Hardware identity impersonation for target access control

Patent metadata

Field	Value
Publication number	US-12432204-B2
Application number	US-202217934774-A
Country	US
Kind code	B2
Filing date	Sep 23, 2022
Priority date	Sep 23, 2022
Publication date	Sep 30, 2025
Grant date	Sep 30, 2025

Abstract

Systems and techniques are provided for identity impersonation in access control systems. For example, a process for identity impersonation in access control systems can include: receiving, at a hardware identity impersonator from a first access domain, a request to make a target region accessible to a second access domain; updating a second access domain identity data structure to include an entry corresponding to the first access domain, the entry comprising an address of the target region and a first access domain identifier; receiving, at the hardware identity impersonator from the second access domain, an access request to access the target region, wherein the access request comprises an address and a second access domain identifier of the second access domain; and transmitting, at the hardware identity impersonator based on the access request, the address and the first access domain identifier to a memory management unit (MMU) of an access control system.

First claim

What is claimed is:

1. A method for identity impersonation in access control systems, the method comprising:
receiving, at a hardware identity impersonator from a first access domain, a request to make a target region accessible to a second access domain;
updating, at the hardware identity impersonator, a second access domain identity data structure to include an entry corresponding to the first access domain, wherein the entry comprises an address of the target region and a first access domain identifier;
receiving, at the hardware identity impersonator from the second access domain, an access request to access the target region, wherein the access request comprises the address of the target region and a second access domain identifier of the second access domain;
replacing, by the hardware identity impersonator, the second access domain identifier with the first access domain identifier;
transmitting, by the hardware identity impersonator based on the access request, the address and the first access domain identifier to a memory management unit (MMU) of an access control system; and
obtaining, at the second access domain, based on the access request by the hardware identity impersonator, data from the target region, wherein the second access domain obtains access to the target region based on a successful first access control check by the MMU and a successful second access control check by a protection unit of the access control system, and wherein the successful first access control check and the successful second access control check are based at least in part on the address of the target region and the first access domain identifier.

2. The method of claim 1 , wherein the access request corresponds to an operation to be performed by a second access domain execution engine of the second access domain using data from the target region.

3. The method of claim 2 , further comprising, after the operation is performed by the second access domain execution engine:
receiving, at the hardware identity impersonator, a second request from the first access domain to delete the entry; and
deleting, at the hardware identity impersonator, the entry from the second access domain identity data structure, wherein deleting the entry removes access to the target region from the second access domain.

4. The method of claim 2 , wherein the operation to be performed by the second access domain execution engine is requested by a first access domain execution engine of the first access domain.

5. The method of claim 1 , further comprising, before transmitting the address and the first access domain identifier:
performing, at the hardware identity impersonator, a lookup in the second access domain identity data structure using the address to obtain the first access domain identifier.

6. The method of claim 1 , wherein:
the access request is a read request; and
obtaining access to the target region comprises allowing an engine of the second access domain to perform a read from the target region.

7. The method of claim 1 , wherein:
the access request is a write request; and
obtaining access to the target region comprises allowing an engine of the second access domain to perform a write to the target region.

8. The method of claim 1 , further comprising:
receiving, at the hardware identity impersonator, a second request from a third access domain to make a second target region accessible to the second access domain;
determining, at the hardware identity impersonator, that the third access domain does not have access the second target region; and
denying the second request based on determining that the third access domain does not have access to the second target region.

9. The method of claim 1 , further comprising:
receiving, at the hardware identity impersonator, a second request from a third access domain to make a second target region accessible to the second access domain;
determining, at the hardware identity impersonator, that the third access domain is an untrusted access domain; and
denying the second request based on determining that the third access domain is the untrusted access domain.

10. The method of claim 1 , wherein the entry further comprises a valid indicator, and the access request is transmitted based at least in part on the valid indicator.

11. The method of claim 1 , wherein the access request comprises the address, a size, and an operation type, and the method further comprises:
transmitting, at the hardware identity impersonator, the size and the operation type to the MMU.

12. An apparatus for identity impersonation in access control systems, the apparatus comprising:
at least one memory; and
at least one processor coupled to the at least one memory and configured to:
receive, via a hardware identity impersonator and from a first access domain, a request to make a target region accessible to a second access domain;
update, at the hardware identity impersonator, a second access domain identity data structure to include an entry corresponding to the first access domain, wherein the entry comprises an address of the target region and a first access domain identifier;
receive, at the hardware identity impersonator from the second access domain, an access request to access the target region, wherein the access request comprises the address of the target region and a second access domain identifier of the second access domain;
replace, by the hardware identity impersonator, the second access domain identifier with the first access domain identifier;
transmit, from the hardware identity impersonator based on the access request, the address and the first access domain identifier to a memory management unit (MMU) of an access control system; and
obtain, at the second access domain, based on the access request by the hardware identity impersonator, data from the target region, wherein the second access domain obtains access to the target region based on a successful first access control check by the MMU and a successful second access control check by a protection unit of the access control system, and wherein the successful first access control check and the successful second access control check are based at least in part on the address of the target region and the first access domain identifier.

13. The apparatus of claim 12 , wherein the access request corresponds to an operation to be performed by a second access domain execution engine of the second access domain using data from the target region.

14. The apparatus of claim 13 , wherein the at least one processor is further configured to, after the operation is performed by the second access domain execution engine:
receive, via the hardware identity impersonator, a second request from the first access domain to delete the entry; and
delete, at the hardware identity impersonator, the entry from the second access domain identity data structure, wherein deleting the entry removes access to the target region from the second access domain.

15. The apparatus of claim 13 , wherein the operation to be performed by the second access domain execution engine is requested by a first access domain execution engine of the first access domain.

16. The apparatus of claim 12 , wherein the at least one processor is further configured to, before transmitting the address and the first access domain identifier:
perform, at the hardware identity impersonator, a lookup in the second access domain identity data structure using the address to obtain the first access domain identifier.

17. The apparatus of clai

Assignees

• Qualcomm Inc

Inventors

• Asbe Samar
• Gopalakrishnan Vijayakumar
• Li Ai

Classifications

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title