Computing device to provide access control to a hardware resource

Patent metadata

Field	Value
Publication number	US-10482289-B2
Application number	US-201715685795-A
Country	US
Kind code	B2
Filing date	Aug 24, 2017
Priority date	Aug 24, 2017
Publication date	Nov 19, 2019
Grant date	Nov 19, 2019

Abstract

A computing device includes a hardware resource, a component to send a transaction signal including a target address of the hardware resource, a security data associated with an initiator of the transaction signal, and a safety data associated with the initiator, and an access control unit coupled to the component and the hardware resource, the access control unit to receive the transaction signal, determine whether security access is granted based on the transaction signal, determine whether safety access is granted based on the transaction signal, and allow access to the hardware resource based on both the security access and the safety access being granted.

First claim

The invention claimed is:

1. A computing device comprising:
a hardware resource;
a safety configuration register;
a component to send a transaction signal, the transaction signal including a target address of the hardware resource, a security data associated with an initiator of the transaction signal, a safety data associated with the initiator, and a safety master identifier, wherein the safety master identifier allows safety access to the safety configuration register but prevents safety access to the hardware resource when the safety master identifier is set to a first value, and does not prevent safety access to the hardware resource but prevents safety access to the safety configuration register when the safety master identifier is set to a second value; and
an access control unit coupled to the component and the hardware resource, the access control unit to:
receive the transaction signal;
determine whether security access is granted based on the transaction signal;
determine whether safety access is granted based on the transaction signal; and
allow access to the hardware resource based on both the security access and the safety access being granted.

2. The computing device of claim 1 , wherein the security data associated with the initiator includes one or more bits indicating a security level of the initiator.

3. The computing device of claim 2 , wherein the security data associated with the initiator includes an access domain identifier.

4. The computing device of claim 1 , wherein the safety data associated with the initiator includes a safety identifier.

5. The computing device of claim 4 , wherein the safety identifier identifies one of a plurality of safety levels.

6. The computing device of claim 1 , further comprising:
a logic element included within the access control unit, the logic element to allow access to the hardware resource based on both the security access and the safety access being granted.

7. The computing device of claim 1 , wherein the safety master identifier includes a bit indicating a safety master, the safety master allowed to only access the safety configuration register.

8. The computing device of claim 1 , wherein the hardware resource is a memory.

9. A computing device comprising:
means for sending a transaction signal, the transaction signal including a target address of a hardware resource, a security data associated with an initiator of the transaction signal, a safety data associated with the initiator, and a safety master identifier, wherein the safety master identifier allows safety access to a safety configuration register but prevents safety access to the hardware resource when the safety master identifier is set to a first value, and does not prevent safety access to the hardware resource but prevents safety access to the safety configuration register when the safety master identifier is set to a second value;
means for receiving the transaction signal;
means for determining whether security access is granted based on the transaction signal;
means for determining whether safety access is granted based on the transaction signal; and
means for allowing access to the hardware resource based on both the security access and the safety access being granted.

10. The computing device of claim 9 , wherein the security data associated with the initiator includes one or more bits indicating a security level of the initiator.

11. The computing device of claim 10 , wherein the security data associated with the initiator includes an access domain identifier.

12. The computing device of claim 9 , wherein the safety data associated with the initiator includes a safety identifier.

13. The computing device of claim 12 , wherein the safety identifier identifies one of a plurality of safety levels.

14. The computing device of claim 9 , wherein the safety master identifier includes a bit indicating a safety master, the safety master allowed to only access the safety configuration register.

15. A method operational in a computing device comprising:
sending, by a component, a transaction signal, the transaction signal including a target address of a hardware resource, a security data associated with an initiator of the transaction signal, a safety data associated with the initiator, and a safety master identifier, wherein the safety master identifier allows safety access to a safety configuration register but prevents safety access to the hardware resource when the safety master identifier is set to a first value, and does not prevent safety access to the hardware resource but prevents safety access to the safety configuration register when the safety master identifier is set to a second value;
receiving, by an access control unit, the transaction signal;
determining, by the access control unit, whether security access is granted based on the transaction signal;
determining, by the access control unit, whether safety access is granted based on the transaction signal; and
allowing, by the access control unit, access to the hardware resource based on both the security access and the safety access being granted.

16. The method of claim 15 , wherein the security data associated with the initiator includes one or more bits indicating a security level of the initiator.

17. The method of claim 16 , wherein the security data associated with the initiator includes an access domain identifier.

18. The method of claim 15 , wherein the safety data associated with the initiator includes a safety identifier.

19. The method of claim 18 , wherein the safety identifier identifies one of a plurality of safety levels.

20. The method of claim 15 , wherein the safety master identifier includes a bit indicating a safety master, further comprising:
allowing only to the safety master access to the safety configuration register.

21. A non-transitory, computer-readable medium, having stored thereon computer-readable instructions for providing access control to a hardware resource, comprising instructions configured to cause a computing device to:
send a transaction signal, the transaction signal including a target address of the hardware resource, a security data associated with an initiator of the transaction signal, a safety data associated with the initiator, and a safety master identifier, wherein the safety master identifier allows safety access to a safety configuration register but prevents safety access to the hardware resource when the safety master identifier is set to a first value, and does not prevent safety access to the hardware resource but prevents safety access to the safety configuration register when the safety master identifier is set to a second value;
receive the transaction signal;
determine whether security access is granted based on the transaction signal;
determine whether safety access is granted based on the transaction signal; and
allow access to the hardware resource based on both the security access and the safety access being granted.

22. The computer-readable medium of claim 21 , wherein the security data associated with the initiator includes one or more bits indicating a security level of the initiator.

23. The computer-readable medium of claim 22 , wherein the security data associated with the initiator includes an access domain identifier.

24. The computer-readable medium of claim 21 , wherein the safety data associated with the initiator includes a safety identifier.

Assignees

• Qualcomm Inc

Inventors

• Barr David
• Shaool Dafna
• Gulati Rahul
• Bhuyan Pranjal

Classifications

• B60W2050/0006

  Digital architecture hierarchy · CPC title

• B60W2050/0005

  Processor details or data handling, e.g. memory registers or chip architecture · CPC title

• F02N11/0807

  Remote means · CPC title

• G06F2221/2129

  Authenticate client device independently of the user · CPC title

• G06F21/44 Primary

  Program or device authentication · CPC title