Subsystem firewalls

Patent metadata

Field	Value
Publication number	US-2020120067-A1
Application number	US-201916716132-A
Country	US
Kind code	A1
Filing date	Dec 16, 2019
Priority date	May 26, 2017
Publication date	Apr 16, 2020
Grant date	—

Abstract

The disclosed technology is generally directed to firewalls. In one example of the technology, a first firewall is used such that communication is blocked from a first subsystem of a device upon boot of the device. The first firewall is enabled to be configured by secure code subsequent to boot such that code that is not secure code is prevented from configuring the first firewall. After configuration of the first firewall, based on the configuration, the first firewall is used to selectively allow the first subsystem access to the first memory based on ranges of addresses of the first memory configured as accessible to the first subsystem.

First claim

We claim:

1 . An apparatus, comprising:
a first bus master that is configured to operate with secure code; a first input/output (IO) subsystem that is configured to control at least some input/output functions for the apparatus; and a first firewall that is configured such that communication from the first IO subsystem is blocked from a boot of the apparatus until the first firewall has been configured, and that is further configured to:
receive a secure code configuration from the bus master;
in response to receiving the secure code configuration from the bus master, configure the first firewall with the secure code configuration while non-secure code is prevented from configuring the first firewall; and
after the configuring of the first firewall with the secure code configuration, allow the first IO subsystem to access a first range of addresses in a memory mapped address space of the apparatus.

2 . The apparatus of claim 1 , further comprising:
a second IO subsystem; a second firewall that is configured such that communication from the second 10 subsystem is blocked from the boot of the apparatus until the second firewall has been configured, and that is further configured to:
receive another secure code configuration;
in response to receiving the other secure code configuration, configure the second firewall with the other secure code configuration while non-secure code is prevented from configuring the second firewall; and
after the configuring of the second firewall, allow the second IO subsystem to access a second range of addresses in the memory mapped address space of the apparatus, wherein at least a portion of the first range of addresses in the memory mapped address space of the apparatus does not overlap with the second range of addresses in the memory mapped address space of the apparatus.

3 . The apparatus of claim 1 , wherein the first range of addresses in the memory mapped address space of the apparatus is for at least one of a static random-access memory or a flash memory.

4 . The apparatus of claim 1 , wherein the first firewall is further configured to:
after the configuring of the first firewall, allow, by the first firewall, the first IO subsystem access to a second range of addresses in the memory mapped address space of the apparatus.

5 . The apparatus of claim 1 , wherein the first firewall is further configured to:
after the configuring of the first firewall, allow, by the first firewall, the first IO subsystem access to a first peripheral based on a set of peripherals being configured as accessible to the first IO subsystem.

6 . The apparatus of claim 1 , wherein the bus master is further configured to:
after the configuring of the first firewall, set a sticky lock bit for the first firewall, wherein the first firewall is further configured to prevent the first firewall from being reconfigured after the sticky lock bit for the first firewall is set until a reboot of the apparatus.

7 . A method, comprising:
blocking, with a first firewall, communication from a first input/output (IO) subsystem of a device from a boot of the device until the first firewall has been configured with secure code; subsequent to the boot, configuring the first firewall with secure code while configuration of the first firewall by non-secure code is prevented; and after the configuring of the first firewall, selectively allowing the first IO subsystem access to a first range of addresses in a memory mapped address space based on the first range of addresses in the memory mapped address space being configured as accessible to the first IO subsystem by the secure code.

8 . The method of claim 7 , further comprising:
blocking, with a second firewall, communication from a second input/output (IO) subsystem of the device from the boot of the device until the second firewall has been configured; subsequent to the boot, configuring the second firewall with other secure code while configuration of the second firewall by non-secure code is prevented; and after the configuring of the second firewall, selectively allowing the second IO subsystem access to a second range of addresses in the memory mapped address space based on the second range of addresses in the memory mapped address space being configured as accessible to the second IO subsystem by the other secure code, wherein at least the portion of the first range of addresses in the memory mapped address space does not overlap with the second range of addresses in the memory mapped address space.

9 . The method of claim 7 , wherein the first range of addresses in the memory mapped address space is for at least one of a static random-access memory or a flash memory.

10 . The method of claim 7 , wherein the first firewall is a hardware firewall.

11 . The method of claim 7 , wherein the first IO subsystem includes a microcontroller.

12 . The method of claim 7 , further comprising:
after the configuring of the first firewall, selectively allowing, by the first firewall, the first IO subsystem access to a second range of addresses in the memory mapped address space based on the second range of addresses in the memory mapped address space being configured as accessible to the first IO subsystem by the secure code.

13 . The method of claim 7 , further comprising:
after the configuring of the first firewall, selectively allowing, by the first firewall, the first IO subsystem access to a first peripheral based on a set of peripherals being configured as accessible to the first IO subsystem by the secure code.

14 . The method of claim 7 , further comprising:
after the configuring of the first firewall, setting a sticky lock bit for the first firewall, such that after the sticky lock bit is set for the first firewall, the first firewall is prevented from being reconfigured until a reboot of the device.

15 . An apparatus, comprising:
a first input/output (IO) subsystem; and a first hardware firewall that is configured such that communication from the first IO subsystem to a first range of addresses in a memory mapped address space is blocked from boot until the first hardware firewall has been configured, and wherein the first hardware firewall is functional to:
be configured by secure code while non-secure code is prevented from configuring the first hardware firewall; and
after configuration of the first hardware firewall, selectively allow the first IO subsystem access to the first range of addresses in the memory mapped address space based on the first range of addresses in the memory mapped address space being configured as accessible to the first IO subsystem by the configuration.

16 . The apparatus of claim 15 , further comprising:
a second IO subsystem; and a second hardware firewall that is configured such that communication from the second IO subsystem of the apparatus to a second range of addresses in the memory mapped address space is blocked from boot until the second hardware firewall has been configured, and wherein the second hardware firewall is functional to:
be configured by secure code subsequent to boot while non-secure code is prevented from configuring the second hardware firewall; and
after configuration of the second hardware firewall, selectively allow the second IO subsystem access to the second range of addresses in the memory mapped address space based on the second range of addresses in the memory mapped address space being configured as accessible to the second IO subsystem by the configuration, wherein at least the portion of the first range of addresse

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Letey George Thomas
• Stiles Douglas L
• Nightingale Edmund B

Classifications

• G06F13/24

  using interrupt (G06F13/32 takes precedence) · CPC title

• G06F21/85

  interconnection devices, e.g. bus-connected or in-line devices · CPC title

• G06F21/575

  Secure boot · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F15/7825

  Globally asynchronous, locally synchronous, e.g. network on chip · CPC title