System-on-Chip DMA Controllers with Hardware Routing by Security Level
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional direct memory access controllers in systems-on-chip require complex programming and reconfiguration, leading to performance degradation due to interrupts and security vulnerabilities from unauthorized access.
Innovation Solution
A system-on-chip design with separate direct memory access controllers for secure and non-secure levels, managed by a hardware routing circuit that autonomously routes requests based on peripheral access rights, eliminating the need for dynamic reconfiguration by secure software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a single direct memory access controller is used with programmable access rights for each channel, then the controller can be configured for different devices, but the system requires complex programming and reconfiguration by secure software which degrades performance
Solution Approach 1:
The patent divides the direct memory access controller into multiple independent controllers, each dedicated to a specific security domain (secure, non-secure, or mixed). This segmentation eliminates the need for dynamic reconfiguration while maintaining adaptability, as each controller is pre-configured for its specific domain's access requirements.
Solution Approach 2:
The routing circuit automatically routes DMA requests to the appropriate controller based on the request's security attributes without requiring secure software intervention. This self-service mechanism eliminates performance-degrading interrupts and reconfiguration operations while maintaining proper access control.
2Adaptability or versatility
If secure software dynamically assigns channels and reconfigures the DMA controller based on active devices, then the controller can adapt to different application needs, but this systematic reconfiguration generates interrupts and degrades system performance
Solution Approach 1:
The system performs channel assignment and controller configuration in advance during system initialization or device reset, rather than dynamically during operation. Each controller is pre-configured with the appropriate access rights for its security domain, eliminating the need for time-critical reconfiguration operations that would generate interrupts.
Solution Approach 2:
The routing circuit provides automatic, interrupt-free routing of DMA requests to the appropriate pre-configured controller based on security attributes in the request itself, eliminating the need for secure software to respond to interrupts for channel assignment.
3Adaptability or versatility
If the DMA controller access level is defined by the requesting device's access level, then the system can handle both secure and non-secure requests, but unauthorized devices could potentially access secure memory regions if the controller is in an unsecure state
Solution Approach 1:
The patent segments the DMA controller into multiple independent controllers, each with a fixed security level matching its target domain. This prevents unauthorized access because a non-secure controller cannot access secure memory regions, and a secure controller cannot be compromised by non-secure devices, eliminating the security vulnerability while maintaining request handling capability.
Solution Approach 2:
The routing circuit acts as an intermediary that inspects the security attributes of each DMA request and routes it to the appropriate controller based on those attributes. This intermediary layer ensures that only authorized controllers receive requests from devices with matching security levels, preventing unauthorized access while allowing legitimate requests to proceed.
Data Source
Figure 1
Figure 2
AI summary
The system-on-chip (SYS) includes a memory circuit (CT_MEM) comprising memory regions (MEM_S, MEM_NS), and a direct memory access circuit (CT_DMA) capable of generating direct memory accesses (DMA_S, DMA_NS). The direct memory access circuit (CT_DMA) includes at least one first direct memory access controller (CTRL_S) having the first level of access rights and at least one second direct memory access controller (CTRL_NS) having the second level of access rights. The system-on-chip (SYS) includes a routing circuit (CT_RTG) configured to physically couple a first device (PER_S) having the first level of access rights with said at least one first controller (CTRL_S) and to physically couple a second device (PER_NS) having the second level of access rights with said at least one second controller (CTRL_NS).