Centralized Bus Filter for Secure IC Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing bus systems for integrated-circuit devices lack efficient and flexible implementation of security filtering, especially in systems with multiple bus masters, leading to inefficient duplication of filtering logic and limited ability to discriminate between different master components.
Innovation Solution
Implementing bus filtering at an interception point within the bus system, rather than only at the edges, allows for a single filter unit to intercept requests from multiple master components and apply distinct filtering rules based on the initiating master, reducing duplication and enhancing efficiency and flexibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If filtering is implemented at each master component edge, then security coverage is comprehensive, but filtering logic is duplicated across multiple components reducing efficiency
Solution Approach 1:
The patent consolidates filtering logic into a single centralized filter unit that serves multiple master components. Instead of each master component having its own filter, the invention merges the filtering function into one shared resource that all masters access, eliminating duplication while maintaining comprehensive security coverage.
Solution Approach 2:
The centralized filter unit is designed to handle filtering requests from multiple different master components through a universal interface. It can identify which master is making the request and apply appropriate filtering rules, making the filter unit multi-functional rather than dedicated to a single master.
2Adaptability or versatility
If filtering logic is duplicated at each master component, then each master has independent security control, but resource utilization is inefficient
Solution Approach 1:
The invention merges multiple instances of filtering logic into a single shared filter unit, reducing the quantity of filtering resources from N copies (one per master) to one copy that serves all masters.
Solution Approach 2:
The centralized filter unit acts as an intermediary between multiple master components and the bus system. It receives requests from any master, applies the appropriate filtering rules, and forwards authorized requests, eliminating the need for each master to have its own filtering capability.
3Reliability
If filtering is performed at slave component edges, then slave security is enforced, but timing paths are longer delaying transaction completion
Solution Approach 1:
The filter unit is positioned to intercept bus transactions early in the transaction path, before they reach the slave components. By performing filtering action preliminarily at this intermediate point, unauthorized transactions are rejected before traversing the entire path to slaves, shortening the effective timing path for both authorized and unauthorized transactions.
4Reliability
If existing filtering approaches are used, then basic security is provided, but flexibility to discriminate between different masters is limited
Solution Approach 1:
The filter unit implements different filtering rules for different master components, applying local quality to the filtering process. Each master can have its own set of permissions and restrictions, allowing the system to discriminate between masters while using a single shared filter unit.
Solution Approach 2:
The filtering system is designed to dynamically adapt to different master components based on identification information in the transaction. The filter unit can change its behavior and applied rules depending on which master is making the request, providing flexibility without requiring static dedicated filters for each master.
Data Source
Figure 1
Figure 2
AI summary
An integrated-circuit device (1) includes a bus system (2), a plurality of master components (4, 6), a plurality of slave components (12, 14, 16, 17), and hardware filter logic (24, 26). The bus system (2) is configured to carry bus transactions and security-state signals for distinguishing between secure and non-secure transactions. The master components (4, 6) are switchable between a secure and a non-secure state. The hardware filter logic (24, 26) is configured to intercept bus transactions at an interception point, positioned within the bus system (2) such that bus transactions from at least two of the master components (4, 6) and at least two slave components (12, 14, 16, 17) pass the interception point. It is also configured to use i) a slave address of the intercepted bus transaction, and ii) the security state of the intercepted bus transaction, to determine whether to allow the transaction, in accordance with a set of filtering rules, and to block intercepted bus transaction that are determined not to be allowed.