Secure serial peripheral interface communication
This document discloses aspects of secure serial peripheral interface (SPI) communication. In some aspects, a secure SPI communication module monitors communications transmitted by a host to a peripheral block that is coupled to the host via a SPI interconnect. The module compares respective commands of the communications sent by the host to information indicating commands that the peripheral block is not authorized to execute. Based on the comparing, the module determines that one of the respective commands is one of the commands that the peripheral block is not authorized to execute. The module then prevents the peripheral block from receiving at least a portion of the respective command of the communication. By so doing, the module can prevent the peripheral block from executing unauthorized commands, which may compromise security of the peripheral block.
1 . A method implemented by security circuitry associated with a host of a system for secure serial peripheral interface communication, the method comprising:
monitoring communications transmitted by the host to a peripheral block of the system that is coupled to the host via a serial peripheral interface (SPI) interconnect;
comparing respective commands of the communications sent by the host to information indicating which commands the peripheral block is not authorized to execute;
determining, based on the comparing, that one of the respective commands comprises a write-status-register command that the peripheral block is not authorized to execute; and
in response to determining that the peripheral block is not authorized to execute the write-status-register command, altering the write-status-register command to prevent the write-status-register command from altering a status register of the peripheral block.
2 . The method of claim 1 , wherein the respective command comprises a first command of a first communication, and the method further comprises: determining that the peripheral block is not authorized to execute a second command of a second communication sent by the host to the peripheral block; and preventing the peripheral block from receiving at least a portion of the second command that the peripheral block is not authorized to execute.
3 . The method of claim 2 , wherein the preventing comprises altering the state of the chip select line and the clock line of the SPI interconnect to prevent the peripheral block from receiving the at least a portion of the second command of the second communication sent by the host.
4 . The method of claim 3 , wherein:
the second command of the second communication comprises eight bits; and
the altering comprises deasserting the chip select line prior to or on an eighth clock cycle by which an eighth bit of the second command is communicated via the SPI interconnect to prevent at least the eighth bit of the second command from being processed by the peripheral block.
5 . The method of claim 3 , wherein:
the second command of the second communication comprises eight bits; and
the altering comprises gating the clock line prior to or on an eighth clock cycle by which an eighth bit of the second command is communicated via the SPI interconnect to prevent at least the eighth bit of the second command from being processed by the peripheral block.
6 . The method of claim 1 , wherein the altering of the write-status-register command comprises:
setting bit positions of the write-status-register command to predefined bit values to provide an altered write-status-register command; and
passing, to the peripheral block, the altered write-status-register command that comprises the predefined bit values and other bits of the write-status-register command.
7 . The method of claim 1 , wherein the information indicating which commands that the peripheral block is not authorized to execute comprises a table of:
the commands that the peripheral block is not authorized to execute; and
commands that the peripheral block is authorized to execute.
8 . The method of claim 7 , further comprising configuring, prior to the monitoring of the communications, the table of the commands that the peripheral block is not authorized to execute and the commands that the peripheral block is authorized to execute.
9 . The method of claim 7 , wherein the comparing of the respective commands of the communications sent by the host to the information of the table comprises:
indexing, based on the respective commands, into the table to determine whether the respective commands are authorized for execution by the peripheral block.
10 . The method of claim 1 , wherein:
the peripheral block of the system comprises a memory module coupled to the host via the SPI interconnect, the memory module comprising one of non-volatile memory or Flash memory; or
the peripheral block of the system does not include a write protect input node or a write protect input node of the peripheral block is disabled.
11 . The method of claim 10 , further comprising verifying a binary image stored on the memory module of the system before attempting to load the binary image from the memory module to the host via the SPI interconnect.
12 . The method of claim 11 , further comprising:
in response to successful verification of the binary image, allowing the memory module to send the binary image to the host via the SPI interface; or
in response to unsuccessful verification of the binary image, preventing the memory module from sending the binary image to the host via the SPI interface.
13 . The method of claim 12 , wherein the binary image is a first binary image stored in a first partition of the memory module, and the method further comprises:
manipulating an address of a read command for the first binary image to cause the memory module to send a second binary image to the host from a second partition of the memory module.
14 . An integrated circuit including circuitry for secure serial peripheral interface communication, the circuitry comprising:
a host with a functional core;
at least one peripheral block;
a serial peripheral interface (SPI) interconnect coupling the host and the at least one peripheral block; and
a secure SPI communication module operably coupled with the SPI interconnect and configured to:
monitor communications transmitted by the host to a peripheral block of the at least one peripheral block of the integrated circuit that is coupled to the host via the serial peripheral interface (SPI) interconnect;
compare respective commands of the communications sent by the host to information indicating which commands the peripheral block is not authorized to execute;
determine, based on the comparing, that one of the respective commands comprises a write-status-register command that the peripheral block is not authorized to execute; and
in response to the determination that the peripheral block is not authorized to execute the write-status-register command, alter the write-status-register command to prevent the write-status-register command from altering a status register of the peripheral block.
15 . The integrated circuit of claim 14 , wherein: the respective command comprises a first command of a first communication; and the secure SPI communication module is further configured to: determine that the peripheral block is not authorized to execute a second command of a second communication sent by the host to the peripheral block; and prevent the peripheral block from receiving at least a portion of the second command that the peripheral block is not authorized to execute.
16 . The integrated circuit of claim 15 , wherein the secure SPI communication module is further configured to alter the state of the chip select line and the clock line of the SPI interconnect to prevent the peripheral block from receiving the at least a portion of the respective second command of the second communication sent by the host.
17 . The integrated circuit of claim 16 , wherein:
the second command of the second communication comprises eight bits; and
the secure SPI communication module is further configured to deassert the chip select line prior to or on an eighth clock cycle by which an eighth bit of the second command is communicated via the SPI interconnect to prevent at least the eighth bit of the second command from being processed by the peripheral block.
18 . The integrated circuit of claim 16 , wherein:
the second command of the second communication comprises eight bits; and
the secure SPI communication module is further configured to gate the clock line prior to or on an eighth clock cycle by which an eighth bit of the second command is communicated via the SPI interconnect to prevent at least the eighth bit of the second command from being processed by the peripheral block.
19 . The method of claim 2 , wherein the preventing comprises altering a state of a chip select line or a clock line of the SPI interconnect to prevent the peripheral block from receiving the at least a portion of the second command of the second communication sent by the host.
20 . The integrated circuit of claim 15 , wherein the secure SPI communication module is further configured to alter a state of a chip select line or a clock line of the SPI interconnect to prevent the peripheral block from receiving the at least a portion of the second command of the second communication sent by the host.