SoC Control Point Isolation Barriers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security architectures for system-on-chip (SoC) information handling systems face challenges in providing effective protection and isolation against malicious attacks, particularly due to vulnerabilities in privilege-based isolation schemes and dedicated secure enclave subsystems, which can be compromised by privilege-escalation attacks and lack dynamic runtime control.
Innovation Solution
A dynamic runtime isolation architecture is implemented using a separate SoC control point entity that creates programmable isolation barriers around each execution domain through a two-way control channel, independent from execution domain processors and software, allowing for dynamic reconfiguration and protection without relying on privilege modes or bus master device IDs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If privilege-based isolation schemes are used to protect processing subsystems, then isolation between software entities is provided, but the isolation can be compromised by privilege-escalation attacks
Solution Approach 1:
The patent introduces a dedicated secure enclave subsystem as an intermediary between the CPU and system resources. This enclave acts as a mediator that enforces isolation policies independently of CPU privilege levels, preventing privilege-escalation attacks from compromising isolation security. The enclave intercepts and filters transactions between processing subsystems, providing a layer of protection that cannot be bypassed by software running at any privilege level.
Solution Approach 2:
The system is segmented into distinct isolation domains managed by the secure enclave subsystem. Each processing subsystem is assigned to an isolation domain with defined access policies. This segmentation allows the system to provide fine-grained isolation control where the enclave can enforce domain boundaries independently of CPU privilege mechanisms, resolving the contradiction between providing isolation and preventing privilege escalation vulnerabilities.
2Reliability
If dedicated secure enclave subsystems are used to provide boot control point and address space control, then secure boot operation is achieved, but dynamic runtime isolation control is not provided
Solution Approach 1:
The secure enclave subsystem implements dynamic runtime control by allowing modification of isolation policies and address space configurations during system operation. The enclave can respond to runtime events, update access control lists, and reconfigure isolation barriers without requiring system reboot. This dynamic capability enables the system to adapt isolation policies based on runtime conditions while maintaining secure boot operation, resolving the contradiction between secure boot and runtime adaptability.
3Reliability
If address space control mechanisms with bus master device ID are used, then isolation barriers are constructed around address space targets, but the number of CPU domains is limited and interconnect infrastructure is unprotected
Solution Approach 1:
The patent extends isolation control from the address space dimension to the transaction dimension by implementing filtering at the interconnect level. The secure enclave subsystem intercepts transactions on the system interconnect and enforces isolation policies based on transaction attributes rather than just address space. This additional dimension of control allows the system to protect the interconnect infrastructure itself and support unlimited CPU domains without re-engineering the interconnect hardware, as the enclave software can dynamically configure filtering rules.
Data Source
AI summary
A method and apparatus are disclosed for a multi-processor SoC which includes an execution domain processor for running an execution domain; a control point processor that is physically and programmatically independent from the execution domain processor and configured to generate control data for controlling access by the execution domain to one or more SoC resources by identifying at least a first SoC resource that the execution domain is allowed to access; and an access control circuit connected between the execution domain and the SoC resources and including a programmable front end which is connected to receive the control data from the control point processor, and a signals-based back end which is configured to provide a dynamic runtime isolation barrier in response to the control data, thereby controlling access to the one or more system-on-chip resources by the execution domain.