Virtualized Hardware Accelerator Isolation for Secure IPC Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Embedded computing systems are susceptible to security threats and system failures that can compromise safety-critical applications, such as advanced driver assistance systems, due to malicious access and lack of isolation between hardware accelerators.
Innovation Solution
A trusted and sandboxed communication interface is implemented between HWA thread users and domain specific HWAs, managed by a multi-HWA function controller, which filters and schedules message requests, classifies them based on HWA capabilities, and provides privileged credential information to prevent security intrusions and failures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If HWA thread users are allowed to communicate directly with domain specific HWAs, then communication efficiency is improved, but security vulnerabilities increase due to lack of isolation and authentication
Solution Approach 1:
The patent introduces a trusted communication interface that acts as an intermediary between HWA thread users and domain specific HWAs. This interface includes a buffer for storing message requests and credential information, authentication logic for verifying privileges, and controlled forwarding mechanisms. The intermediary maintains security while enabling efficient communication by offloading authentication overhead and providing isolated, authenticated access paths.
2Adaptability or versatility
If multiple HWA thread users are allowed to access the same HWA, then resource utilization is improved, but system complexity increases due to need for isolation and access control
Solution Approach 1:
The patent segments the access control functionality into modular components within the trusted communication interface: separate buffer regions for different users, independent authentication logic for each user-HWA pair, and configurable forwarding rules. This segmentation allows multiple users to access the same HWA resources while maintaining isolated security contexts and simplifying access control management.
3Reliability
If privileged credential information is verified for each message request, then security is improved, but processing overhead increases
Solution Approach 1:
The patent implements preliminary authentication where the trusted communication interface verifies privileged credential information and establishes trusted communication channels before actual message processing. The interface pre-validates user privileges and configures appropriate access permissions, so that subsequent message requests from authenticated users can be forwarded with minimal additional verification overhead.
Data Source
AI summary
This disclosure relates to various implementations an embedded computing system. The embedded computing system comprises a hardware accelerator (HWA) thread user and a second HWA thread user that creates and sends out message requests. The HWA thread user and the second HWA thread user is communication with a microcontroller (MCU) subsystem. The embedded computing system also comprises a first inter-processor communication (IPC) interface between the HWA thread user and the MCU subsystem and a second IPC interface between the second HWA thread user and the MCU subsystem, where the first IPC interface is isolated from the second IPC interface. The MCU subsystem is also in communication with a first domain specific HWA and a second domain specific HWA.