Secure hardware signal filtering

Patent metadata

Field	Value
Publication number	US-10938782-B1
Application number	US-201615391464-A
Country	US
Kind code	B1
Filing date	Dec 27, 2016
Priority date	Dec 27, 2016
Publication date	Mar 2, 2021
Grant date	Mar 2, 2021

Abstract

Systems and methods in accordance with various embodiments of the present disclosure provide secure filtering of transactions at a hardware and protocol level using a security device included on a server. In particular, various embodiments provide approaches for filtering transactions on various buses, such as SMBus, PMBus, I2C, and SPI, within a server. This filtering logic can be utilized to modify requests for access to devices on those busses, certain memory or registers within the devices, and/or limit the quantity of transactions on those busses. Embodiments may provide a policy engine through which the filtering logic applied to a given bus or buses may be modified. When a transaction is received, one or more attributes of the transaction can be compared to one or more policies. If there is a match, the transaction can be modified according to the matched policy.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving a request to perform a transaction on a memory location over a hardware-level protocol, the request received by a server in a resource environment, the request including a transaction type and a memory location;
determining, by a programmable logic device (PLD) at the server, the transaction type and the memory location from the request;
comparing, by the PLD, the transaction type and the memory location to one or more access policies, the access policies defining an action to be performed on transactions for at least one of a memory address or a device address;
matching, by the PLD, the memory location to the one or more access policies based at least in part on the memory location matching at least a portion of the memory address or the device address;
determining that the action defined using the one or more access policies is a block action;
in response to the determination that the action defined using the one or more access policies is a block action, returning a non-acknowledgement to a requestor computing device to cancel the transaction by setting a Serial Data (SDA) line high during an acknowledgement-related clock period of the hardware-level protocol; and
issuing a stop condition to block the transaction from being performed on the memory location.

2. The computer-implemented method of claim 1 , further comprising:
receiving a second request to perform a second transaction on a second memory location;
matching, by the PLD, the second memory location to the one or more access policies;
determining a second action associated with the one or more access policies is a masking action;
reading data from the second memory location; and
masking the data from the second memory location based on the masking action.

3. The computer-implemented method of claim 1 , further comprising:
receiving a second request to perform a second transaction on a second memory location;
matching, by the PLD, the second memory location to the one or more access policies;
determining a second action associated with the one or more access policies is a masking action;
reading data from a masked memory location specified by the one or more access policies; and
returning data from the masked memory location.

4. A computer-implemented method comprising:
receiving a request to perform a transaction at a server over a hardware-level protocol;
determining, by a security device on the server, one or more attributes associated with the request;
determining, by the security device, a transaction type associated with the request;
comparing, by the security device, the transaction type and the one or more attributes to an access policy, the one or more attributes including a memory location or a device location, the access policy being associated with a memory address or a device address;
matching, by the security device, the one or more attributes to the access policy based at least in part on the memory location matching at least a portion of the memory address or the device location matching at least a portion of the device address;
determining an action to be performed on the transaction, the action defined using the access policy, is a blocking action; and
in response to the determination that the action to be performed on the transaction is a blocking action, returning a non-acknowledgement (NACK) based on the action by setting a data line high during an acknowledgement-related clock period of the hardware-level protocol.

5. The computer-implemented method of claim 4 , wherein determining an action to be performed on the transaction associated with the access policy, further comprises:
setting a block signal to an invalid value prior to receipt of a completed transaction command.

6. The computer-implemented method of claim 4 , further comprising
issuing a stop instruction.

7. The computer-implemented method of claim 4 , further comprising:
reading data from at least one memory address specified in a second request; and
masking at least a portion of the data read from the at least one memory address to create masked data.

8. The computer-implemented method of claim 7 , further comprising:
replacing at least the portion of the data with replacement data specified by the access policy.

9. The computer-implemented method of claim 7 , further comprising:
replacing at least one memory address specified in the second request with at least one masked memory address; and
reading masked data from the at least one masked memory address.

10. The computer-implemented method of claim 4 , wherein comparing, by the security device, the transaction type and the one or more attributes to an access policy further comprises:
comparing at least a portion of address data specified by the one or more attributes to the access policy.

11. The computer-implemented method of claim 4 , wherein the one or more policies include at least one of a memory address, device address, or register address.

12. The computer-implemented method of claim 4 , wherein the one or more policies include a command represented by a pattern of read and write transactions.

13. A computing device, comprising:
at least one processor;
a transaction monitor state machine configured to:
receive a request to perform a transaction at a server;
determine one or more attributes associated with the request, the one or more attributes including a memory location or a device location;
determine a transaction type associated with the request;
a transaction filter state machine configured to receive the transaction type and one or more attributes associated with the request from the transaction monitor state machine, the transaction filter state machine further configured to:
compare the transaction type and the one or more attributes to an access policy, the access policy being associated with a memory address or a device address;
determine that the memory location matches at least a portion of the memory address or the device location matches at least a portion of the device address;
determine an action to be performed on the transaction, the action defined by the access policy, is a blocking action; and
in response to the determination that the action is a blocking action, return a non-acknowledgement based on the action by setting a data line high during an acknowledgement-related clock period.

14. The computing device of claim 13 , wherein the transaction filter state machine is further configured to:
set the transaction filter state machine to a block state.

15. The computing device of claim 14 , wherein the block state outputs a block signal having an invalid value prior to receipt of a completed transaction command.

16. The computing device of claim 14 , wherein the transaction filter state machine is further configured to:
issue a stop instruction.

17. The computing device of claim 13 , wherein the transaction filter state machine is further configured to:
read data from at least one memory address specified in a second request; and
mask at least a portion of the data read from the at least one memory address to create masked data.

18. The computing device of claim 17 , wherein masking at least a portion of the data read from the at least one memory address to create masked data further comprises:
replacing at least the portion of the data with replacement data specified by the access policy.

19. The computing device of claim 13 , wherein the transaction filter stat

Assignees

• Amazon Tech Inc

Inventors

• Harland Jason Alexander
• Kentley Michael Joseph

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/0209

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title