Policy enforcement and continuous policy monitoring on reconfigurable hardware device
Systems and method for enforcing a policy of a configuration and continuously monitoring the policy on a Reconfigurable Hardware Device (RHD) are provided. In some embodiments, the RHD comprises a loader component, a validator component, and at least one region of programmable logic. The loader component is configured to receive a configuration from an external entity. The validator component is configured to obtain a policy, perform an evaluation of the policy based on information about the RHD, and perform one or more actions based on a result of the evaluation of the policy. In this way, some embodiments herein can restrict what properties the RHD must comply with before the configuration is deployed and possibly sensitive data is exposed. Further, by adopting some embodiments, the RHD can be used to quickly change behavior of a vehicle when encountering a new location or environmental condition.
1 . A Reconfigurable Hardware Device, RHD, comprising:
at least one region of programmable logic;
a loader component configured to receive a configuration to be loaded onto the RHD, wherein at least one bitstream for the at least one region of programmable logic is comprised in the configuration, wherein the configuration further includes a policy that specifies requirements on properties of the RHD that must be satisfied in order for the configuration as received to be loaded onto the RHD; and
a validator component configured to:
obtain the policy;
perform an evaluation of the policy based on the properties of the RHD, to check whether the RHD satisfies the requirements specified by the policy; and
perform one or more actions based on a result of the evaluation of the policy.
2 . The RHD of claim 1 , wherein the validator component is further configured to obtain the policy from the loader component.
3 . The RHD of claim 1 , wherein, responsive to the result of the evaluation of the policy indicating that the evaluation is successful in confirming that the RHD satisfies the requirements specified by the policy, the one or more actions performed by the validator component comprise allowing at least one bitstream comprised in the configuration to be loaded into the at least one region of programmable logic.
4 . The RHD of claim 3 , wherein, responsive to the result of the evaluation of the policy indicating that the evaluation is successful in confirming that the RHD satisfies the requirements specified by the policy, the one or more actions performed by the validator component further comprise sending a proof-of-compliance to an external entity that provided the policy, wherein the proof-of-compliance is asserted as proof that the RHD satisfies the requirements specified by the policy.
5 . The RHD of claim 1 , wherein, responsive to the result of the evaluation of the policy indicating that the evaluation is unsuccessful in confirming that the RHD satisfies the requirements specified by the policy, the one or more actions performed by the validator component comprise:
(i) disallowing loading of at least one bitstream comprised in the configuration into at least one region of programmable logic;
(ii) altering the configuration by loading an altered version of the bitstream into at least one region of programmable logic;
(iii) disabling at least one region of programmable logic; or
(iv) any combination of (i-iii).
6 . The RHD of claim 1 , wherein:
in order to perform the evaluation of the policy, the validator component is further configured to determine whether a set of the properties of the RHD is cryptographically signed with a private key that is aligned with a public key in the RHD; and
the result of the evaluation of the policy is successful if the set of the properties of the RHD is cryptographically signed with the private key that is aligned with the public key in the RHD and the set of the properties of the RHD satisfies the one or more requirements defined by the policy and otherwise the result of the evaluation of the policy is unsuccessful.
7 . The RHD of claim 1 , wherein:
the loader component is further configured to receive an initial policy before receiving the configuration; and
the validator component is further configured to:
determine whether the properties of the RHD satisfy a requirement defined by the initial policy;
responsive to determining that the properties of the RHD satisfy the requirement defined by the initial policy, send an indication that the initial policy is satisfied to an external entity that provided the initial policy.
8 . The RHD of claim 1 , wherein the validator component is further configured to:
receive a set of measurements from a set of sensors associated to the RHD, the set of measurements being indicative of one or more of the properties of the RHD; and
perform the evaluation of the policy based on the set of measurements.
9 . The RHD of claim 8 wherein, responsive to the evaluation result indicating that the evaluation is not successful in confirming that the RHD satisfies the requirements specified by the policy, the one or more actions performed by the validator component comprises:
(i) disallowing loading of at least one bitstream comprised in the configuration into at least one region of programmable logic;
(ii) altering the configuration by loading an altered version of the bitstream into at least one region of programmable logic;
(iii) disabling at least one region of programmable logic; or
(iv) any combination of (i)-(iii).
10 . A method performed by a Reconfigurable Hardware Device, RHD, that comprises at least one region of programmable logic the method comprising:
receiving a configuration to be loaded onto the RHD, wherein at least one bitstream for the at least one region of programmable logic is comprised in the configuration, wherein the configuration further includes a policy that specifies requirements on properties of the RHD that must be satisfied in order for the configuration as received to be loaded onto the RHD;
obtaining the policy from the configuration;
performing an evaluation of the policy based on the properties of the RHD, to check whether the RHD satisfies the requirements specified by the policy; and
performing one or more actions based on a result of the evaluation of the policy.
11 . The method of claim 10 wherein obtaining the policy comprises obtaining the policy from a loader component configured to receive the configuration.
12 . The method of claim 10 , wherein, responsive to the result of the evaluation of the policy indicating that the evaluation is successful in confirming that the RHD satisfies the requirements specified by the policy, the one or more actions comprise allowing at least one bitstream comprised in the configuration to be loaded into at least one region of programmable logic.
13 . The RHD of claim 1 , wherein the loader component is configured to receive the configuration from an external entity that defines the policy, owns the configuration, and uses the RHD.
14 . The RHD of claim 13 , wherein the external entity uses the RHD as part of an Infrastructure-as-a-Service (IaaS) offering.
15 . The RHD of claim 1 , wherein the policy is specific to a user of the RHD, a bitstream, an Intellectual Property (IP) vendor, or an IP block, and is not specific to the RHD.
16 . The RHD of claim 1 , wherein the requirements specified by the policy include one or more of:
a requirement on a geolocation of the RHD;
a requirement on available hardware capabilities of the RHD;
a requirement on physical protection of the RHD; or
a requirement on an organization that owns, controls, or is authorized to manage the RHD.
17 . The RHD of claim 1 , wherein the policy specifies requirements on properties of the RHD that include a property defining a security class which is settable individually per virtual instance accessing the RHD or which is settable individually per device.
18 . The method of claim 10 , wherein said receiving comprises receiving the configuration from an external entity that defines the policy, owns the configuration, and uses the RHD.
19 . The method of claim 18 , wherein the external entity uses the RHD as part of an Infrastructure-as-a-Service (IaaS) offering.
20 . The method of claim 10 , wherein the policy is specific to a user of the RHD, a bitstream, an Intellectual Property (IP) vendor, or an IP block, and is not specific to the RHD.