Programmable validation of transaction requests

Patent metadata

Field	Value
Publication number	US-2016140073-A1
Application number	US-201414540175-A
Country	US
Kind code	A1
Filing date	Nov 13, 2014
Priority date	Nov 13, 2014
Publication date	May 19, 2016
Grant date	—

Abstract

A data processor includes an input/output bridge that provides enforcement of a security status on transactions between devices across the bridge. The bridge includes circuitry to parse a received request to obtain one or more identifiers, and compare the identifiers against one or more programmable lookup tables. Based on this comparison, the bridge can determine the security status of the transaction, as well as selectively forward the transaction based on the security status.

First claim

What is claimed is:

1 . A method of controlling access, comprising:
receiving a request from a processor to access at least one of a plurality of devices; parsing an address portion of the request to obtain a bus identifier, a device identifier, and a function identifier; comparing at least one of the bus identifier and the device identifier against a bus table and a device table, respectively, to determine a first security status; comparing the function identifier against a function table to determine a second security status; and selectively forwarding the request to the at least one of the plurality of devices based on at least one of the first security status and the second security status.

2 . The method of claim 1 , wherein the processor is an ARM processor.

3 . The method of claim 1 , wherein the request includes a Peripheral Component Interconnect (PCI) transaction.

4 . The method of claim 3 , wherein selectively forwarding the request includes transmitting the PCI transaction via a PCI bus.

5 . The method of claim 1 , wherein selectively forwarding the request includes denying the request in response to detecting a mismatch between at least two of the bus identifier, the device identifier, and the function identifier.

6 . The method of claim 1 , wherein selectively forwarding the request includes denying the request in response to detecting a mismatch between at least one of the bus identifier, a device identifier, and a function identifier and at least one of the bus table, device table and function table.

7 . The method of claim 1 , wherein the bus identifier indicates a given path at which the request is to be forwarded to the at least one of the plurality of devices.

8 . The method of claim 7 , wherein the bus table indicates a security status of the given path, the security status being secure or non-secure.

9 . The method of claim 8 , wherein selectively forwarding the request includes denying the request in response to a mismatch between the security status and a status of at least one of the device identifier and the function identifier indicated by the device table and function table, respectively.

10 . The method of claim 1 , wherein the device indicator indicates the at least one of the plurality of devices.

11 . A circuit for controlling access, comprising:
a first port configured to receive a request from a processor to access at least one of a plurality of devices, the request including a bus identifier, a device identifier, and a function identifier; a second port configured to connect to the plurality of devices via a bus; a memory storing a bus table, a device table, and a function table; and a control circuit configured to:
compare at least one of the bus identifier and the device identifier against the bus table and the device table, respectively, to determine a first security status;
compare the function identifier against the function table to determine a second security status; and
selectively forward the request to the at least one of the plurality of devices based on at least one of the first security status and the second security status.

12 . The circuit of claim 11 , wherein the processor is an ARM processor.

13 . The circuit of claim 11 , wherein the request includes a Peripheral Component Interconnect (PCI) transaction.

14 . The circuit of claim 13 , wherein the control circuit is further configured to transmit the PCI transaction via a PCI bus.

15 . The circuit of claim 11 , wherein the control circuit is further configured to deny the request in response to detecting a mismatch between at least two of the bus identifier, the device identifier, and the function identifier.

16 . The circuit of claim 11 , wherein the control circuit is further configured to deny the request in response to detecting a mismatch between at least one of the bus identifier, a device identifier, and a function identifier and at least one of the bus table, device table and function table.

17 . The circuit of claim 11 , wherein the bus identifier indicates a given path at which the request is to be forwarded to the at least one of the plurality of devices.

18 . The circuit of claim 17 , wherein the bus table indicates a security status of the given path, the security status being secure or non-secure.

19 . The circuit of claim 18 , wherein the control circuit is further configured to deny the request in response to a mismatch between the security status and a status of at least one of the device identifier and the function identifier indicated by the device table and function table, respectively.

20 . The circuit of claim 11 , wherein the device indicator indicates the at least one of the plurality of devices.

Assignees

• Cavium Inc

Inventors

• Sanzone Robert A
• Snyder Ii Wilson P
• Kessler Richard E

Classifications

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• G06F13/4221 Primary

  being an input/output bus, e.g. ISA bus, EISA bus, PCI bus, SCSI bus · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title