Implementing access control by system-on-chip

1. A system-on-chip (SoC), comprising:

an access control unit to:

receive a message comprising an access control data item;

validate the message using a value of a message digest function of contents of the message and a value of a state variable reflecting a state of communications between the access control unit and a programming agent that has initiated the message, wherein the value of the state variable is derived from a previous value of the message digest function calculated within a current communication session between the access control unit and the programming agent;

update the state variable using the value of the message digest function of the contents of the message; and

control, using the access control data item, access by an initiator device to a target device.

2. The SoC of claim 1 , wherein the message digest function is provided by a cryptographic hash function.

3. The SoC of claim 1 , wherein the access control data item comprises at least one of: an access control rule or an address translation rule.

4. The SoC of claim 3 , wherein the access control rule comprises at least one of: an identifier of the initiator device, an identifier of the target device, an address range, an access permission, or an access authorization type.

5. The SoC of claim 1 , wherein the access control unit is implemented by a network-on-chip (NoC) comprising a filtering firewall to enforce access control using the access control data item while transporting at least one of data frames or electric signals between the initiator device and the target device.

6. The SoC of claim 1 , wherein the access control unit is implemented by a memory management unit (MMU) to enforce access control using the access control data item while translating a first address to a second address referencing a memory location on the target device.

7. A system-on-chip (SoC), comprising:

an access control unit to:

receive an access control programming message comprising an access control data item;

validate the access control programming message using value of a message digest function of contents of the access control programming message, wherein the message digest function is computed using a session key, and wherein validating the access control programming message comprises validating the session key using an intermediate output of the message digest function; and

control, using the access control data item, access by an initiator device to a target device.

8. The SoC of claim 7 , wherein the message digest function is provided by a cryptographic hash function.

9. The SoC of claim 7 , wherein the access control data item comprises at least one of: an access control rule or an address translation rule.

10. The SoC of claim 7 , wherein the access control programming message further comprises a target address for storing the access control data item.

11. The SoC of claim 7 , wherein the access control unit is further configured to:

receive, prior to receiving the access control programming message, a session key and a session key signature; and

validate the session key by comparing the session key signature with a value of the message digest function of the session key, wherein the message digest function is computed using a hardcoded key.

12. The SoC of claim 7 , wherein validating the access control programming message comprises validating the session key using an intermediate output of the message digest function.

13. The SoC of claim 7 , wherein the access control unit is implemented by a network-on-chip (NoC) comprising a filtering firewall to enforce access control using the access control data item while transporting at least one of data frames or electric signals between the initiator device and the target device.

14. The SoC of claim 7 , wherein the access control unit is implemented by a memory management unit (MMU) to enforce access control using the access control data item while translating a first address to a second address referencing a memory location on the target device.

15. A system-on-chip (SoC), comprising:

an access control unit comprising a key register for storing a key value and a secure memory for storing access control data, the access control unit to:

receive a session key and a session key signature;

validate the session key by comparing the session key signature with a value of a message digest function of the session key, wherein the message digest function is computed using the key value stored by the key register;

receive an access control programming message comprising an access control data item and an access control data item signature;

validate the access control programming message by comparing the access control data item signature with a value of the message digest function of contents of the access control programming message, wherein the message digest function is computed using the session key;

store the access control data item in the secure memory; and

control, using the access control data item, access by an initiator device to a target device.

16. The SoC of claim 15 , wherein the message digest function is provided by a cryptographic hash function.

17. The SoC of claim 15 , further comprising a reset unit to:

responsive to detecting a transition into a test mode, clear the key register.

18. The SoC of claim 15 , further comprising a reset unit to:

responsive to detecting a transition into a functional mode, load an initial key value into the key register.

19. The SoC of claim 15 , further comprising a reset unit to:

responsive to detecting a transition into a functional mode, disable scanning the key register.

20. The SoC of claim 15 , further comprising a reset unit to:

responsive to detecting a transition into a functional mode, clear the secure memory storing the access control data.

21. A method, comprising:

receiving, by an access control unit of a system-on-chip (SoC), a message comprising an access control data item;

validating the message using a value of a message digest function of contents of the message and a value of a state variable reflecting a state of communications between the access control unit and a programming agent that has initiated the message, wherein the value of the state variable is derived from a previous value of the message digest function calculated within a current communication session between the access control unit and the programming agent;

updating the state variable using the value of the message digest function of the contents of the message; and

controlling, using the access control data item, access by an initiator device to a target device.

22. The method of claim 21 , wherein the message digest function is provided by a cryptographic hash function.

23. The method of claim 21 , wherein the access control data item comprises at least one of: an access control rule or an address translation rule.

24. The method of claim 23 , wherein the access control rule comprises at least one of: an identifier of the initiator device, an identifier of the target device, an address range, an access permission, or an access authorization type.

25. A method, comprising:

receiving, by an access control unit of a system-on-chip (SoC), an access control programming message comprising an access control data item;

validating the access control programming message using a value of a message digest function of contents of the access control programming message, wherein the message digest function is computed using a session key, and wherein validating the access control programming message comprises validating the session key using an intermediate output of the message digest function; and

controlling, using the access control data item, access by an initiator device to a target device.

26. The method of claim 25 , wherein the message digest function is provided by a cryptographic hash function.

27. The method of claim 25 , wherein the access control data item comprises at least one of: an access control rule or an address translation rule.

28. The method of claim 25 , wherein the access control programming message further comprises a target address for storing the access control data item.

29. The method of claim 25 , further comprising:

receiving, prior to receiving the access control programming message, a session key and a session key signature; and

validating the session key by comparing the session key signature with a value of the message digest function of the session key, wherein the message digest function is computed using a hardcoded key.

30. The method of claim 29 , wherein validating the access control programming message comprises validating the session key using an intermediate output of the message digest function.

31. A method, comprising:

receiving, by an access control unit of a system-on-chip (SoC), a session key and a session key signature;

validating the session key by comparing the session key signature with a value of a message digest function of the session key, wherein the message digest function is computed using the key value stored by a key register;

receiving an access control programming message comprising an access control data item and an access control data item signature;

validating the access control programming message by comparing the access control data item signature with a value of the message digest function of contents of the access control programming message, wherein the message digest function is computed using the session key;

controlling, using the access control data item, access by an initiator device to a target device.

32. The method of claim 31 , wherein the message digest function is provided by a cryptographic hash function.

33. The method of claim 31 , further comprising:

responsive to detecting a transition into a test mode, clearing the key register.

34. The method of claim 31 , further comprising:

responsive to detecting a transition into a functional mode, loading an initial key value into the key register.

35. The method of claim 31 , further comprising:

responsive to detecting a transition into a functional mode, disabling scanning the key register.

36. The method of claim 31 , further comprising a reset unit to:

responsive to detecting a transition into a functional mode, clearing a secure memory storing the access control data.