Access control for hardware resources

According to a method, an access request for a configuration module in a Field Programmable Gate Array (FPGA) may be received. The configuration module may be operable to configure functionality of the FPGA based on configuration information stored thereon. It may be determined whether the access request conforms to a specification specifying access control related to the configuration module. In response to determining that the access request conforms to the specification, the access request may be transmitted to the configuration module for access of the configuration information.

BACKGROUND

The present disclosure relates to access control, and more specifically, to access control for hardware resources. Computing capacity requirement increases as cognitive computing, artificial intelligence (AI), big data, computationally intensive applications and the like become popular. However, general-purpose processors are unable to meet the increasingly growing requirement of the computing capacity. In this case, more powerful hardware accelerators, such as Field Programmable Gate Arrays (FPGAs), have been developed for use in the environment with a heavy demand on the computing capacity, such as the cloud computing environment. However, conventional designs for hardware accelerators are insufficient to guarantee the security of the hardware accelerators.

SUMMARY

According to one embodiment of the present disclosure, there is provided a method. According to the method, an access request for a configuration module in an FPGA may be received. The configuration module may be operable to configure functionality of the FPGA based on configuration information stored thereon. It may be determined whether the access request conforms to a specification specifying access control related to the configuration module. In response to determining that the access request conforms to the specification, the access request may be transmitted to the configuration module for access of the configuration information.

According to another embodiment of the present disclosure, there is provided an FPGA. The FPGA may include a configuration module operable to configure functionality of the FPGA based on configuration information stored thereon. The FPGA may also include a specification module operable to: receive an access request for the configuration module, determine whether the access request conforms to a specification specifying access control related to the configuration module, and in response to determining that the access request conforms to the specification, transmit the access request to the configuration module for access of the configuration information.

According to yet another embodiment of the present disclosure, there is provided a system. The system may include one or more processors and a memory coupled to at least one of the processors. A set of computer program instructions may be stored in the memory and executed by at least one of the processors in order to perform actions of: receiving an access request for a configuration module in an FPGA, the configuration module being operable to configure functionality of the FPGA based on configuration information stored thereon; determining whether the access request conforms to a specification specifying access control related to the configuration module; and in response to determining that the access request conforms to the specification, transmitting the access request to the configuration module for access of the configuration information.

DETAILED DESCRIPTION

As used herein, the term “includes” and its variants are to be read as opened terms that mean “includes, but is not limited to.” The term “based on” is to be read as “based at least in part on.” The term “one embodiment” and “an embodiment” are to be read as “at least one embodiment.” The term “another embodiment” is to be read as “at least one other embodiment.” Other definitions, explicit and implicit, may be included below.

Moreover, it is to be understood that in the context of the present disclosure, the terms “first,” “second,” “third” and the like are used to indicate individual elements or components, without suggesting any limitation as to the order of these elements. Further, unless otherwise indicated, a first element may or may not be the same as a second element. Other definitions, explicit and implicit, may be included below.

Reference is first made toFIG. 1, in which an example computer system/server12which is applicable to implement the embodiments of the present disclosure is shown.FIG. 1is also adapted to depict an illustrative example of a portable electronic device such as a communication device which is applicable to implement the embodiments of the present disclosure. Computer system/server12is only illustrative and is not intended to suggest any limitation as to the scope of use or functionality of embodiments of the disclosure described herein.

As mentioned above, the conventional hardware accelerator design, such as the FPGA design, is insufficient to guarantee the security of the hardware accelerator. An example of the conventional hardware accelerator architecture200is shown inFIG. 2. The conventional hardware accelerator architecture200includes an FPGA210. Hereinafter, the FPGA is described as an example of the hardware accelerator. However, it is to be understood that examples of the hardware accelerator are not limited to the FPGA, but may include any hardware devices that are capable of performing acceleration, such as an Application Specific Integrated Circuit (ASIC).

The FPGA210is an integrated circuit that is configurable by the user after being manufactured. The FPGA210may serve as the processing unit16shown inFIG. 1. As shown inFIG. 2, the FPGA210includes a configuration module220and an interface module230. The configuration module220is operable to configure functionality of the FPGA210based on configuration information stored thereon. Typically, the configuration information is specified using a hardware description language (HDL). In other cases, any other machine-readable languages may be used to specify the configuration information.

Specifically, the configuration module220may configure, based on the configuration information, the logical behaviors of all or some of the logic cells (not shown) in the FPGA210to implement the functionality of the FPGA210. A logic cell is the smallest functional unit of the FPGA. Each logic cell may contain a lookup table (LUT) to implement a combinational logic and a flip-flop, which stores the output of the LUT, to implement the sequential logic. The LUT can encode any n-input Boolean function by storing the truth table of the function into the LUT, where n is an integer larger than one. This is an efficient way of encoding Boolean logic functions, and providing reconfigurable hardware logic capabilities for the FPGA. As an example, in order to implement an AND gate function, the truth table stored in the LUT may be as shown in Table 1:

Additionally, the configuration module220may also configure, based on the configuration information, the properties of all or some of the pins (not shown) of the FPGA in order to implement the functionality of the FPGA210. For example, the configuration module220may configure a pin to a certain logic level (such as a logic low level, a logic high level, or a high resistance level), or may configure the pin as an input pin or an output pin.

The FPGA210may receive, from an administrative interface, such as a Joint Test Action Group (JTAG) interface, an access request for the configuration module220to access the configuration information stored thereon. The access request may be an operation for reading configuration information from the configuration module220and/or writing configuration information to the configuration module220.

Alternatively, the FPGA210may also receive, from a non-administrative interface, an access request for the configuration module220to access the configuration information. The non-administrative interface may be a Universal Serial Bus (USB) interface, a Peripheral Component Interconnect Express (PCIe) interface, an Ethernet interface, and/or the like.

Different from the access request which is received from the administrative interface which is directly transmitted to the configuration module220, the access request received from the non-administrative interface is first transmitted to the interface module230. The interface module230may convert the access request received from the non-administrative interface into a format suitable for the configuration module220, and then transmit the converted access request to the configuration module220.

In conventional hardware accelerator architectures, such as the architecture200, there is no access control for the received access requests. For example, when a user programs the FPGA by accessing the configuration information stored in the configuration module in a cloud computing environment, a cloud provider may be required to provide full control of the FPGA to the user. With the full control, any types of access requests may be issued by the user to the FPGA. However, due to the unawareness of the user in the configuration of the FPGA, or due to the misoperation or malicious operation of the user on the configuration module, the FPGA may be misconfigured. For example, a harmful configuration file may be downloaded to the configuration module, and thus bringing the FPGA into a dangerous state. Therefore, the lack of access control in the hardware accelerator architecture results in disastrous security problems.

Moreover, since the FPGA may interact directly with the external circuits of a Printed Circuit Board (PCB) containing the FPGA, such as circuits for Double Data Rate (DDR), USB and PCIe, the misconfigured FPGA may also damage these external circuits, the PCB, or even the host machine hosting the PCB. As an example, if the configuration of the FPGA does not match the circuits to which the FPGA connects, the PCB may be damaged. Specifically, if a pin of the FPGA is electrically connected to a logic high level (such as, 3.3V), but the user configures in the access request the pin to an inverse logic level, that is, a logic low level (such as, GND), such configuration will cause a short circuit accident and thus damage that pin or the FPGA.

Typically, an FPGA vendor has full knowledge of the FPGA only and a service provider (such as the cloud provider) has full knowledge of the hardware environment. Due to the knowledge limitation, neither the FPGA vendor nor the service provider can perform access control for the FPGA. In particular with only the knowledge of the FPGA but without any knowledge about how the FPGA is used in the hardware environment, the FPGA vendor cannot specify the allowable or restricted configuration in the hardware environment. For example, although the FPGA vendor knows about the prescribed logic levels of the pins of the FPGA, the FPGA vendor is unable to constrain the logic levels to which the pins are actually connected in field. Thus, the FPGA vendor is only able to perform the security check for the internal circuits within the FPGA, but is unable to perform the security check based on the hardware environment.

On the other hand, although the cloud provider has full knowledge of the hardware environment, the cloud provider is unable to constrain how the user programs the FPGA for the purpose of preserving security for the FPGA. Typically, configuration information stored in the configuration module of the FPGA may be of a private format which is not public to the cloud provider. In this case, the cloud provider fails to control, for example, how the user configures the logic levels of the pins of the FPGA, and thus is unable to prevent the pins from connecting to incorrect logic levels.

A partial reconfiguration technology has been proposed to implement some kind of access control in the FPGA. The partial reconfiguration is the process of changing a part of the FPGA without affecting the other parts. For example, the user may configure a reconfigurable area of the FPGA without affecting the logic levels of the pins outside that area. However, even with the partial reconfiguration technology, it is unable to constrain the user to only configure a specific area of the FPGA. The user may still be able to configure other areas of the FPGA, for example, by downloading a full configuration file for configuring the overall functionality of the FPGA into the configuration module.

Embodiments of the present disclosure provide a new solution for access control for hardware resources is proposed. According to the solution, a specification module is introduced to perform access control for a configuration module of an FPGA. The specification module is operable to determine whether an access request destined for the configuration module conforms to specific predefined criterion and decide whether to transmit the access request to the configuration module based on the determination. Through the solution, it is possible to achieve access control of the FPGA by providing access requests that conform to the predefined specification only to the configuration module.

FIG. 3shows a schematic diagram of an example hardware accelerator architecture300in accordance with embodiments of the present disclosure. It should be understood that the structure and function of the hardware accelerator architecture300shown inFIG. 3is for purpose of illustration and does not imply any limitation on the scope of the present disclosure. Embodiments of the present disclosure may be embodied in different structures and/or functions.

The hardware accelerator architecture300includes an FPGA310and a specification module320. The FPGA310may serve as the processing unit16shown inFIG. 1. As shown inFIG. 3, the FPGA310includes a configuration module330and an interface module340.

The configuration module330is operable to configure functionality of the FPGA310based on configuration information stored thereon. Typically, the configuration information is specified using a hardware description language (HDL). In other cases, any other machine-readable languages may be used to specify the configuration information. Specifically, the configuration module330may configure, based on the configuration information, the logical behaviors of all or some of the logic cells (not shown) in the FPGA310to implement the functionality of the FPGA310. Additionally, the configuration module330may also configure, based on the configuration information, the properties of all or some of the pins (not shown) of the FPGA in order to implement the functionality of the FPGA310.

The interface module340may convert the access request received from the non-administrative interface into a format suitable for the configuration module330, and then transmit the converted access request to the configuration module330.

In addition to the configuration module330and the interface module340, the FPGA310further includes a specification module350. The specification module350may be implemented in a non-volatile storage that is either one-time programming or multi-time programming. Other storage implementations of the specification module350are also possible. In the example ofFIG. 3, the specification module350is built in the FPGA310. However, the arrangement of the specification module350may be varied and an alternative arrangement will be discussed below with reference toFIG. 4.

Still referring toFIG. 3, the specification module350may store a specification specifying access control related to the configuration module330. Specifically, the specification may specify the access control for at least one of the following: one or more interfaces from which the access request to the configuration module330is received, one or more users attempting to access the configuration module330, and/or part or all of the configuration information stored in the configuration module330. Now some examples of the specification contained in the specification module350will be discussed.

Access control for an interface.

In some embodiments, the specification may specify different privileges for one or more interfaces of the FPGA310from which the access request for the configuration module330may be received. In this way, the access control can be achieved based on the privileges of the interfaces. For example, since the administrative interface is generally used by a user with high privilege, such as an administrator, the administrative interface may be assigned with a higher privilege above a non-administrative interface(s). In this case, the access request received from the administrative interface may be accepted for transmission to the configuration module330, but the access request received from the non-administrative interface may be discarded.

Access control for a user.

In some embodiments, the specification may specify different privileges for one or more users. For example, an administrator may be assigned with a higher privilege above a normal user. In this case, the access request issued by the administrator may be accepted for transmission to the configuration module330, but the access request issued by the normal user may be discarded. Alternatively, or in addition, the specification may contain user credentials or keys. In this case, the access request from a normal user who also provides a user credential or key that match the user credential or key contained in the specification may also be accepted for transmission to the configuration module330.

Access control for the configuration information.

The specification may specify the access control for part or all of the configuration information for one or more pins and/or logic gates of the FPGA310. In the embodiments of access control for the pins, the specification may specify allowable properties for one or more pins in the configuration information. Specifically, the specification may specify the allowable level standard for a given pin (such as TTL, LVTTL, CMOS or the like). Alternatively, or in addition, the specification may specify an allowable logic level for one or more pins. For example, the specification may specify whether a pin is allowable to be set to a logic low level, a logic high level, a high resistance level, or the like. In some other embodiments, the specification may specify an allowable I/O state for one or more pins. For example, the specification may specify whether a pin is allowable to be set as an input pin or an output pin. In this case, the configuration information of the properties of a pin(s) may be locked to the specified allowable pin states, such that the access request that intends to change the configuration information for the pin(s) to the unallowable states will be denied.

Although the access control has been described with respect to the interface, the user and the configuration information, respectively, the access control can be specified for any combination of the interface, the user and the configuration information.

In the embodiments of access control for the logic gates of the FPGA310, the specification may specify that configuration information of certain logic gates is accessible to certain users. In this way, the configuration information of the logic gates is locked for access requests from the specified users. Specifically, the specification may specify that the configuration information of the logic gates of an encryption area may be allowed to be accessed by a first user, and the configuration information of the logic gates of an image decoding area may be allowed to be accessed by a second user. In this way, the configuration information for the logic gates of the encryption area is locked to be accessed by the first user, while the configuration information for the logic gates of the image decoding area are locked to be accessed by the second user.

In some embodiments, the configuration information for the logic gates may be locked by addresses of the logic gates, either physical addresses or logical addresses in the configuration module330. For example, the encryption area may include the logic gates of the addresses 0-99, and the image encoding area may include the logic gates of the addresses 100-149. In this case, the specification may specify that the configuration information for the logic gates of the addresses 0-99 may be allowed to be accessed by the first user, and the configuration information for the logic gates of the addresses 100-149 may be allowed to be accessed by the second user. Note that the values of the above addresses are illustrative, and do not intend to limit the scope of the present disclosure.

As mentioned above, the FPGA310may receive, from the administrative interface or the non-administrative interface, an access request for the configuration module330to access the configuration information. The access request may be an operation for reading the configuration information from the configuration module330and/or writing the configuration information in the configuration module330.

The specification module350may determine whether the received access request conforms to the specification. Specifically, the specification module350may determine whether the access request conforms to the specification based on at least one of the following: the interface of the FPGA310from which the access request is received, the user issuing the access request, and the part of the configuration information in the configuration module330to be accessed. In response to determining that the access request conforms to the specification, the specification module350may transmit the access request to the configuration module330to access the configuration information. Otherwise, the specification module350may discard the access request.

Some examples of the specification have been discussed above. The determination in the specification module350based on the specification will be described in detail below.

Determination based on the interface.

In some embodiments, the specification module350may perform the determination based on the access control for the interface specified in the specification. For example, the specification module350may perform the determination based on whether the interface has a predetermined privilege. As described above, the administrative interface may be assigned with a higher privilege above the non-administrative interface. In this case, the specification module350may determine that the access request received from the administrative interface may be accepted because it conforms to the specification and thus may be transmitted to the configuration module. The access request received from the non-administrative interface may be determined as failing to conform to the specification and thus will be discarded.

Determination based on the user.

In some embodiments, the specification module350may perform the determination based on the access control for the user specified in the specification. For example, the specification module350may perform the determination based on whether the user has a predetermined privilege. As described above, the administrator may have a higher privilege above the normal user. In this case, the specification module350may determine that the access request issued by the administrator may be accepted because it conforms to the specification and thus may be transmitted to the configuration module. The access request from the normal user may be determined as failing to conform to the specification and thus will be discarded.

Determination based on the configuration information.

In some embodiments, the specification module350may perform the determination based on the access control for the part of configuration information for the pins of the FPGA specified in the specification. For example, in the case that the specification specifies that the configuration information of a pin is allowed to be set to a logic high level, that is, the pin is locked to the logic high level, the specification module350may determine that the access request attempting to set the configuration information of the pin to a logic low level in the configuration information210fails to conform to the specification and thus will be discarded.

Alternatively, or in addition, in some embodiments, the specification module350may perform the determination based on the access control for the part of configuration information for the logic gates of the FPGA. For example, in the case that the specification specifies that the configuration information for the logic gates of the addresses 0-99 are allowed to be accessed by the first user, the access request from the second user attempting to access the configuration information for the logic gates of the addresses 0-99 will be discarded.

Although the determination has been described with respect to the interface, the user, and the configuration information respectively, the determination can be made based on any combination of the interface, the user and the configuration information.

In some embodiments, if the access request is determined to be discarded, the specification module350may generate an alert message to notify the user that the access request has been denied.

By employing the specification specifying the access control related to the configuration module330, it is possible to eliminate the misconfiguration of the hardware resources which could easily damage the hardware or even cause serious disasters. In addition, hardware resource sharing can be achieved in the multi-user environment with security for such sharing guaranteed in the meantime.

In order to provide more flexibility to the hardware accelerator architecture300, in some embodiments, a specification control module320is provided to set/modify the specification. In some embodiments, as shown inFIG. 3, the specification control module320may be built outside the FPGA310.

In some embodiments, the specification control module320may transmit, to the specification module350, access control information for setting the specification via the interfaces of the FPGA310. In response to receiving the access control information, the specification module350may set the specification based on the access control information. For example, the specification may originally specify that the configuration information of a pin is locked to a logic high level, and the specification control module320may provide the access control information for modifying the specification, such that the modified specification may specify that the configuration information of the pin may be a logic low level or a high resistance level.

In some embodiments, the specification module350may determine whether the access control information received from the specification control module320can be used to set its specification. The determination of setting the specification may be based on the interface from which the access control information is received, and/or the user who prescribing the access control information.

In an embodiment, the specification module350may determine whether the interface of the FPGA has a predetermined privilege for setting the specification. As described above, the administrative interface may be assigned with a higher privilege above the non-administrative interface. In this case, the specification module350may determine that the access control information received from the administrative interface may be used to set the specification, but the access control information received from the non-administrative interface may not be used. As another example, the specification module350may determine that the access control information received from the administrative interface may be used to set the whole specification, but the access control information received from the non-administrative interface may only be used to set a certain part of the specification.

In another embodiment, the specification module350may determine whether the user of from whom the access request is issued has a predetermined privilege for setting the specification. As described above, the administrator may have a higher privilege above the normal user. In this case, the specification module350may determine that the access control information provided by the administrator may be used to set the specification, but the access control information provided by the normal user may not be used. As another example, the specification module350may determine that the access control information provided by the administrator may be used to set the whole specification, but the access control information provided by the normal user may only be used to set a certain part of the specification.

As an alternative, or in addition to the access control information, privilege information, such as user credentials or keys, may be provided or obtained from the specification control module320to the specification module350. In this case, the specification module320may check the provided user credentials or keys against the user credentials or keys stored in the specification module350, such that the specification may only be set by the authorized users.

For example, in the case that the specification control module320provides or allows to obtain the access control information along with the privilege information to the specification module350via the non-administrative interface, even if the non-administrative interface is of low privilege, the specification module350may also set the specification based on the access control information.

Optionally, in the event that the specification module350refuses to set the specification based on the access control information, the specification module350may also generate an alert message to notify the user that the setting of the specification has been refused.

FIG. 4shows a schematic diagram of another example hardware accelerator architecture400in accordance with embodiments of the present disclosure. It should be understood that the structure and function of the hardware accelerator architecture400shown inFIG. 4is for illustrative purposes only and does not imply any limitation on the scope of the present disclosure. Embodiments of the present disclosure may be embodied in different structures and/or functions.

The hardware accelerator architecture400includes an FPGA410and a specification control module320. The FPGA410may be implemented in the computer system/server12. As shown inFIG. 4, the FPGA410includes the configuration module330and the interface module340. The functions of the configuration module330and the interface module340are substantially the same as those described with reference toFIG. 3and thus details thereof are omitted for sake of brevity.

Different from the FPGA310shown inFIG. 3, a specification module350is set in the external specification control module320, rather than in the FPGA410. In this way, no change needs to be made to the FPGA410while access control for the configuration module330can still be achieved.

In the example ofFIG. 4, the access request destined for the configuration module330in the FPGA410is first received by the specification module350. The specification module350performs the same function of access control to the access request as in the example ofFIG. 3. If the specification module350determines that the access request conforms to the specification, the specification module350transmits the access request to the configuration module330to access the configuration information either via the administrative interface or the non-administrative interface of the FPGA410. Otherwise, in response to determining that the access request fails to conform to the specification, the specification module350discards the access request.

In order to set/modify the specification, the specification control module320may provide the specification module350with the access control information to set the specification based on the access control information.

In some embodiments, as described above, the specification module350may determine whether the user and/or the interface of the FPGA have a predetermined privilege for setting the specification. Also, in the case that the specification control module320provides the privilege information, the specification module320may check the provided privilege information against the privilege information stored in the specification module350, such that the specification may only be set by the authorized users.

Optionally, in the event that the specification module350refuses to set the specification based on the access control information, the specification module350may also generate an alert message to notify the user that the setting of the specification has been refused.

In this way, similar toFIG. 3, it is possible to eliminate the misconfiguration of the hardware resources which could easily damage the hardware or even cause serious disasters, and secure hardware resource sharing can be achieved in the multi-user environment. Additionally, since no change needs to be made to the FPGA410, the hardware accelerator architecture400provides more flexibility.

FIG. 5is a flow chart of a method500implemented in the example hardware accelerator architecture300or400in accordance with embodiments of the present disclosure. The method500is entered in block510, where the specification module receives an access request for the configuration module330in the FPGA310or410.

In block520, the specification module350determines whether the access request conforms to a specification specifying access control related to the configuration module330. In some embodiments, whether the access request conforms to the specification is determined based on at least one of the following: an interface of the FPGA310or410from which the access request is received, a user issuing the access request, and part of the configuration information in the configuration module330to be accessed. For example, the part of configuration information includes at least one of the following: part of configuration information for a pin of the FPGA310or410and part of configuration information for a logic gate of the FPGA310or410.

In block530, in response to determining that the access request conforms to the specification, the specification module350transmits the access request to the configuration module330for access of the configuration information. In block540, in response to determining that the access request fails to conform to the specification, the specification module350discards the access request.

In this way, the misconfiguration of the hardware resources which could easily damage the hardware or even cause serious disasters can be avoided.

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

Workloads layer90provides examples of functionality for which the cloud computing environment may be utilized. Examples of workloads and functions which may be provided from this layer include: mapping and navigation91; software development and lifecycle management92; virtual classroom education delivery93; data analytics processing94; transaction processing95; and access control for hardware resources96. Access control for hardware resources96may relate to a configuration module in a Field Programmable Gate Array (FPGA). The configuration module may be operable to configure functionality of the FPGA based on configuration information stored thereon. The configuration module may determine whether the access request conforms to a specification specifying access control related to the configuration module. In response to determining that the access request conforms to the specification, the access request may be transmitted to the configuration module for access of the configuration information.