Secure asset management system
In a general aspect, a system can include a processor having a secure mode and a non-secure mode, and a secure module configured to respond to tokens posted by the processor in the secure mode. Each token can identify a secure asset, and source and destination addresses within secure and public address spaces. The secure module can include a memory storing secure assets identifiable by the tokens and a memory access circuit to read data from source addresses and write processed data to destination addresses. The system can further include a cryptography engine configured to process the read data using identified secure assets. The secure module can respond to tokens posted in the non-secure mode. The memory can store, with each secure asset, a respective rule defining the address spaces where the memory access circuit may read and write data. The secure module can ignore tokens that do not satisfy respective rules.
1. A data processing system with a trusted execution environment, the data processing system comprising:
a host processor configured to operate in a secure mode associated with the trusted execution environment and a non-secure mode;
a system bus operationally coupled with the host processor;
a resource connected to the system bus, wherein the resource is partitioned into a secure area and a non-secure area, wherein the secure area is accessible using a first set of addresses within a secure address space of the secure area, and wherein the non-secure area is accessible by the host processor operating in the secure mode and the non-secure mode using a second set of addresses within a public address space of the non-secure area; and
a secure module connected to the system bus, the secure module being configured to respond to tokens posted by the host processor in the secure mode, wherein a given token of the tokens identifies:
a respective secure asset of a plurality of secure assets;
respective source addresses within the secure address space of the secure area of the resource; and
respective destination addresses within the public address space of the non-secure area of the resource, the secure module including:
an internal memory storing the plurality of secure assets identifiable by the tokens;
a memory access circuit configured to, for the given token, read data from the resource connected to the system bus using the respective source addresses and write processed data to the resource connected to the system bus using the respective destination addresses; and
a cryptography engine configured to, for a given token, process the read data using the respective secure asset,
the secure module being further configured to respond to tokens posted by the host processor in the non-secure mode,
the internal memory of the secure module storing a respective rule with each secure asset of the plurality of secure assets, the respective rule defining permissions as to the public address space and the secure address space where the memory access circuit is authorized to read data and write data, and
the secure module ignores tokens that do not satisfy the permissions defined in the respective rule.
2. The data processing system of claim 1 , further comprising cross-domain rules for tokens posted by the host processor in the non-secure mode, the cross-domain rules allowing for reading data from one of the public address space or the secure address space and writing resulting data to an other of the public address space or the secure address space.
3. The data processing system of claim 2 , wherein a cross-domain rule of the cross-domain rules allows for reading the data from the public address space and writing the resulting data to the secure address space in response to a decryption token.
4. The data processing system of claim 2 , wherein a cross-domain rule of the cross-domain rules allows for reading the data from the secure address space and writing the resulting data to the public address space in response to an encryption token.
5. The data processing system of claim 1 , wherein all rules for the plurality of secure assets, in the non-secure mode, constrain access to the public address space.
6. The data processing system of claim 1 , wherein the respective rule includes a flag identifying one of the secure address space or the public address space, indicating where source data is located, and the respective rule constrains read access to the one of the secure address space or the public address space identified by the flag.
7. The data processing system of claim 1 , wherein the resource is part of a plurality of resources that comprise a system memory area and a secure peripheral.