Embedded Controller Access Control Through Secure Channels

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The communication interface between the main processor and the embedded controller in information handling systems lacks security features, particularly in accessing sensitive data, with no control mechanism for data access.

Innovation Solution

Implementing encryption of data through the communication channel between the embedded controller and the main processor, along with an access control mechanism to secure sensitive data, using a secure tunnel and cryptographic key exchange methods.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If encryption and access control mechanisms are implemented, then security is improved, but device complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoiddevice complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a secure channel as an intermediary layer between the processor and embedded controller. This secure channel handles all cryptographic operations and access control validations centrally, allowing the embedded controller to maintain simple hardware architecture while achieving secure communication through the intermediary security framework.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The access control functionality is segmented into distinct components: a secure channel for encrypted communication, an access control table for permission management, and validation logic that determines resource access rights. This segmentation allows each component to be optimized independently and simplifies the overall system by distributing security functions across dedicated modules rather than embedding them throughout the entire system.

Inventive Principle:

Principle #1Segmentation

2Reliability

If a secure channel is established for communication, then data security is improved, but communication overhead increases

Engineering Contradiction:

Improvedata securityVSAvoidcommunication overhead

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent performs preliminary actions by establishing a secure channel and validating access rights before actual data communication occurs. The access control table is pre-configured with permission rules, and the secure channel is set up with cryptographic keys in advance. This preliminary setup eliminates the need for repeated security validations during each communication transaction, reducing overall communication overhead.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements a feedback mechanism where the embedded controller validates access rights and returns authorization status to the processor. This feedback loop allows the system to quickly determine whether access should be granted without attempting to transfer data, thereby reducing communication time for unauthorized access attempts and optimizing overall communication efficiency.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12362919B2Enforcing access control for embedded controller resources and interfaces

Publication Date: 2025.07.15 DELL PROD LP

AI summary

An information handling system may establish a secure channel between an embedded controller and a processor, and request access to a resource of the embedded controller through the secured channel. The system may also receive a response to the request via the secure channel, wherein the response is based on the embedded controller validating whether the processor has a right to access the resource.