Memory Controller Security Filtering During SoC Boot
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional firewalls in system-on-chip (SoC) do not adequately limit access to external memory based on the evolving security level during the boot process, potentially allowing unauthorized access to protected memory regions.
Innovation Solution
A memory controller with integrated verification means that stores transaction information in a control register and conditions access based on a list of special transactions, adapting to the evolving SoC security level to block unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional firewalls are used to filter access contexts and memory regions, then runtime protection is provided, but access cannot be limited based on the evolving system-on-chip security level during boot process
Solution Approach 1:
The patent implements dynamic security level filtering by making the memory controller's verification means responsive to changing security levels during the boot process. The controller automatically adjusts its filtering behavior based on the current security level, transitioning from permissive early-boot access to restrictive late-boot access, thereby resolving the contradiction between providing runtime protection and adapting to evolving security requirements.
Solution Approach 2:
The patent changes the security parameter (security level) as a dynamic variable that modifies the behavior of the memory controller during boot. By linking memory access permissions to the evolving security level parameter, the system achieves both reliable protection and adaptability to different boot stages without requiring separate firewall configurations for each security level.
2Reliability
If firewalls filter access contexts and memory regions, then runtime protection is provided, but unauthorized access to protected memory regions during boot process cannot be prevented
Solution Approach 1:
The patent merges the security verification function directly into the memory controller by integrating comparison means that operate in parallel with the existing firewall mechanism. This consolidation allows the system to enforce security level-based restrictions without adding separate verification hardware or complex multi-layer filtering logic, thereby achieving enhanced protection while minimizing additional complexity.
Solution Approach 2:
The patent introduces a security level parameter as an intermediary that mediates between the transaction context and the memory access decision. The comparison means use this intermediary parameter to determine whether to allow or block access, simplifying the verification logic while providing comprehensive security checks across all boot stages without requiring complex direct evaluation of all access parameters.
3Reliability
If memory access is restricted based on security level during boot, then security is enhanced, but access control flexibility is reduced
Solution Approach 1:
The patent implements self-service security enforcement by configuring the memory controller to automatically compare transaction security levels against required security levels without external intervention. The controller autonomously blocks or permits access based on this comparison, eliminating the need for manual security policy configuration or external verification logic, thereby maintaining strict security enforcement while simplifying operational control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The system-on-chip (SoC) includes a memory controller (CNTMEM) adapted to receive transactions (TR1, TR2) containing transaction information (TINF) defining access to a memory (MEM). The memory controller (CNTMEM) is configured to store the transaction information in a control register (REG) and to control access to the memory (MEM) from the contents of said control register (REG). The memory controller (CNTMEM) includes verification means (CMP) configured to condition memory access based on a comparison between the transaction information stored in the control register (REG) and a list of special information (LST) defining special transactions.