Hierarchical SoC Partitioning for Security Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In safety and security critical deployments, existing embedded processor subsystems allow hypervisors to access all hardware resources, which can lead to unsafe conditions or security flaws due to potential bugs or nefarious access.

Innovation Solution

A system on a chip (SoC) is partitioned into a hierarchy with three levels, where a trusted operating system manages all levels, a safety critical hypervisor manages the second and third levels but not the first, and a non-safety critical hypervisor manages only the third level, ensuring isolation and access control.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a hypervisor is permitted to access all hardware resources in an embedded processor, then resource management flexibility and control are improved, but safety and security reliability deteriorate due to potential bugs or nefarious access

Engineering Contradiction:

Improveresource management flexibilityVSAvoidsafety and security reliability

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent divides the hardware resources into multiple security domains (secure domain and non-secure domain) and partitions memory into separate regions (first memory region accessible only by secure software, second memory region accessible by both). This segmentation prevents the hypervisor from accessing all resources, thereby maintaining safety and security reliability while still allowing flexible resource management within each domain.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a memory management unit (MMU) as an intermediary component that enforces access control policies. The MMU intercepts and controls all memory access requests, determining whether a given software component (including the hypervisor) is authorized to access specific memory regions. This intermediary mechanism ensures that even if the hypervisor has broad management capabilities, it cannot access restricted resources, thus resolving the contradiction between flexibility and reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If certain resources are made inaccessible to the hypervisor for safety or security reasons, then safety and security reliability are improved, but resource management capability deteriorates

Engineering Contradiction:

Improvesafety and security reliabilityVSAvoidresource management capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent designs the memory management unit (MMU) with multi-functional capabilities to handle different access control scenarios. The MMU can enforce various access policies for different memory regions, support multiple security domains, and provide both isolation and shared access functionalities. This universal component enables the system to maintain comprehensive resource management capability while ensuring that critical resources remain protected from hypervisor access.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12235950B2Hierarchical hardware-software partitioning and configuration

Publication Date: 2025.02.25 XILINX INC

AI summary

Embodiments herein describe partitioning hardware and software in a system on a chip (SoC) into a hierarchy. In one embodiment, the hierarchy includes three levels of hardware-software configurations, enabling security and/or safety isolation across those three levels. The levels can cover the processor subsystem with compute, memory, acceleration, and peripheral resources shared or divided across those three levels.