Register Access Locking by Operating Mode and Data Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Integrated circuits (ICs) face challenges in securing internal storage, such as register values, against attacks from external devices and compromised internal firmware or microcode, which can lead to unauthorized access and compromise security measures.
Innovation Solution
The ICs implement a dynamic lock mechanism based on operating mode and data values, using a bus interface controller, state controller, access control manager, and data screener to manage register access, allowing or denying access based on valid or invalid data sets for the current operating mode.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional static access control is used for registers, then device complexity is reduced, but security against compromised firmware and external attacks is insufficient
Solution Approach 1:
The patent implements dynamic access control where lock status changes based on operating mode and data validity. The access control manager dynamically asserts or de-asserts locks on register addresses depending on the current mode and whether the data matches expected values, transforming static register protection into a dynamic, context-aware security mechanism.
Solution Approach 2:
The system changes security parameters (lock status) based on mode parameters and data parameters. When the mode changes or when data validity is reassessed, the access control parameters are updated accordingly, allowing the same register to have different access permissions under different conditions.
2Reliability
If dynamic lock mechanism with mode and data validation is implemented, then security against attacks is improved, but device complexity increases
Solution Approach 1:
The access control functionality is segmented into distinct components: a state controller for managing modes, an access control manager for lock decisions, and a data screener for validation. This segmentation allows each component to perform its specific function efficiently while working together to provide comprehensive security.
Solution Approach 2:
The access control manager acts as an intermediary between the bus interface controller and the registers. It intercepts access requests, evaluates them against current mode and data validity, and decides whether to permit or block access, thereby adding security without requiring changes to the fundamental bus interface or register structure.
3Reliability
If access control checks are performed for every register operation, then security is enhanced, but operation speed decreases
Solution Approach 1:
The system performs preliminary validation by maintaining state information about current mode and data validity. Rather than performing full validation checks on every single access, the preliminary establishment of trust states allows for faster subsequent accesses within the same valid context, while still providing security through periodic re-validation.
Data Source
AI summary
An integrated circuit (IC), including multiple registers and functional units for performing operations of the integrated circuit, provides security of register accesses. A bus interface controller coupled to the registers provides read/write access from bus interface. The IC includes a state controller for managing multiple operational modes, and an access control manager coupled to the state controller and the bus interface controller that asserts a dynamic lock over the accesses to the registers according to a selected operating mode and one or more protected addresses of the addressable register space corresponding to the current operating mode. A data screener compares data associated with the read or write accesses to sets of valid or invalid data values for the current operating mode and the protected addresses, and the access control manager permits or denies the read or write accesses in conformity with a result of the comparison.