System, method and computer-accessible medium for low-overhead security wrapper for memory access control of embedded systems

Patent metadata

Field	Value
Publication number	US-10289577-B2
Application number	US-201715592838-A
Country	US
Kind code	B2
Filing date	May 11, 2017
Priority date	May 11, 2016
Publication date	May 14, 2019
Grant date	May 14, 2019

Abstract

An exemplary system for wrapping an intellectual property core (IP) bus master(s), can include, for example, a plurality of IP cores associated with the IP core bus master(s), and a wrapper module connected to a serial input of the IP core bus master(s) and a serial output of the IP core bus master(s), where the wrapper module can be configured to capture and shift a plurality of values of a system bus for a plurality of bus transfers associated with the IP core bus master(s) and the IP cores. The wrapper module can be further configured to modify a wrapper control logic and a wrapper boundary register of the IP core bus master(s). A plurality of terminals can be included, which can be coupled to the IP core bus master(s), and a plurality of wrapper cells can be included, which can be associated with the plurality of terminals.

First claim

What is claimed is:

1. A system for wrapping at least one intellectual property (IP) core bus master, comprising:
a plurality of IP cores associated with the at least one IP core bus master;
a plurality of terminals coupled to the at least one IP core bus master wherein the terminals include at least one HADDR and at least one HWRITE;
a plurality of wrapper cells associated with the terminals;
a wrapper module connected to a serial input of the at least one IP core bus master and a serial output of the at least one IP core bus master, wherein the wrapper module is configured to monitor a plurality of values of at least one of the at least one HADDR and the at least one HWRITE; and
a computer hardware arrangement configured to determine if at least one attack on the system bus has occurred based on the values,
wherein the wrapper module is configured to (i) capture and shift the values of a system bus for a plurality of bus transfers associated with the at least one IP core bus master and the IP cores, and (ii) deny access to the system bus if the computer hardware arrangement determines that the at least one attack has occurred.

2. The system of claim 1 , wherein the wrapper module is further configured to modify a wrapper control logic and a wrapper boundary register of the at least one IP core bus master.

3. The system of claim 1 , wherein the wrapper module is further configured to allow access to the system bus if (i) the computer hardware arrangement determines that the at least one attack has not occurred, and (ii) the wrapper module has completed monitoring the values.

4. The system of claim 1 , wherein the wrapper module is further configured to independently capture and shift the values of the system bus.

5. The system of claim 1 , wherein the IP cores include at least one of (i) memory access controllers, (ii) processors, (iii) image processors, or (iv) input/output controllers.

6. The system of claim 1 , wherein the wrapper module includes an architecture from a previously-generated design-for-test architecture associated with the IP cores.

7. A non-transitory computer-accessible medium having stored thereon computer-executable instructions for wrapping at least one intellectual property (IP) core bus master, wherein, when a computer arrangement executes the instructions, the computer arrangement is configured to perform procedures comprising:
providing a plurality of IP cores associated with the at least one IP core bus master;
wrapping a serial input of the at least one IP core bus master and a serial output of the at least one IP core bus master using a wrapper module;
monitoring a plurality of values of a plurality of terminals associated with the at least one IP core bus master, wherein the terminals include at least one HADDR and at least one HWRITE, and wherein the terminals have a plurality of wrapper cells associated therewith;
determining if at least one attack on the system bus has occurred based on the values;
capturing and shifting the values of a system bus for a plurality of bus transfers associated with the at least one IP core bus master and the IP cores; and
denying access to the system bus if the computer hardware arrangement determines that the at least one attack has occurred.

8. The computer-accessible medium of claim 7 , wherein the computer arrangement is further configured to modify a wrapper control logic and a wrapper boundary register of the at least one IP core bus master.

9. The computer-accessible medium of claim 7 , wherein the computer arrangement is further configured to allow access to the system bus if (i) the computer arrangement determines that the at least one attack has not occurred, and (ii) the computer arrangement module has completed monitoring the values.

10. The computer-accessible medium of claim 7 , wherein the computer arrangement is further configured to independently capture and shift the values of the system bus.

11. The computer-accessible medium of claim 7 , wherein the IP cores include at least one of (i) memory access controllers, (ii) processors, (iii) image processors, or (iv) input/output controllers.

12. The computer-accessible medium of claim 7 , wherein the computer arrangement is configured to wrap the serial input and the serial output using architecture from a previously-generated design-for-test architecture associated with the IP cores.

13. A method for wrapping at least one intellectual property (IP) core bus master, comprising:
providing a plurality of IP cores associated with the at least one IP core bus master;
wrapping a serial input of the at least one IP core bus master and a serial output of the at least one IP core bus master using a wrapper module;
monitoring a plurality of values of a plurality of terminals associated with the at least one IP core bus master, wherein the terminals include at least one HADDR and at least one HWRITE, and wherein the terminals have a plurality of wrapper cells associated therewith;
determining if at least one attack on the system bus has occurred based on the values;
using a computer hardware arrangement, capturing and shifting the values of a system bus for a plurality of bus transfers associated with the at least one IP core bus master and the IP cores; and
denying access to the system bus if the computer hardware arrangement determines that the at least one attack has occurred.

14. A system for wrapping at least one intellectual property (IP) core bus master, comprising:
a plurality of IP cores associated with the at least one IP core bus master;
a plurality of terminals coupled to the at least one IP core bus master wherein the plurality of terminals include at least one HADDR and at least one HWRITE;
a plurality of wrapper cells associated with the plurality of terminals
a wrapper module connected to a serial input of the at least one IP core bus master and a serial output of the at least one IP core bus master, wherein the wrapper module is configured to monitor a plurality of values of at least one of the at least one HADDR and the at least one HWRITE; and
a computer hardware arrangement configured to determine if at least one attack on the system bus has occurred based on the values,
wherein the wrapper module is configured to (i) capture and shift the values of a system bus for a plurality of bus transfers associated with the at least one IP core bus master and the IP cores, and allow access to the system bus if (a) the computer hardware arrangement determines that the at least one attack has not occurred, and (b) the wrapper module has completed monitoring the values.

15. A non-transitory computer-accessible medium having stored thereon computer-executable instructions for wrapping at least one intellectual property (IP) core bus master, wherein, when a computer arrangement executes the instructions, the computer arrangement is configured to perform procedures comprising:
providing a plurality of IP cores associated with the at least one IP core bus master;
wrapping a serial input of the at least one IP core bus master and a serial output of the at least one IP core bus master using a wrapper module;
monitoring a plurality of values of a plurality of terminals associated with the at least one IP core bus master, wherein the terminals include at least one HADDR and at least one HWRITE, and wherein the terminals have a plurality of wrapper cells associated therewith;
determining if at least one attack on the system bus has occurred based on the values;
capturing and shifting the values of a system bus for a plurality of bus transfers associated with the at least on

Assignees

• Univ New York

Inventors

• Karri Ramesh
• Backer Jerry
• Hely David

Classifications

• G06F13/1668 Primary

  Details of memory controller · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F13/4282

  on a serial bus, e.g. I2C bus, SPI bus (on daisy chain buses G06F13/4247) · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title