Managing privileges of different entities for an integrated circuit

Patent metadata

Field	Value
Publication number	US-10860229-B2
Application number	US-201515512041-A
Country	US
Kind code	B2
Filing date	Aug 31, 2015
Priority date	Sep 17, 2014
Publication date	Dec 8, 2020
Grant date	Dec 8, 2020

Abstract

A request associated with one or more privileges assigned to a first entity may be received. Each of the one or more privileges may correspond to an operation of an integrated circuit. Information corresponding to the first entity and stored in a memory that is associated with the integrated circuit may be identified. Furthermore, the memory may be programmed to modify the information stored in the memory that is associated with the integrated circuit in response to the request associated with the one or more privileges assigned to the first entity.

First claim

What is claimed is:

1. A method comprising:
receiving a request associated with one or more privileges assigned to a first entity, each of the one or more privileges corresponding to an operation of an integrated circuit and being defined by a root entity that has authority to manage or configure the integrated circuit during a manufacturing lifecycle of the integrated circuit, wherein the first entity is a delegate entity;
identifying information corresponding to the first entity, the information being stored in a memory that is associated with the integrated circuit, specifying that the one or more privileges are assigned to the first entity, and specifying whether the first entity is allowed to delegate the one or more privileges corresponding to the operation of the integrated circuit to another delegate entity; and
programming, by a processing device, the memory to modify the information being stored in the memory that is associated with the integrated circuit in response to the request associated with the one or more privileges assigned to the first entity.

2. The method of claim 1 , wherein the one or more privileges are assigned to the first entity by the root entity, and wherein the request associated with the one or more privileges comprises a revocation of the one or more privileges assigned to the root entity, and wherein the programming of the memory to modify the information comprises programming at least one bit of the memory corresponding to the root entity from a first value to a second value to revoke the one or more privileges assigned to the root entity.

3. The method of claim 1 , wherein the delegate entity has been assigned the one or more privileges by the root entity, and wherein the request associated with the one or more privileges comprises a revocation of the one or more privileges assigned to the first entity or the root entity.

4. The method of claim 1 , further comprising:
receiving a second request associated with one or more privileges to be assigned to a second entity, each of the one or more privileges to be assigned to the second entity corresponding to a second operation of the integrated circuit;
identifying second information corresponding to the second entity, the second information being stored in the same memory that is associated with the integrated circuit and stores the information corresponding to the first entity; and
programming the memory to modify the second information corresponding to the second entity in response to the second request.

5. The method of claim 1 , further comprising:
receiving a request from a second entity to access a particular operation of the integrated circuit; and
allowing access to the particular operation of the integrated circuit to the second entity when the information stored in the memory identify that the second entity has been assigned a privilege to access the particular operation of the integrated circuit.

6. The method of claim 1 , wherein the memory is a one-time programmable (OTP) memory.

7. The method of claim 1 , further comprising:
receiving a request from the first entity to access a particular operation of the integrated circuit;
identifying information being stored in the memory that corresponds to a permission associated with the particular operation of the integrated circuit from each of a plurality of other entities; and
allowing access for the first entity to the particular operation of the integrated circuit when the information being stored in the memory that corresponds to the permission indicates that the particular operation of the integrated circuit is permitted to be performed by the first entity.

8. The method of claim 7 , wherein the particular operation of the integrated circuit is a debug operation.

9. A system comprising:
a plurality of components in an integrated circuit device to perform a plurality of operations;
a one-time programmable (OTP) memory to store information associated with a plurality of privileges for a plurality of entities to have the components perform the plurality of operations at least during a manufacturing lifecycle of the integrated circuit; and
a security manager in the integrated circuit device, comprising a processor and operatively coupled with the OTP memory, to:
receive a request associated with one or more of the privileges of the plurality of privileges that is assigned to a first entity, each of the one or more privileges corresponding to one operation performed by the components and being defined by a root entity that has authority to manage or configure the security manager during the manufacturing lifecycle, wherein the first entity is a delegate entity;
identify information corresponding to the first entity and stored in the OTP memory, specifying that the one or more privileges are assigned to the first entity, and specifying whether the first entity is allowed to delegate the one or more privileges corresponding to the operations performed by the components in the integrated circuit device to another delegate entity of the plurality of entities; and
program the OTP memory to modify the information being stored in the OTP memory based on the request associated with the one or more privileges.

10. The system of claim 9 , wherein the one or more privileges are assigned to the first entity by the root entity, and wherein the request comprises a revocation of the one or more privileges assigned to the root entity, and wherein programming of the OTP memory to modify the information comprises programming at least one bit of the OTP memory corresponding to the root entity from a first value to a second value to revoke the one or more privileges assigned to the root entity.

11. The system of claim 9 , wherein the delegate entity has been assigned the one or more privileges by the root entity, and wherein the request associated with the one or more privileges comprises a revocation of the one or more privileges assigned to the first entity or the root entity.

12. The system of claim 9 , wherein the security manager is further to:
receive a second request associated with one or more privileges to be assigned to a second entity, each of the one or more privileges to be assigned to the second entity corresponding to one of the operations performed by at least one of the components;
identify second information corresponding to the second entity, the second information being stored in the same OTP memory that stores the information corresponding to the first entity; and
program the OTP memory to modify the second information corresponding to the second entity in response to the second request.

13. The system of claim 9 , wherein the security manager is further to:
receive a request from a second entity to have one or more of the components perform one or more of the operations; and
allow the one or more components to perform the one or more operations when the information stored in the OTP memory identify that the second entity has been assigned a privilege to have the one or more components perform the one or more operations.

14. The system of claim 9 , wherein the security manager is further to:
receive a request from the first entity to have the one or more components perform a particular operation;
identify information being stored in the OTP memory that corresponds to a permission associated with the particular operation from each of a plurality of other entities; and
allow the one or more components to perform the particular operation when the information being stored in the OTP memory that corresponds to the permission indicates that the particular operation is permitted t

Assignees

• Cryptography Res Inc

Inventors

• Jun Benjamin Che-Ming
• Rawlings William Craig
• Kumar Ambuj
• Marson Mark Evan

Classifications

• G06F21/76

  in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD] · CPC title

• G06F3/0688

  Non-volatile semiconductor memory arrays · CPC title

• G11C17/16

  using electrically-fusible links · CPC title

• G06F3/0637 Primary

  Permissions · CPC title

• G06F3/0622

  in relation to access · CPC title