SoC Trace Probe Isolation With Cohort-Based Debug Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing debug systems for Systems-on-Chip (SoC) face challenges in balancing observability during trace-based debugging with security, as they can be exploited as backdoors for attacks and fail to provide flexible security features adaptable to different SoC architectures and changes in design, particularly in zonal architectures requiring virtualization.
Innovation Solution
Implementing a software-based firewall at each interconnect trace probe with cohort identification (CID) filtering and a secure trace enable multiplexer to selectively enable packet access based on cohort identification, ensuring only authorized data is traced over the interconnect.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If debug instruments are added to observe internal signals and register values, then observability during trace-based debugging is improved, but security of the SoC deteriorates as debug instruments can be used as backdoors for attacks
Solution Approach 1:
The debug infrastructure is segmented into isolated debug domains, each with its own debug instruments and trace buffers. This segmentation prevents a single debug instrument from accessing all internal signals, thereby maintaining security while preserving observability within each domain.
Solution Approach 2:
A security management module acts as an intermediary between debug instruments and SoC resources. This intermediary enforces access policies, controls which debug instruments can observe which signals, and prevents unauthorized access to sensitive data, thus resolving the security-observability contradiction.
2Reliability
If fixed configuration register values are used to tag each asset with owner identification, then security enforcement is improved, but adaptability to different SoC architectures and design changes deteriorates
Solution Approach 1:
The security configuration is made dynamic through runtime policy loading and reconfiguration capabilities. Instead of fixed compile-time configurations, the system can load security policies at runtime and adapt to different SoC architectures and design changes, maintaining both security enforcement and adaptability.
Solution Approach 2:
Security parameters such as owner identification values, access permissions, and domain boundaries are stored as configurable parameters rather than fixed hardware values. This allows the security system to be reconfigured for different SoC architectures and design iterations without requiring hardware changes.
3Object-affected harmful factors
If debug infrastructure is permanently disabled after silicon validation, then security is improved, but ability to provide trace protection throughout the SoC life cycle deteriorates
Solution Approach 1:
The debug infrastructure is enabled periodically or conditionally based on operational context rather than being permanently disabled. Security policies can dynamically enable or disable specific debug instruments based on runtime conditions, allowing trace protection to persist throughout the SoC life cycle while maintaining security when debugging is not needed.
4Reliability
If fixed debug systems are used to balance security and observability, then security during debugging is improved, but flexibility to specify security features for all access use cases deteriorates
Solution Approach 1:
The security management module provides universal security enforcement across multiple access use cases and debug instrument types. A single policy framework handles various security requirements (trace filtering, domain isolation, access control) uniformly, providing both security during debugging and flexibility for different access scenarios.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An apparatus and method are disclosed for a System on Chip (SoC) which includes a central interconnect fabric connected between a plurality of initiators and targets, where the central interconnect includes one or more debug trace probes for connection to a debugger, where each debug trace probe is connected with debug firewall control logic configured to allow a data trace packet from a first cohort to be traced out to the debug trace probe only if the data trace packet includes a CID value associated with the first cohort that matches a CCID value associated with a configuring cohort which configures the debug trace probe, and where the debug firewall control logic includes a secure trace enable multiplexer connected to packet capture control logic which is configured to output a packet capture enable signal indicating whether the data trace packet is a secure packet or unsecure packet.