Delayed authentication debug policy

Patent metadata

Field	Value
Publication number	US-9759768-B2
Application number	US-201615249005-A
Country	US
Kind code	B2
Filing date	Aug 26, 2016
Priority date	Dec 23, 2014
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

A chassis platform, such as processor or a system-on-chip (SoC), includes logic to implement a debug chassis security system including a policy generator to control access from a test access port. The policy generator may distribute a debug policy to at least one logic block that locally enforces the debug policy. The debug policy may include a delayed authentication policy in which debug assets are distributed and the chassis platform is initially locked to prevent debug access via the test access port. An authenticated debug user may unlock the chassis platform at a later time to enable debugging operations. The debug policy may also include a live execution policy and an immediate debug policy.

First claim

What is claimed is:

1. A processor, comprising:
a test access port;
a logic block, including circuitry to enforce a debug policy to components within the logic block with global keys, debug global values, digital assets, and debug assets;
a digital asset controller including circuitry to manage the digital assets based on a debug policy;
a policy generator including circuitry to:
receive a debug user authentication for a debug user accessing the processor via the test access port;
based at least on the debug user authentication, determine a debug policy for the processor, the debug policy including a delayed authentication policy; and
distribute the debug policy to the logic block and to the digital asset controller;
lock the processor to prevent debugging operation via the test access port based on the delayed authentication policy; and
unlock the processor at a later time to enable debugging operation via the test access port based on the debug user authentication;

wherein:
the logic block further includes circuitry to:
determine to use the debug global values based on the delayed authentication policy, and
distribute the debug assets to the logic block based on the delayed authentication policy.

2. The processor of claim 1 , wherein the policy generator further includes circuitry to:
receive the debug user authentication during an authentication window that opens after the processor is powered on; and
keep the authentication window open until the later time based on the delayed authentication policy; and
receive a second debug user authentication via the test access port during the later time;
determine that the second debug user authentication is privileged to unlock the processor; and
based on the second debug user authentication, unlock the processor to enable debugging operation via the test access port.

3. The processor of claim 1 , wherein:
the debug policy includes a live execution policy;
the policy generator further includes circuitry to:
receive the debug user authentication during an authentication window that opens after the processor is powered on;
close the authentication window after a first time elapses, the later time extending beyond the first time; and
select the live execution policy when no debug user authentication is received before the authentication window is closed; and
lock the processor to prevent debugging operation via the test access port based on the live execution policy;

the logic block further includes circuitry to use the global keys based on the live execution policy; and
the digital asset controller further includes circuitry to distribute the digital assets to the logic block based on the live execution policy.

4. The processor of claim 1 , wherein:
the debug policy includes an immediate authentication policy;
the policy generator further includes circuitry to:
receive the debug user authentication during an authentication window that opens after the processor is powered on;
close the authentication window after a first time elapses, the later time extending beyond the first time;
select the immediate authentication policy when the debug user authentication is received before the authentication window is closed;
based on the debug user authentication and the immediate authentication policy, authenticate the debug user to immediately unlock the processor to enable debugging operation via the test access port;

the logic block further includes circuitry to use the debug global values based on the immediate authentication policy; and
the digital asset controller further includes circuitry to distribute the debug assets to the logic block based on the immediate authentication policy.

5. The processor of claim 1 , wherein the logic block further includes circuitry to, based on the debug user authentication, determine a level of debug access for the debug user to the components, via the test access port, within the logic block.

6. The processor of claim 1 , wherein the policy generator further includes circuitry to:
authenticate the debug user using a hardware authentication engine; and
authenticate the debug user using a firmware authentication engine.

7. The processor of claim 1 , wherein:
the digital assets include fused key values distributed by the digital asset controller; and
the global keys include keys implemented in metal in the processor.

8. A method comprising, within a chassis platform:
receiving, at a policy generator in a debug chassis security system included in the chassis platform, debug user authentication for a debug user accessing the chassis platform via a test access port;
based at least on the debug user authentication, determining a debug policy for the chassis platform;
distributing the debug policy to a logic block implemented in the chassis platform and to a digital asset controller, wherein the logic block receiving the debug policy includes the logic block enforcing the debug policy to components within the logic block;
distributing, with the digital asset controller and based on the debug policy, digital assets to the logic block;
distributing, with the digital asset controller and based on the debug policy, debug assets to the logic block; and
wherein the debug policy includes a delayed authentication policy further comprising:
distributing, by the digital asset controller, the debug assets to the logic block;
indicating to the logic block to use debug global values;
initially locking the chassis platform to prevent debugging operation via the test access port; and
enabling an authenticated debug user to unlock the chassis platform at a later time to enable debugging operation via the test access port.

9. The method of claim 8 , wherein receiving the debug user authentication includes:
receiving the debug user authentication during an authentication window that opens after the chassis platform is powered on and remains open until the later time, based on the delayed authentication policy, and

the delayed authentication policy further comprising:
receiving a second debug user authentication via the test access port during the later time;
determining that the second debug user authentication is privileged to unlock the chassis platform; and
based on the second debug user authentication, unlocking the chassis platform for debugging operation via the test access port.

10. The method of claim 8 , wherein the debug policy includes a live execution policy further comprising:
when no debug user authentication is received during an authentication window that opens after the chassis platform is powered on and closes after a first time elapses, the later time extending beyond the first time, selecting the live execution policy;
distributing the digital assets to the logic block;
indicating to the logic block to use the global keys; and
locking the chassis platform to prevent debugging operation via the test access port.

11. The method of claim 8 , wherein the debug policy includes an immediate authentication policy further comprising:
when the debug user authentication is received during an authentication window that opens after the chassis platform is powered on and closes after a first time elapses, the later time extending beyond the first time, selecting the immediate execution policy;
distributing the debug assets to the logic block;
indicating to the logic block to use debug global values; and
based on the debug user authentication, authenticating the debug user to immediately unlock the chassis platform to enable debugging operation via the test access port.

12. The method of claim 8 , wherein recei

Assignees

• Intel Corp

Inventors

• Neve De Mevergnies Michael
• Gartler Hermann W
• Bair Michael S

Classifications

• G06F11/27 Primary

  Built-in tests · CPC title

• G01R31/3177

  Testing of logic operation, e.g. by logic analysers · CPC title

• G01R31/31705

  Debugging aspects, e.g. using test circuits for debugging, using dedicated debugging test circuits (generation of test sequences therefor G01R31/31835, using scan test therefor G01R31/318544) · CPC title

• G06F11/25

  Testing of logic operation, e.g. by logic analysers · CPC title

• G01R31/31719 Primary

  Security aspects, e.g. preventing unauthorised access during test · CPC title