Inter-Bus Bridge Circuit for Secure Protocol Translation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Compatibility issues arise when connecting buses that implement different protocols, such as the Advanced eXtensible Interface (AXI) and Peripheral Component Interconnect express (PCIe), due to differences in security mechanisms and address spaces, leading to challenges in managing secure and non-secure resource access.
Innovation Solution
A bridge circuit that stores address translation information and security indicators, rejecting non-secure access requests to secure address ranges and translating requests between buses while enforcing security mechanisms by using address range maps to ensure secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If buses with different protocols (AXI and PCIe) are connected directly, then communication between diverse devices is enabled, but security compatibility issues arise due to different security mechanisms
Solution Approach 1:
The patent introduces a bridge device as an intermediary between AXI and PCIe buses. This bridge includes an AXI interface coupled to an AXI bus and a PCIe interface coupled to a PCIe bus, with translation logic that mediates security requirements between the two protocols. The bridge translates AXI security attributes (SECURE/NON-SECURE) into PCIe security handling, preventing direct connection security conflicts while enabling protocol compatibility.
Solution Approach 2:
The patent changes security parameter representation between protocols. The AXI protocol uses explicit SECURE/NON-SECURE attributes in its address and control signals, while PCIe uses different security mechanisms. The bridge translates these security parameters by examining AXI security attributes and generating corresponding PCIe transactions with appropriate security handling, effectively changing the security parameter format to match the target protocol's requirements.
2Ease of operation
If address translation is implemented to map between different address spaces, then device accessibility is improved, but security enforcement complexity increases
Solution Approach 1:
The patent segments the address space into secure and non-secure regions using address translation tables. The translation logic divides the combined address space into distinct segments, each with specific security attributes. This segmentation allows simple access control decisions (secure vs. non-secure) while maintaining complex address mapping capabilities, reducing the overall enforcement complexity.
Solution Approach 2:
The patent performs preliminary security classification during address translation setup. Security attributes are predetermined and stored in translation tables before actual access occurs. When a translation request is made, the security status is already known from the pre-configured table entries, eliminating the need for complex real-time security analysis and simplifying enforcement to a simple table lookup and attribute propagation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Approaches for bridging communication between first and second buses are disclosed. Address translation information and associated security indicators are stored (202) in a memory. Each access request from the first bus includes a first requester security indicator and a requested address. Each access request from the first bus and directed to the second bus is either rejected (214), or translated (210) and communicated (212) to the second bus, based on the requester security indicator and the security indicator associated with the address translation information for the requested address. Each access request from the second bus to the first bus includes the requested address, and the access request is translated (226) and communicated (228) to the first bus along with the security indicator that is associated with the address translation information for the requested address.