Data release control based on authentication and link protection
First data is stored. A request for the first data is received from a communication device over a link established with a communication device. An access control engine comprising circuitry is to control access to the first data to the communication device based on an authentication state of the communication device and a protection state of the link.
1. An apparatus comprising:
a memory to store first data; and
an access control engine comprising circuitry, the access control engine to:
receive a request for the first data from a communication device over a link established with the communication device;
control access to the first data to the communication device based on an authentication state of the communication device and a protection state of the link; and
provide access to the first data to the communication device responsive to a determination that the protection state of the link indicates that confidentiality, replay, and integrity protections are enabled for the link;
wherein the link is a Peripheral Component Interconnect Express (PCIe) link and the apparatus and the communication device comprise PCIe endpoints to communicate over the PCIe link.
2. The apparatus of claim 1 , wherein the access control engine is to block access to the first data to the communication device responsive to a determination that the protection state of the link indicates that one or more of confidentiality, replay, and integrity protections are not enabled for the link.
3. The apparatus of claim 1 , wherein the authentication state indicates whether immutable components of the communication device have been authenticated.
4. The apparatus of claim 1 , wherein the authentication state indicates whether mutable components of the communication device have been authenticated.
5. The apparatus of claim 1 , wherein the authentication state indicates whether credentials of a user associated with the first data have been authenticated.
6. The apparatus of claim 1 , wherein the access control engine is to control access to the first data to the communication device based on the authentication state and the protection state of the link responsive to a determination that the first data is to be protected.
7. The apparatus of claim 6 , wherein the access control engine is to provide access to second data over the link to the communication device without checking the protection state of the link responsive to a determination that the data is not protected.
8. The apparatus of claim 1 , wherein, upon a determination that the protection state of the link has degraded, the access control engine is to deny access to the first data over the link to the communication device until the protection state of the link is restored.
9. The apparatus of claim 8 , wherein the determination that the protection state of the link has degraded is made responsive to a notification that the link is to transition to a low power state.
10. The apparatus of claim 8 , wherein the determination that the protection state of the link has degraded is made responsive to a notification that a checksum of a message transmitted over the link is invalid.
11. The apparatus of claim 8 , wherein responsive to the determination that the protection state of the link has degraded, the access control engine is to deny access to the first data over the link until authentication is performed again.
12. The apparatus of claim 1 , wherein responsive to a determination that the authentication state or the protection state of the link is insufficient to provide access to the first data, the access control engine is to cause a register accessible by the communication device to be written to, the register to indicate that the first data is inaccessible over the link.
13. The apparatus of claim 1 , wherein responsive to a determination that the authentication state or the protection state of the link is insufficient to provide access to the first data, the apparatus is to tear down the link.
14. The apparatus of claim 1 , further comprising a host computing device and the second communication device.
15. A method comprising:
storing first data;
receiving, by a first Peripheral Component Interconnect Express (PCIe) endpoint, a request for the first data from a second PCIe endpoint over a PCIe link established with the second PCIe endpoint;
controlling, by an access control engine comprising circuitry, access to the first data to the second PCIe endpoint based on an authentication state of the second PCIe endpoint and a protection state of the link; and
providing access to the first data to the communication device responsive to a determination that the protection state of the link indicates that confidentiality, replay, and integrity protections are enabled for the link.
16. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:
store first data;
receive a request for the first data from a communication device over a link established with a communication device; and
control access to the first data to the communication device based on an authentication state of the communication device and a protection state of the link, wherein the link is a Peripheral Component Interconnect Express (PCIe) link and the machine and the communication device comprise PCIe endpoints to communicate over the link, wherein controlling access to the first data comprises providing access to the first data to the communication device responsive to a determination that the protection state of the link indicates that confidentiality, replay, and integrity protections are enabled for the link.
17. The storage medium of claim 16 , wherein controlling access to the first data comprises blocking access to the first data to the communication device responsive to a determination that the protection state of the link indicates that one or more of confidentiality, replay, and integrity protections are not enabled for the link.