Thread-Aware Slave Protection for Multi-Threaded Bus Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory protection mechanisms in RISC-V based System-On-Chips (SoCs) fail to filter access requests at a thread level, allowing malicious threads to access sensitive data despite being executed by trusted CPUs, due to the lack of thread-specific identification in existing protection systems.
Innovation Solution
A data processing system that includes a bus interconnect structure with slave protection units that verify both the master device and thread identifiers in access requests, granting or denying access based on both identities to ensure thread-level filtering and protect sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control is implemented at master device level by PMP, then memory protection is provided for regulated CPU cores, but untrusted master devices without PMP can still access protected data
Solution Approach 1:
The patent introduces a slave protection unit as an intermediary component between the bus slave device and master devices. This intermediary unit filters access requests based on master device identity, allowing regulated CPU cores to access protected data while blocking untrusted master devices. The slave protection unit acts as a mediator that enforces security policies without requiring modification to master devices.
2Object-affected harmful factors
If IOPMP filters access requests based on master device ID, then untrusted master devices are blocked, but thread-level differentiation is lost
Solution Approach 1:
The patent segments the access control mechanism into two independent filtering stages: master device-level filtering (identifying trusted vs untrusted devices) and thread-level filtering (identifying specific threads within a master device). This segmentation allows the system to first block untrusted master devices and then provide fine-grained control over thread-level access, resolving the contradiction between blocking harmful access and enabling thread differentiation.
Solution Approach 2:
The patent adds another dimension to access control by introducing thread identifier filtering as a separate layer above master device filtering. This dimensional extension allows the system to differentiate between threads within the same master device, enabling thread-level security policies without compromising the ability to block untrusted master devices at the higher dimension.
3Object-affected harmful factors
If thread-level filtering is implemented, then malicious threads can be blocked, but access control complexity increases
Solution Approach 1:
The slave protection unit serves as an intermediary that handles thread-level filtering, allowing the CPU to focus on execution while the protection unit manages access control complexity. This intermediary approach distributes the complexity of thread identification and filtering away from the CPU core, reducing the overall system complexity burden on critical components.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to a data processing system (10) comprising : - a bus interconnect structure (13), - a slave device (12) coupled to the bus interconnect structure, - a slave protection unit (15) coupled to the bus interconnect structure, - a plurality of master devices (11) coupled to the bus interconnect structure, each master device of said plurality of master devices having a master identifier, wherein : - a master device (11) is configured to run concurrently different threads, and, when a thread run by said master device requests access to said slave device, for issuing on the bus interconnect structure an access request comprising its master identifier and a thread identifier assigned to said thread, - the slave protection unit (15) is configured to grant said thread access to the slave device through the bus interconnect structure after verifying that the master device issuing the request is allowed to access said slave device based on the master identifier of said master device and that the thread is allowed to access said slave device based on the thread identifier of said thread.