Computing peripheral interface management mechanism

Patent metadata

Field	Value
Publication number	US-2022004635-A1
Application number	US-202117480601-A
Country	US
Kind code	A1
Filing date	Sep 21, 2021
Priority date	Sep 21, 2021
Publication date	Jan 6, 2022
Grant date	—

Abstract

An apparatus is disclosed. The apparatus comprises a trusted device including a first integrated circuit (IC) die comprising a first plurality of hardware devices and a second IC die comprising a second plurality of hardware devices and cryptographic processor to operate as a root of trust to manage an input/output (I/O) functional state of each of the hardware devices.

First claim

What is claimed is:

1 . An apparatus comprising:
a trusted device including:
a first integrated circuit (IC) die comprising a first plurality of hardware devices; and
a second IC die comprising a second plurality of hardware devices; and
cryptographic processor to operate as a root of trust to manage an input/output (I/O) functional state of each of the hardware devices.

2 . The apparatus of claim 1 , wherein the first and second plurality of hardware devices each include trusted I/O registers.

3 . The apparatus of claim 2 , wherein the trusted I/O registers comprise:
at least one interface state registers; and an error status register.

4 . The apparatus of claim 3 , wherein the cryptographic processor receives a request from a host indicating that the trusted device is to enter a trusted state.

5 . The apparatus of claim 4 , wherein the cryptographic processor programs the interface state registers within each of the first and second plurality of hardware devices to enter the first and second plurality of hardware devices into a trusted I/O operational state.

6 . The apparatus of claim 5 , wherein each of the first and second plurality of hardware devices performs error handling to detect security violations upon being entered into the trusted I/O operational state.

7 . The apparatus of claim 6 , wherein a hardware device stores a value associated with a detected security violation within the error status register upon detecting the security violation.

8 . The apparatus of claim 7 , wherein the hardware device transmits an alert to the cryptographic processor indicating that the security violation has been detected.

9 . The apparatus of claim 8 , wherein the cryptographic processor queries the error status register within each of the first and second plurality of hardware devices to determine the hardware device at which the error security violation has been detected.

10 . The apparatus of claim 9 , wherein the cryptographic processor transmits a message to the host indicating the hardware device that detected the security violation.

11 . The apparatus of claim 9 , wherein the cryptographic processor facilitates an exit of the trusted device from the trusted I/O operational state.

12 . A method comprising:
receiving a request from a host indicating that each of a plurality of hardware devices within a system on chip (SOC) is to enter into a trusted input/output (I/O) operational state; and programming state registers within each of the plurality of hardware devices to enter the plurality hardware devices into a trusted I/O operational state.

13 . The method of claim 12 , further comprising receiving an alert indicating that a security violation has been detected at one or more of the plurality of hardware devices.

14 . The method of claim 13 , further comprising:
querying an error status register within each of the plurality of hardware devices to determine the hardware device at which the security violation has been detected; and determining that the error status register within a first of the plurality of hardware devices includes a value indicating that the security violation has been detected.

15 . The method of claim 14 , further comprising transmitting a cryptographically protected message to the host indicating that the first hardware device has detected the security violation.

16 . The method of claim 15 , further comprising facilitating an exit of the first hardware device from the trusted I/O operational state.

17 . At least one computer readable medium having instructions stored thereon, which when executed by one or more processors, cause the processors to:
receive a request from a host indicating that each of a plurality of hardware devices within a system on chip (SOC) is to enter into a trusted input/output (I/O) operational state; and program state registers within each of the plurality of hardware devices to enter the plurality hardware devices into a trusted I/O operational state.

18 . The computer readable medium of claim 17 , which when executed by the one or more processors, further cause the processors to receive an alert indicating that a security violation has been detected at one or more of the plurality of hardware devices.

19 . The computer readable medium of claim 18 , which when executed by the one or more processors, further cause the processors to:
query an error status register within each of the plurality of hardware devices to determine the hardware device at which the security violation has been detected; and determine that the error status register within a first of the plurality of hardware devices includes a value indicating that the security violation has been detected.

20 . The computer readable medium of claim 19 , which when executed by one or more processors, further cause the processors to:
transmit a cryptographically protected message to the host indicating that the first hardware device has detected the security violation; and facilitate an exit of the first hardware device from the trusted I/O operational state.

Assignees

• Intel Corp

Inventors

• Nemiroff Daniel
• Krishnan Vidhya
• White Bryan R

Classifications

• G06F21/74

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title

• G06F13/102 Primary

  where the program performs an interfacing function, e.g. device driver (G06F13/105 takes precedence; contention policies within device drivers G06F9/4881; scheduling within device drivers G06F9/52) · CPC title

• G06F21/72

  in cryptographic circuits · CPC title

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/76

  in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD] · CPC title