Secure data access methods and apparatus
View Patent ↗Embodiments include systems and methods for securely accessing data in the context of a data transaction. A system may include a memory block, within which a memory partition may be allocated to the data transaction. The memory partition includes a data storage block and at least one binding register. The system also includes platform entities and an access control block, which determines whether a particular platform entity may access data within the data storage block, and whether a particular platform entity may write binding information into a binding register. Access also may be granted or denied based on the current state of a state machine associated with the data transaction. The system also includes a cipher/binding function adapted to encrypt the data, using the binding information, for storage on an unsecured memory device, and to decrypting encrypted data, using the binding information, which is retrieved from the unsecured memory device.
1. A method for securely accessing data in the context of a data transaction, the method being performed in a multi-processor platform that includes multiple platform entities and a memory block, and comprising the steps of:
a module of the multi-processor platform initiating the data transaction by allocating a memory partition within the memory block to the data transaction, wherein the memory partition includes a plurality of binding registers and a data block;
receiving, from each platform entity in a set of the multiple platform entities, a write request and binding information for each of the plurality of binding registers;
determining, by the module of the multi-processor platform, whether each platform entity in the set of the multiple platform entities is permitted to participate in the data transaction;
when each platform entity in the set of the multiple platform entities is allowed to participate in the data transaction, storing the binding information received from each platform entity in the set of the multiple platform entities into the plurality of binding registers;
writing data, by a first platform entity of the set of the multiple platform entities, into the data block of the memory partition within the memory block;
writing a Bus ID of a second platform entity into a first binding register of the plurality of binding registers, wherein the Bus ID forms at least a portion of the binding information from the second platform entity, and wherein the first platform entity and the second platform entity include either a same platform entity or different platform entities;
encrypting the data using the binding information in each of the plurality of binding registers to produce encrypted data; and
storing the encrypted data on a peripheral memory device.
2. The method of claim 1 , wherein
receiving the write request and the binding information comprises a second platform entity attempting to write of the binding information into at least one binding register of the plurality of binding registers, wherein the first platform entity and the second platform entity include either a same platform entity or different platform entities; and
determining whether each platform entity is permitted to participate in the data transaction comprises determining that the second platform entity is permitted to write the binding information when the second platform entity is assigned to a memory function role that allows writing to the binding register, wherein a platform entity is assigned to one or more of a plurality of memory function roles.
3. The method of claim 1 , further comprising the steps of:
determining whether the second platform entity is a Resource Manager; and
when the second platform entity is the Resource Manager, permitting the second platform entity to write a second binding value into a memory controller binding register of the plurality of binding registers.
4. The method of claim 1 , further comprising the steps of:
determining whether a second platform entity is a Memory Owner; and
when the second platform entity is the Memory Owner, permitting the second platform entity to write a second binding value into a memory owner binding register of the plurality of binding registers, wherein the second binding value is the binding information from the second platform entity, and wherein the first platform entity and the second platform entity include either a same platform entity or different platform entities.
5. The method of claim 1 , further comprising the steps of:
determining whether a second platform entity is a Memory Owner; and
when the second platform entity is the Memory Owner, permitting the second platform entity to write access permissions information into an access permissions binding register of the plurality of binding registers, wherein the access permissions information is the binding information from the second platform entity, and wherein the first platform entity and the second platform entity include either a same platform entity or different platform entities.
6. The method of claim 5 , further comprising:
determining whether the first platform entity is identified in the access permissions information as having permission to write the data; and
when the first platform entity is identified in the access permissions information as having permission to write the data, permitting the first platform entity to write the data.
7. The method of claim 1 , further comprising the steps of:
initiating a state machine for the data transaction, wherein the state machine includes a user state; and
permitting the first platform entity to write the data when the state machine is in the user state.
8. The method of claim 7 , wherein the state machine further includes a control state, and the method further comprises the step of:
a second platform entity attempting to write Resource Manager-provided binding information into a Resource Manager binding register of the plurality of binding registers, wherein the first platform entity and the second platform entity include either a same platform entity or different platform entities; and
permitting the second platform entity to write the Resource Manager-provided binding information when the state machine is in the control state.
9. The method of claim 7 , wherein the state machine further includes an owner state, and the method further comprises the step of:
a second platform entity attempting to write Memory Owner-provided binding information into a Memory Owner binding register of the plurality of binding registers, wherein the first platform entity and the second platform entity include either a same platform entity or different platform entities; and
permitting the second platform entity to write the Memory Owner-provided binding information when the state machine is in the owner state.
10. The method of claim 1 , wherein encrypting comprises:
also encrypting the data using a device identifier.
11. A method for securely accessing data in the context of a data transaction, the method being performed in a multi-processor platform that includes multiple platform entities and a memory block, and comprising the steps of:
a module of the multi-processor platform initiating the data transaction by allocating a memory partition of the memory block to the data transaction, wherein the memory partition includes at least one binding register and a data block;
receiving, from a first platform entity in a set of the multiple platform entities and after the memory partition has been allocated, access permissions information and a write request identifying a first binding register of the at least one binding register;
determining, by the module of the multi-processor platform, whether the first platform entity is permitted to participate in the data transaction;
when the first platform entity of the set of the multiple platform entities is permitted to participate in the data transaction, writing the access permissions information into the first binding register, wherein the access permissions information forms at least a portion of binding information for encrypting data within the data block of the memory partition or for decrypting encrypted data to produce data to be stored in the data block of the memory partition, wherein the data includes data being transferred between a second platform entity and a peripheral memory device, writing a Bus ID of the second platform entity into a first binding register of the plurality of binding registers, wherein the Bus ID forms at least a portion of the binding information from the second platform entity, and wherein the first platform entity and the second platform entity include either a same platform entity or different platform entities;
receiving, from the second platform entity, an access request identifying the data block and indicating a requested type of access;
when the access permissions indicate that the second platform entity is permitted to perform the requested type of access, encrypting or decrypting data in the data block of the memory partition using the binding information in the at least one binding register, which includes the access permissions; and
allowing the second platform entity to access the data.
12. The method of claim 11 , wherein encrypting or decrypting and allowing the second platform entity to access the data comprises:
for a write type of access request, encrypting the data using the binding information to produce encrypted data; and
storing the encrypted data to an unsecured memory device.
13. The method of claim 11 , wherein encrypting or decrypting and allowing the second platform entity to access the data comprises:
for a read type of access request, retrieving encrypted data from an unsecured memory device; and
decrypting the encrypted data using the binding information to produce the data.
14. The method of claim 11 , further comprising the steps of:
a third platform entity attempting to write Resource Manager-provided binding information into a second register of the at least one binding register, wherein some or all of the first platform entity, the second platform entity, and the third platform entity include either a same platform entity or different platform entities; and
permitting the third platform entity to write the Resource Manager-provided binding information when the third platform entity is a Resource Manager.
15. The method of claim 11 , further comprising the steps of:
a third platform entity attempting to write Memory Owner-provided binding information into a second register of the at least one binding register, wherein some or all of the first platform entity, the second platform entity, and the third platform entity include either same platform entities or different platform entities; and
permitting the third platform entity to write the Memory Owner-provided binding information when the third platform entity is a Memory Owner.
16. The method of claim 11 , further comprising the steps of:
providing additional binding information in the at least one binding register, wherein the additional binding information is provided by a set of the multiple platform entities that are permitted to participate in the data transaction.
17. A multi-processor platform for securely accessing data in the context of a data transaction, the platform comprising:
a memory block, within which a memory partition is allocated to the data transaction, wherein the memory partition includes a data storage block and at least one binding register, and wherein the data storage block is adapted to store data being transferred between a platform entity and an unsecured memory device, and wherein the at least one binding register is adapted to store binding information, wherein the binding information includes information provided by a set of platform entities that are permitted to participate in the data transaction, and the binding information includes information that at least partially identifies the set of the multiple platform entities that are permitted to participate in the data transaction;
the set of platform entities, wherein each of the set of platform entities includes one or more hardware blocks adapted to perform one or more functions;
an access control block, adapted to initiate the data transaction by allocating the memory partition within the memory block to the data transaction, to receive, from each platform entity in the set of platform entities, a write request and binding information for each of the at least one binding register, to determine whether each platform entity in the set of platform entities is permitted to participate in the data transaction, including determining whether a particular platform entity of the set of platform entities is permitted to access the data and whether the particular platform entity is permitted to write a portion of the binding information, and, when each platform entity is allowed to participate in the data transaction, to allow the binding information received from each platform entity to be stored into the at least one binding register;
writing a Bus ID of a second platform entity into a first binding register of the plurality of binding registers, wherein the Bus ID forms at least a portion of the binding information from the second platform entity, and wherein the particular platform entity and the second platform entity include either a same platform entity or different platform entities;
and cipher/binding function adapted, in the context of the data transaction, to encrypt the data, using the binding information in each binding register of the at least one binding register, for storage on the unsecured memory device, and to decrypt encrypted data, using the binding information, which is retrieved from the unsecured memory device.
18. The platform of claim 17 , wherein the memory block, the set of platform entities, the access control block, and the cipher/binding function are included within a system-on-a-chip.
19. The platform of claim 17 , wherein the memory block, the set of platform entities, the access control block, and the cipher/binding function are included within a system-in-package.
20. The platform of claim 17 , wherein the apparatus is selected from a group of apparatus that includes a cellular telephone, a pager, a radio, a personal data assistant, a portable media player, a computer, a controller, a set top box, and a gaming system.
21. A multi-processor platform for securely accessing data in the context of a data transaction, the platform comprising:
a memory block, which includes a memory partition that can be allocated to the data transaction, wherein the memory partition includes a data storage block and at least one binding register, and wherein the data storage block is adapted to store data being transferred between a platform entity of a set of platform entities of the multi-processor platform and an unsecured memory device, and wherein the at least one binding register is adapted to store access permissions information;
the set of platform entities, wherein each of the set of platform entities includes one or more hardware blocks adapted to perform one or more functions;
an access control block, adapted to initiate the data transaction by allocating the memory partition within the memory block to the data transaction, to receive, from a first platform entity in the set of platform entities, a write request and access permissions information, to store the access permissions information in the at least one binding register when a determination is made that the first platform entity is permitted to participate in the data transaction, and to determine whether a second platform entity of the set of platform entities is permitted to access the data based at least in part on the access permissions information;
writing a Bus ID of a second platform entity into a first binding register of the plurality of binding registers, wherein the Bus ID forms at least a portion of the binding information from the second platform entity, and wherein the first platform entity and the second platform entity include either a same platform entity or different platform entities; and
a cipher/binding function adapted, in the context of the data transaction and when the second platform entity is permitted to access the data, to encrypt the data, using at least the access permissions information in the at least one binding register, for storage on the unsecured memory device, and to decrypt encrypted data, using at least the access permissions information, which is retrieved from the unsecured memory device.