Security processor with bus configuration
View Patent ↗A security subsystem controls the data transfer rights among components of a secured system via a common bus. The security subsystem includes a secure block that is coupled to an access controller, preferably via a hard-wired connection to the controller. This secure block exclusively controls the access rights among components, and can effectively isolate security functions and data from the main processor. Because the security is provided via access control to components or subsets of components via a common bus, an efficient and effective integration of the security subsystem within the secured system can be achieved.
1. A system comprising:
a main processor that is configured to effect a primary function of the system,
a plurality of components that are configured to transfer data via a bus that is common to the main processor,
an access controller that is configured to selectively inhibit data transfers between the main processor and one or more components of the plurality of components, based on defined access rights, and
a secure block that is independent of the main processor and is configured to define the access rights;
wherein,
the access controller is configured to selectively inhibit the data transfers based on contents of an access control matrix whose contents define the access rights between the main processor and the one or more components, and
the secure block is configured to exclusively control the contents of the access control matrix, and
the access control matrix includes a definition of access rights to the access control matrix that exclusively limit a right to modify the contents of the access control matrix to the secure block.
2. The system of claim 1 , wherein
the plurality of components includes a first input/output component that is operably coupled to the main processor, and
the secure block includes a second input/output component that is isolated from the main processor.
3. The system of claim 1 , wherein
the secure block includes:
a security processor,
a memory, and
an input/output component.
4. The system of claim 3 , wherein
the secure block further includes
one or more elements that facilitate cryptographic processing.
5. The system of claim 1 , wherein
the plurality of components includes:
a key component and
a cryptographic component, operably coupled to the main processor, that provides a cryptographic process based on a key value contained in the key component,
the secure block is configured to provide the key value to the key component, and
the access controller is configured by the secure block to inhibit data transfers between the key component and the main processor via the bus, while allowing data transfers between the secure block and the key component and between the cryptographic component and the key component via the bus.
6. The system of claim 1 , wherein
the plurality of components includes:
an input/output component that is configured to receive information from an external source, and
a memory component that is configured to store the information, and
the secure block is configured to:
determine an authentication of the information, and
deny access rights between the memory component and the main processor until the authentication is determined.
7. The system of claim 1 , further including
a timing device, operably coupled to the secure block, that is configured to provide measures of time duration, and
wherein
the secure block is configured to define one or more of the access rights based on at least one of the measures of time duration.