiency of using computing devices by dynamically generating and managing firewall policies to ensure that network attacks are mitigated and that firewall policies are updated to address network attacks. The disclosed systems, apparatus, articles, and methods are therefore directed to one or more improvements in the operation of machines such as computers or other electronic and / or mechanical devices.

[0138] Disclosed herein are example methods, apparatus, systems, and articles of manufacture for generating and managing firewall policies that can be deployed at the interconnect level of computing devices. Further examples and combinations thereof include the following:

[0139] Example 1 includes an apparatus comprising an interface circuit, machine-readable instructions, and programmable circuitry for at least one of instantiating or executing the machine-readable instructions to determine whether an operation is allowed to pass between a first component on a system on a chip (SoC) and a second component on the SoC, detecting an interconnection between the first component on the SoC and the second component on the SoC, the interconnection filtering the operation based on the determination of whether the operation is allowed to pass between the first component and the second component, and sending a request to filter the operation based on the determination of whether the operation is allowed to pass between the first component and the second component.

[0140] Example 2 includes the apparatus of Example 1, wherein the operation is associated with an application, and the programmable circuit generates a firewall policy for the application based on a determination of whether the operation is allowed to pass between the first component and the second component.

[0141] Example 3 includes an apparatus as described in Example 2, wherein the programmable circuit trains a machine learning model based on performing the operations to generate a subsequent firewall policy.

[0142] Example 4 includes an apparatus as described in Example 3, wherein, to train the machine learning model, the programmable circuit analyzes previous iterations of the firewall policy to identify whether to restrict previously allowed operations from passing between the first component and the second component.

[0143] Example 5 includes the apparatus of Example 1, wherein the programmable circuit determines whether to allow the operation to pass based on at least one of an amount of available computing resources or a detection of an unauthorized operation.

[0144] Example 6 includes the apparatus of Example 1, wherein the first component is at least one of a first processor core or a first memory module, and the second component is at least one of a second processor core or a second memory module.

[0145] Example 7 includes the apparatus of Example 1, wherein the interconnect defines a communication path between the first component and the second component, and the programmable circuit determines whether the operation is to pass through the interconnect.

[0146] Example 8 includes a device comprising a first component, a second component, machine-readable instructions, and a programmable circuit for at least one of instantiating or executing the machine-readable instructions to retrieve a request for a filtering operation, the request indicating that the operation is allowed to pass between the first component and the second component, and performing a filtering action on the operation, the filtering action performing at least one of the following based on the request: preventing the operation from passing between the first component and the second component, or allowing the operation to pass between the first component and the second component.

[0147] Example 9 includes the apparatus of Example 8, wherein the programmable circuit analyzes the request to determine whether to block the operation.

[0148] Example 10 includes the apparatus of Example 8, further comprising an interconnect defining a communication path between the first component and the second component.

[0149] Example 11 includes the apparatus of Example 10, wherein the programmable circuit performs the filtering operation on the interconnect.

[0150] Example 12 includes the apparatus of Example 10, wherein the programmable circuit sends an indication representing at least one of a location or a number of interconnects.

[0151] Example 13 includes the apparatus of Example 8, wherein the first component is at least one of a first processor core or a first memory module, and the second component is at least one of a second processor core or a second memory module.

[0152] Example 14 includes a non-transitory machine-readable storage medium comprising instructions to cause a programmable circuit to perform at least the following operations: determine whether an operation is allowed to pass between a first component on a system on a chip (SoC) and a second component on the SoC, detect an interconnection between the first component on the SoC and the second component on the SoC, the interconnection filtering the operation based on the determination of whether the operation is allowed to pass between the first component and the second component, and sending a request to filter the operation based on the determination of whether the operation is allowed to pass between the first component and the second component.

[0153] Example 15 includes a non-transitory machine-readable storage medium as described in Example 14, wherein the operation is associated with an application, and wherein the instructions cause the programmable circuit to generate a firewall policy for the application based on a determination of whether the operation is allowed to pass between the first component and the second component.

[0154] Example 16 includes the non-transitory machine-readable storage medium of Example 15, wherein the instructions cause the programmable circuit to train a machine learning model based on performing the operations to generate a subsequent firewall policy.

[0155] Example 17 includes the non-transitory machine-readable storage medium of Example 16, wherein, to train the machine learning model, the instructions cause the programmable circuit to analyze previous iterations of the firewall policy to identify whether to restrict previously allowed operations from passing between the first component and the second component.

[0156] Example 18 includes the non-transitory machine-readable storage medium of Example 14, wherein the instructions cause the programmable circuit to determine whether to allow the operation to pass based on at least one of a quantity of available computing resources or a detection of an unauthorized operation.

[0157] Example 19 includes the non-transitory machine-readable storage medium of Example 14, wherein the first component is at least one of a first processor core or a first memory module, and the second component is at least one of a second processor core or a second memory module.

[0158] Example 20 includes the non-transitory machine-readable storage medium of Example 14, wherein the interconnect defines a communication path between the first component and the second component, and the programmable circuit determines whether the operation is to pass through the interconnect.

[0159] Example 21 includes a method comprising determining whether an operation is allowed to pass between a first component on a system on a chip (SoC) and a second component on the SoC, detecting an interconnection between the first component on the SoC and the second component on the SoC, filtering the operation based on the determination of whether the operation is allowed to pass between the first component and the second component, and sending a request to filter the operation based on the determination of whether the operation is allowed to pass between the first component and the second component.

[0160] Example 22 includes the method of Example 21, further comprising generating a firewall policy for an application associated with the operation based on a determination of whether the operation is allowed to pass between the first component and the second component.

[0161] Example 23 includes the method as described in Example 22, further comprising training a machine learning model to generate subsequent firewall policies based on performing the operations.

[0162] Example 24 includes the method of Example 23, further comprising analyzing a previous iteration of the firewall policy to identify whether to restrict previously allowed operations from passing between the first component and the second component.

[0163] Example 25 includes the method of Example 21, further comprising determining whether to allow the operation to pass based on at least one of an amount of available computing resources or a detection of an unauthorized operation.

[0164] Example 26 includes the method of Example 21, wherein the first component is at least one of a first processor core or a first memory module, and the second component is at least one of a second processor core or a second memory module.

[0165] Example 27 includes the method of Example 21, wherein the interconnect defines a communication path between the first component and the second component.

[0166] Example 28 includes a device comprising: a device for determining whether an operation is allowed to pass between a first component on a system on a chip (SoC) and a second component on the SoC, a device for detecting an interconnection between the first component on the SoC and the second component on the SoC, the interconnection filtering the operation based on the determination of whether the operation is allowed to pass between the first component and the second component, and a device for sending a request to filter the operation based on the determination of whether the operation is allowed to pass between the first component and the second component.

[0167] Example 29 includes the apparatus of Example 28, further comprising an apparatus for generating a firewall policy for an application associated with the operation based on a determination of whether the operation is allowed to pass between the first component and the second component.

[0168] Example 30 includes the apparatus of Example 29, further comprising an apparatus for training a machine learning model based on performing the operations to generate subsequent firewall policies.

[0169] Example 31 includes an apparatus as described in Example 30, wherein the means for training analyzes previous iterations of the firewall policy to identify whether to restrict previously allowed operations from passing between the first component and the second component.

[0170] Example 32 includes the apparatus of Example 28, wherein the means for determining determines whether to allow the operation to pass based on at least one of an amount of available computing resources or a detection of an unauthorized operation.

[0171] Example 33 includes the apparatus of Example 28, wherein the interconnect defines a communication path between the first component and the second component.

[0172] The attached claims are hereby incorporated into this Detailed Description section by this reference. Although certain example systems, devices, articles, and methods are disclosed herein, the scope of coverage of this patent is not limited thereto. On the contrary, this patent covers all systems, devices, articles, and methods that fairly fall within the scope of the claims of this patent.

Claims

1. A device comprising: Interface circuit; machine-readable instructions; as well as programmable circuitry for at least one of instantiating or executing the machine-readable instructions to: determining whether to allow an operation to pass between a first component on a system on a chip (SoC) and a second component on the SoC; detecting an interconnection between a first component on the SoC and a second component on the SoC; causing the interconnect to filter the operation based on a determination of whether the operation is allowed to pass between the first component and the second component; and Based on a determination of whether the operation is allowed to pass between the first component and the second component, a request to filter the operation is sent.

2. The device according to claim 1, wherein: The operation is associated with an application, and the programmable circuitry generates a firewall policy for the application based on a determination of whether the operation is allowed to pass between the first component and the second component.

3. A device as claimed in any preceding claim, wherein: The programmable circuit trains a machine learning model based on executing the operations to generate subsequent firewall policies.

4. The device as claimed in claim 3, wherein: To train the machine learning model, the programmable circuitry analyzes previous iterations of the firewall policy to identify whether to restrict previously allowed operations from passing between the first component and the second component.

5. A device as claimed in any preceding claim, wherein: The programmable circuitry determines whether to allow the operation to pass based on at least one of an amount of available computing resources or a detection of an unauthorized operation.

6. A device as claimed in any preceding claim, wherein: The first component is at least one of a first processor core or a first memory module, and the second component is at least one of a second processor core or a second memory module.

7. A device as claimed in any preceding claim, wherein: The interconnect defines a communication path between the first component and the second component, and the programmable circuit determines whether the operation is to pass through the interconnect.

8. An apparatus comprising: First component; a second component communicatively coupled to the first component via an interconnect; machine-readable instructions; as well as programmable circuitry for at least one of instantiating or executing the machine-readable instructions to: Retrieve a request for filtering an operation, the request indicating whether the operation is allowed to pass between the first component and the second component; and A filtering action is performed on the operation, the filtering action performing at least one of the following based on the request: blocking the operation from passing between the first component and the second component at the interconnect, or allowing the operation to pass between the first component and the second component at the interconnect.

9. The device of claim 8, wherein: The programmable circuitry analyzes the request to determine whether to prevent the operation.

10. An apparatus as claimed in any preceding claim, further comprising an interconnect defining a communication path between the first component and the second component.

11. The device of claim 10, wherein: The programmable circuit performs the filtering operation on the interconnect.

12. The device according to claim 10 or 11, wherein: The programmable circuit sends an indication representative of at least one of a location or a quantity of interconnections.

13. An apparatus as claimed in any preceding claim, wherein: The first component is at least one of a first processor core or a first memory module, and the second component is at least one of a second processor core or a second memory module.

14. A machine-readable storage medium comprising instructions to cause a programmable circuit to at least: determining whether to allow an operation to pass between a first component on a system on a chip (SoC) and a second component on the SoC; detecting an interconnection between a first component on the SoC and a second component on the SoC; causing the interconnect to filter the operation based on a determination of whether the operation is allowed to pass between the first component and the second component; and Based on a determination of whether the operation is allowed to pass between the first component and the second component, a request to filter the operation is sent.

15. The machine-readable storage medium of claim 14, wherein: The operation is associated with an application, wherein the instructions cause the programmable circuitry to generate a firewall policy for the application based on a determination of whether the operation is allowed to pass between the first component and the second component.

16. A machine-readable storage medium as claimed in any preceding claim, wherein: The instructions cause the programmable circuit to train a machine learning model based on performing the operations to generate a subsequent firewall policy.

17. The machine-readable storage medium of claim 16, wherein: To train the machine learning model, the instructions cause the programmable circuit to analyze previous iterations of the firewall policy to identify whether to restrict previously allowed operations from passing between the first component and the second component.

18. A machine-readable storage medium as claimed in any preceding claim, wherein: The instructions cause the programmable circuit to determine whether to allow the operation to pass based on at least one of an amount of available computing resources or a detection of an unauthorized operation.

19. A machine-readable storage medium as claimed in any preceding claim, wherein: The first component is at least one of a first processor core or a first memory module, and the second component is at least one of a second processor core or a second memory module.

20. A machine-readable storage medium as claimed in any preceding claim, wherein: The interconnect defines a communication path between the first component and the second component, and the programmable circuit determines whether the operation is to pass through the interconnect.

21. A method comprising: determining whether to allow an operation to pass between a first component on a system on a chip (SoC) and a second component on the SoC; detecting an interconnection between a first component on the SoC and a second component on the SoC; causing the interconnect to filter the operation based on a determination of whether to allow the operation to pass between the first component and the second component; and Based on a determination of whether the operation is allowed to pass between the first component and the second component, a request to filter the operation is sent.

22. The method of claim 21, further comprising: A firewall policy is generated for an application associated with the operation based on a determination of whether the operation is allowed to pass between the first component and the second component.

23. The method of any preceding claim, further comprising: A machine learning model is trained based on performing the operations to generate subsequent firewall policies.

24. The method of claim 23, further comprising: A previous iteration of the firewall policy is analyzed to identify whether a previously allowed operation is restricted from passing between the first component and the second component.

25. The method of any preceding claim, further comprising: A determination is made whether to allow the operation to pass based on at least one of an amount of available computing resources or a detection of an unauthorized operation.

Images