Security Filter for Bus Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In secure systems like pay-television systems, the conversion of data access request signals between different buses often results in the loss of origin information, making it impossible to restrict access based on the initiator's security level and the data source or destination's privilege level.
Innovation Solution
A security filter is implemented on the data pathway to selectively block or allow data access commands by comparing the initiator and data source/destination identifications with predefined secure and unprivileged lists, ensuring that only authorized access occurs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data access request signals are converted between different buses, then data transfer compatibility is improved, but origin information is lost making access restriction impossible
Solution Approach 1:
A security filter is introduced as an intermediary component between the bus converter and the data source/destination. This filter receives the converted data access request signals, extracts origin information from them, and uses this information to determine whether to allow or block the access. The intermediary preserves the compatibility benefit of bus conversion while recovering and utilizing the origin information that would otherwise be lost.
2Reliability
If security filtering is implemented to restrict data access, then system security is improved, but device complexity increases
Solution Approach 1:
The security filter is designed as a segmented structure with distinct functional units: an origin information extraction unit that separates origin data from the access request signals, and an access determination unit that independently evaluates security based on extracted information. This segmentation allows the security function to be added without significantly increasing overall system complexity, as each segment performs a specific, well-defined task.
3Reliability
If all data access requests are monitored and restricted, then unauthorized access is prevented, but processing time increases
Solution Approach 1:
The security filter implements partial action by not monitoring all data access requests with the same level of scrutiny. Instead, it extracts origin information and applies access determination rules selectively based on the type of request and the origin source. This approach maintains high security for critical accesses while allowing faster processing for routine or trusted accesses, thereby reducing overall processing time while maintaining access control accuracy.
Data Source
AI summary
A filter is arranged to selectively block or allow a data access command from an initiator according to whether the initiator is secure or insecure and whether a data source or destination being accessed is privileged or unprivileged. The data access command contains an identification of the initiator from which the data access command originated and an identification of the data source or destination being accessed. The security filter compares the initiator identification and data source or destination identification contained within the data access command with a list of those initiators defined as secure and a list of those data sources or destinations which are defined as unprivileged. The filter then blocks or allows the data access command signal according to a set of rules.