IMAGE SIGNAL PROCESSOR SUPPORTING MULTIPLE SECURITY DOMAINS ON A SHARED PHYSICAL LINK

This disclosure provides systems, methods, and devices for wireless communication that support improved routing of image sensors that share a PHY within different secure domains. In a first aspect, a device may receive a packet from an image sensor along a physical data connection. The device may determine a virtual channel associated with the packet and may determining a secure domain for the packet based on the virtual channel. The first secure domain may be selected from a plurality of secure domains accessible via the physical data connection, such as based on a mapping maintained by the device. The device may then route the packet within the first secure domain such that further processing and storage of the packet occurs within the first secure domain, such as within a context base associated with the first secure domain. Other aspects and features are also claimed and described.

TECHNICAL FIELD

Aspects of the present disclosure relate generally to image processing, and more particularly, to receiving and routing data packets from image sensors. Some features may enable and provide improved image processing, including receiving and routing data packets within different secure domains.

INTRODUCTION

Image capture devices are devices that can capture one or more digital images, whether still image for photos or sequences of images for videos. Capture devices can be incorporated into a wide variety of devices. By way of example, image capture devices may comprise stand-alone digital cameras or digital video camcorders, camera-equipped wireless communication device handsets, such as mobile telephones, cellular or satellite radio telephones, personal digital assistants (PDAs), panels or tablets, gaming devices, computer devices such as webcams, video surveillance cameras, or other devices with digital imaging or video capabilities.

The increasing amount of image data captured by the image capture device has some negative effects that accompany the increasing resolution obtained by the additional image data. Additional image data increases the amount of processing performed by the image capture device in determining image frames and videos from the image data, as well as in performing other operations related to the image data. For example, the image data may be processed through several processing blocks for enhancing the image before the image data is displayed to a user on a display or transmitted to a recipient in a message. Each of the processing blocks consumes additional power proportional to the amount of image data, or number of megapixels, in the image capture. The additional power consumption may shorten the operating time of an image capture device using battery power, such as a mobile phone.

Image sensors may communicate with other components of an image capture device, such as an image signal processor, using one or more physical data connections. In certain instances, the amount of data being transmitted or the number of image sensors that need to be communicated with may be limited by the capacity of the physical data connections.

BRIEF SUMMARY OF SOME EXAMPLES

Techniques for improved routing of data packets received from image sensors are provided. In particular, techniques are provided that enable the routing of data packets from multiple image sensors that are received via the same PHY to be routed to different secure domains. Virtual channels for received data packets may be mapped to corresponding secure domains, which may change over time depending on the applications accessing the image sensors. Data and applications utilizing particular secure domains may be prevented from accessing or writing to other secure domains. In particular, based on the virtual channel for a packet, a corresponding secure domain may be determined, and the ISP may enable the packet to be routed within the secure domain, such as by writing the contents of the packet to a corresponding context base for the secure domain.

These techniques enable the routing of data packets from multiple image sensors to different secure domains even if the image sensors communicated using the same PHY. Such implementations may improve the security of image processing, such as by protecting against data leakage between applications accessing different cameras on the same PHY or data leakage between multiple applications accessing the same camera. Such techniques may also improve the flexibility, cost, and complexity of image processing systems, as secure deployments that rely on fewer PHYs are still possible without adding additional PHYs.

In one example application, vehicles include several cameras that may share a common physical PHY link and also support different domains and use cases. For example, an in-cabin driver-facing camera may be used for face authentication, driver monitoring, and video call functions governed by different software domains, with each domain having different security restrictions. Aspects of this disclosure include virtual channels within an image signal processor as a path-based approach to support multiple security domains sharing a common physical PHY link. The sharing of a PHY link reduces area and cost in the image signal processor compared to having different physical paths for each security domain. Identifiers for data, formatted as packets in some embodiments, identify different domain IDs and segment image data and image statistics within different system memory context banks for content protection. In some embodiments, each security domain may be further divided into sub-domains for carrying image data in a first sub-domain and image metadata in a second sub-domain of each security domain.

Each virtual channel may have a specific assigned context bank in a secure storage unit. Different cameras within a vehicle may be assigned different security domains. For example, the driver monitoring and/or authentication cameras may have a first security domain and cameras capturing the vehicle surroundings may have a second security domain. As another example, the driver monitoring cameras may have a first security domain, authentication cameras may have a second security domain, and cameras capturing the vehicle surroundings may have a third security domain. Although vehicle applications are described, other combinations of cameras on other devices may be assigned different security domains. For example, a mobile computing device may have authentication cameras in a first security domain and photography cameras in a second security domain.

When the virtual channels are implemented in an image signal processor, hardware in the image signal processor may be shared between security domains and/or specifically assigned to a security domain. For example, an image signal processor may include multiple image front ends (IFEs) in which the IFEs are assigned to a first security domain or a second security domain in a fixed manner or through a dynamic reallocation.

In one aspect, the techniques described herein relate to an apparatus including an image signal processor and a memory. The memory may store instructions which, when executed by the image signal processor, cause the processor to receive a packet from an image sensor along a physical data connection and determine a virtual channel associated with the packet. The image processor may also determine, based on the virtual channel, a first secure domain for the packet and route the packet within the first secure domain. The first secure domain may be selected from a plurality of secure domains accessible via the physical data connection.

In another aspect, the techniques described herein relate to a method that includes receiving, by an image signal processor, a packet from an image sensor along a physical data connection and determining, by the image signal processor, a virtual channel associated with the packet. The method may also include determining, by the image signal processor based on the virtual channel, a first secure domain for the packet and routing, by the image signal processor, the packet within the first secure domain. The first secure domain may be selected from a plurality of secure domains accessible via the physical data connection.

In another aspect, the techniques described herein relate to a non-transitory, computer-readable medium storing instructions which, when executed by an image signal processor, cause the image signal processor to receive a packet from an image sensor along a physical data connection and determine a virtual channel associated with the packet. The instructions may further cause the image signal processor to determine, based on the virtual channel, a first secure domain for the packet and route the packet within the first secure domain. The first secure domain may be selected from a plurality of secure domains accessible via the physical data connection.

In some aspects, the techniques described herein relate to an image capture device including a first image sensor, a second image sensor, an image signal processor, a first shared physical link coupling the first image sensor to the image signal processor and coupling the second image sensor to the image signal processor, and a memory. The memory may store instructions which, when executed by the image signal processor, cause the image signal processor to receive a packet from an image sensor along a physical data connection and determine a virtual channel associated with the packet. The instructions may further cause the image signal processor to determine, based on the virtual channel, a first secure domain for the packet and route the packet within the first secure domain. The first secure domain is selected from a plurality of secure domains accessible via the physical data connection.

Methods of image processing described herein may be performed by an image capture device and/or performed on image data captured by one or more image capture devices. Image capture devices—devices that can capture one or more digital images whether still image photos or sequences of images for videos—can be incorporated into a wide variety of devices. By way of example, image capture devices may comprise stand-alone digital cameras or digital video camcorders, camera-equipped wireless communication device handsets, such as mobile telephones, cellular or satellite radio telephones, personal digital assistants (PDAs), panels or tablets, gaming devices, computing devices, such as webcams, video surveillance cameras, or other devices with digital imaging or video capabilities.

The image processing techniques described herein may involve digital cameras having image sensors and processing circuitry (e.g., application specific integrated circuits (ASICs), digital signal processors (DSP), graphics processing unit (GPU), or central processing units (CPU)). An image signal processor (ISP) may include one or more of these processing circuits and configured to perform operations to obtain the image data for processing according to the image processing techniques described herein and/or involved in the image processing techniques described herein. The ISP may be configured to control the capture of image frames from one or more image sensors and determine one or more image frames from the one or more image sensors to generate a view of a scene in an output image frame. The output image frame may be part of a sequence of image frames forming a video sequence. The video sequence may include other image frames received from the image sensor or other images sensors.

In an example application, the image signal processor (ISP) may receive an instruction to capture a sequence of image frames in response to the loading of software, such as a camera application, to produce a preview display from the image capture device. The image signal processor may be configured to produce a single flow of output image frames, based on images frames received from one or more image sensors. The single flow of output image frames may include raw image data from an image sensor, binned image data from an image sensor, or corrected image data processed by one or more algorithms within the image signal processor. For example, an image frame obtained from an image sensor, which may have performed some processing on the data before output to the image signal processor, may be processed in the image signal processor by processing the image frame through an image post-processing engine (IPE) and/or other image processing circuitry for performing one or more of tone mapping, portrait lighting, contrast enhancement, gamma correction, etc. The output image frame from the ISP may be stored in memory and retrieved by an application processor executing the camera application, which may perform further processing on the output image frame to adjust an appearance of the output image frame and reproduce the output image frame on a display for view by the user.

After an output image frame representing the scene is determined by the image signal processor and/or determined by the application processor, such as through image processing techniques described in various embodiments herein, the output image frame may be displayed on a device display as a single still image and/or as part of a video sequence, saved to a storage device as a picture or a video sequence, transmitted over a network, and/or printed to an output medium. For example, the image signal processor (ISP) may be configured to obtain input frames of image data (e.g., pixel values) from the one or more image sensors, and in turn, produce corresponding output image frames (e.g., preview display frames, still-image captures, frames for video, frames for object tracking, etc.). In other examples, the image signal processor may output image frames to various output devices and/or camera modules for further processing, such as for 3A parameter synchronization (e.g., automatic focus (AF), automatic white balance (AWB), and automatic exposure control (AEC)), producing a video file via the output frames, configuring frames for display, configuring frames for storage, transmitting the frames through a network connection, etc. Generally, the image signal processor (ISP) may obtain incoming frames from one or more image sensors and produce and output a flow of output frames to various output destinations.

In some aspects, the output image frame may be produced by combining aspects of the image correction of this disclosure with other computational photography techniques such as high dynamic range (HDR) photography or multi-frame noise reduction (MFNR). With HDR photography, a first image frame and a second image frame are captured using different exposure times, different apertures, different lenses, and/or other characteristics that may result in improved dynamic range of a fused image when the two image frames are combined. In some aspects, the method may be performed for MFNR photography in which the first image frame and a second image frame are captured using the same or different exposure times and fused to generate a corrected first image frame with reduced noise compared to the captured first image frame.

In some aspects, a device may include an image signal processor or a processor (e.g., an application processor) including specific functionality for camera controls and/or processing, such as enabling or disabling the binning module or otherwise controlling aspects of the image correction. The methods and techniques described herein may be entirely performed by the image signal processor or a processor, or various operations may be split between the image signal processor and a processor, and in some aspects split across additional processors.

The device may include one, two, or more image sensors, such as a first image sensor. When multiple image sensors are present, the image sensors may be differently configured. For example, the first image sensor may have a larger field of view (FOV) than the second image sensor, or the first image sensor may have different sensitivity or different dynamic range than the second image sensor. In one example, the first image sensor may be a wide-angle image sensor, and the second image sensor may be a tele image sensor. In another example, the first sensor is configured to obtain an image through a first lens with a first optical axis, and the second sensor is configured to obtain an image through a second lens with a second optical axis different from the first optical axis. Additionally or alternatively, the first lens may have a first magnification, and the second lens may have a second magnification different from the first magnification. Any of these or other configurations may be part of a lens cluster on a mobile device, such as where multiple image sensors and associated lenses are located in offset locations on a frontside or a backside of the mobile device. Additional image sensors may be included with larger, smaller, or same field of views. The image processing techniques described herein may be applied to image frames captured from any of the image sensors in a multi-sensor device.

In an additional aspect of the disclosure, a device configured for image processing and/or image capture is disclosed. The apparatus includes means for capturing image frames. The apparatus further includes one or more means for capturing data representative of a scene, such as image sensors (including charge-coupled devices (CCDs), Bayer-filter sensors, infrared (IR) detectors, ultraviolet (UV) detectors, complimentary metal-oxide-semiconductor (CMOS) sensors) and time of flight detectors. The apparatus may further include one or more means for accumulating and/or focusing light rays into the one or more image sensors (including simple lenses, compound lenses, spherical lenses, and non-spherical lenses). These components may be controlled to capture the first and/or second image frames input to the image processing techniques described herein.

Other aspects, features, and implementations will become apparent to those of ordinary skill in the art upon reviewing the following description of specific, exemplary aspects in conjunction with the accompanying figures. While features may be discussed relative to certain aspects and figures below, various aspects may include one or more of the advantageous features discussed herein. In other words, while one or more aspects may be discussed as having certain advantageous features, one or more of such features may also be used in accordance with the various aspects. In similar fashion, while exemplary aspects may be discussed below as device, system, or method aspects, the exemplary aspects may be implemented in various devices, systems, and methods.

The method may be embedded in a computer-readable medium as computer program code comprising instructions that cause a processor to perform the steps of the method. In some embodiments, the processor may be part of a mobile device including a first network adaptor configured to transmit data, such as images or videos in a recording or as streaming data, over a first network connection of a plurality of network connections; and a processor coupled to the first network adaptor and the memory. The processor may cause the transmission of output image frames described herein over a wireless communications network such as a 5G NR communication network.

DETAILED DESCRIPTION

As the number of concurrent cameras connected to individual computing devices increases, such as for mobile, automotive, and XR devices, it may be necessary to share more physical resources between multiple cameras. For example, physical data connections (e.g., a CSI PHY) may be shared by multiple image sensors. These PHYs may transmit data between the image sensors and an ISP. Data received from the image sensors may be sensitive in nature and it may be advantageous to ensure that data from one camera is not routed to an application used by another camera.

In such instances, it may be beneficial to implement multiple security domains within an ISP. Certain PHY-based security schemes may be limited to assigning all image sensors on one PHY to the same security domain, which may limit the number of security domains to the number of PHYs on the device. However, PHYs are an expensive resource and it is accordingly not always feasible or pragmatic to have a separate PHY for each image sensor or each desired secure domain. Accordingly, in instances where there is a need for more security domains than there are PHY links, alternative techniques for implementing security domains are necessary. In particular, it may be necessary to support separate security domains for cameras that operate on a single PHY link such that data from separate cameras does not leak into applications for other cameras.

Shortcomings mentioned here are only representative and are included to highlight problems that the inventors have identified with respect to existing devices and sought to improve upon. Aspects of devices described below may address some or all of the shortcomings as well as others known in the art. Aspects of the improved devices described herein may present other benefits and be used in applications other than those described above.

The present disclosure provides systems, apparatus, methods, and computer-readable media that support image processing, including techniques for routing data packets from multiple image sensors to different secure domains, even when the image sensors utilize the same PHY. In particular, techniques are provided that enable the routing of data packets from multiple image sensors that are received via the same PHY to be routed to different secure domains. Virtual channels for received data packets may be mapped to corresponding secure domains, which may change over time depending on the applications accessing the image sensors. Data and applications utilizing particular secure domains may be prevented from accessing or writing to other secure domains. In particular, based on the virtual channel for a packet, a corresponding secure domain may be determined, and the ISP may enable the packet to be routed within the secure domain, such as by writing the contents of the packet to a corresponding context base for the secure domain.

Particular implementations of the subject matter described in this disclosure may be implemented to realize one or more of the following potential advantages or benefits. In some aspects, the present disclosure provides techniques that enable the routing of data packets from multiple image sensors to different secure domains, even if the image sensors communicated using the same PHY. Such implementations may improve the security of image processing, such as by protecting against data leakage between applications accessing different cameras one the same PHY or data leakage between multiple applications accessing the same camera. Such techniques may also improve the flexibility, cost, and complexity of image processing systems, as secure deployments that rely on fewer PHYs are still possible without adding additional PHYs.

An example device for capturing image frames using one or more image sensors, such as a smartphone, may include a configuration of one, two, three, four, or more cameras on a backside (e.g., a side opposite a primary user display) and/or a front side (e.g., a same side as a primary user display) of the device. The devices may include one or more image signal processors (ISPs), Computer Vision Processors (CVPs) (e.g., AI engines), or other suitable circuitry for processing images captured by the image sensors. The one or more image signal processors (ISP) may store output image frames in a memory and/or otherwise provide the output image frames to processing circuitry (such as through a bus). The processing circuitry may perform further processing, such as for encoding, storage, transmission, or other manipulation of the output image frames.

As used herein, image sensor may refer to the image sensor itself and any certain other components coupled to the image sensor used to generate an image frame for processing by the image signal processor or other logic circuitry or storage in memory, whether a short-term buffer or longer-term non-volatile memory. For example, an image sensor may include other components of a camera, including a shutter, buffer, or other readout circuitry for accessing individual pixels of an image sensor. The image sensor may further refer to an analog front end or other circuitry for converting analog signals to digital representations for the image frame that are provided to digital circuitry coupled to the image sensor.

In the description of embodiments herein, numerous specific details are set forth, such as examples of specific components, circuits, and processes to provide a thorough understanding of the present disclosure. The term “coupled,” as used herein, means connected directly to or connected through one or more intervening components or circuits. Also, in the following description and for purposes of explanation, specific nomenclature is set forth to provide a thorough understanding of the present disclosure. However, it will be apparent to one skilled in the art that these specific details may not be required to practice the teachings disclosed herein. In other instances, well known circuits and devices are shown in block diagram form to avoid obscuring teachings of the present disclosure.

Some portions of the detailed descriptions which follow are presented in terms of procedures, logic blocks, processing, and other symbolic representations of operations on data bits within a computer memory. In the present disclosure, a procedure, logic block, process, or the like, is conceived to be a self-consistent sequence of steps or instructions leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, although not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated in a computer system.

Aspects of the present disclosure are applicable to any electronic device including, coupled to, or otherwise processing data from one, two, or more image sensors capable of capturing image frames (or “frames”). The terms “output image frame” and “corrected image frame” may refer to image frames that have been processed by any of the discussed techniques. Further, aspects of the present disclosure may be implemented in devices having or coupled to image sensors of the same or different capabilities and characteristics (such as resolution, shutter speed, sensor type, and so on). Further, aspects of the present disclosure may be implemented in devices for processing image frames, whether or not the device includes or is coupled to the image sensors, such as processing devices that may retrieve stored images for processing, including processing devices present in a cloud computing system.

The terms “device” and “apparatus” are not limited to one or a specific number of physical objects (such as one smartphone, one camera controller, one processing system, and so on). As used herein, a device may be any electronic device with one or more parts that may implement at least some portions of the disclosure. While the description and examples herein use the term “device” to describe various aspects of the disclosure, the term “device” is not limited to a specific configuration, type, or number of objects. As used herein, an apparatus may include a device or a portion of the device for performing the described operations.

Certain components in a device or apparatus described as “means for accessing,” “means for receiving,” “means for sending,” “means for using,” “means for selecting,” “means for determining,” “means for normalizing,” “means for multiplying,” or other similarly-named terms referring to one or more operations on data, such as image data, may refer to processing circuitry (e.g., application specific integrated circuits (ASICs), digital signal processors (DSP), graphics processing unit (GPU), central processing unit (CPU)) configured to perform the recited function through hardware, software, or a combination of hardware configured by software.

FIG.1shows a block diagram of an example device100for performing image capture from one or more image sensors. The device100may include, or otherwise be coupled to, an image signal processor112for processing image frames from one or more image sensors, such as a first image sensor101, a second image sensor102, and a depth sensor140. In some implementations, the device100also includes or is coupled to a processor104and a memory106storing instructions108. The device100may also include or be coupled to a display114and input/output (I/O) components116. I/O components116may be used for interacting with a user, such as a touch screen interface and/or physical buttons.

I/O components116may also include network interfaces for communicating with other devices, including a wide area network (WAN) adaptor152, a local area network (LAN) adaptor153, and/or a personal area network (PAN) adaptor154. An example WAN adaptor is a 4G LTE or a 5G NR wireless network adaptor. An example LAN adaptor153is an IEEE 802.11 WiFi wireless network adapter. An example PAN adaptor154is a Bluetooth wireless network adaptor. Each of the adaptors152,153, and/or154may be coupled to an antenna, including multiple antennas configured for primary and diversity reception and/or configured for receiving specific frequency bands.

The device100may further include or be coupled to a power supply118for the device100, such as a battery or a component to couple the device100to an energy source. The device100may also include or be coupled to additional features or components that are not shown inFIG.1. In one example, a wireless interface, which may include a number of transceivers and a baseband processor, may be coupled to or included in WAN adaptor152for a wireless communication device. In a further example, an analog front end (AFE) to convert analog image frame data to digital image frame data may be coupled between the image sensors101and102and the image signal processor112.

The device may include or be coupled to a sensor hub150for interfacing with sensors to receive data regarding movement of the device100, data regarding an environment around the device100, and/or other non-camera sensor data. One example non-camera sensor is a gyroscope, a device configured for measuring rotation, orientation, and/or angular velocity to generate motion data. Another example non-camera sensor is an accelerometer, a device configured for measuring acceleration, which may also be used to determine velocity and distance traveled by appropriately integrating the measured acceleration, and one or more of the acceleration, velocity, and/or distance may be included in generated motion data. In some aspects, a gyroscope in an electronic image stabilization system (EIS) may be coupled to the sensor hub or coupled directly to the image signal processor112. In another example, a non-camera sensor may be a global positioning system (GPS) receiver.

The image signal processor112may receive image data, such as used to form image frames. In one embodiment, a local bus connection couples the image signal processor112to image sensors101and102of a first camera103and second camera105, respectively. In another embodiment, a wire interface couples the image signal processor112to an external image sensor. In a further embodiment, a wireless interface couples the image signal processor112to the image sensors101,102.

The first camera103may include the first image sensor101and a corresponding first lens131. The second camera may include the second image sensor102and a corresponding second lens132. Each of the lenses131and132may be controlled by an associated autofocus (AF) algorithm133executing in the ISP112, which adjust the lenses131and132to focus on a particular focal plane at a certain scene depth from the image sensors101and102. The AF algorithm133may be assisted by depth sensor140.

The first image sensor101and the second image sensor102are configured to capture one or more image frames. Lenses131and132focus light at the image sensors101and102, respectively, through one or more apertures for receiving light, one or more shutters for blocking light when outside an exposure window, one or more color filter arrays (CFAs) for filtering light outside of specific frequency ranges, one or more analog front ends for converting analog measurements to digital information, and/or other suitable components for imaging. The first lens131and second lens132may have different field of views to capture different representations of a scene. For example, the first lens131may be an ultra-wide (UW) lens and the second lens132may be a wide (W) lens. The multiple image sensors may include a combination of ultra-wide (high field-of-view (FOV)), wide, tele, and ultra-tele (low FOV) sensors.

That is, each image sensor may be configured through hardware configuration and/or software settings to obtain different, but overlapping, field of views. In one configuration, the image sensors are configured with different lenses with different magnification ratios that result in different fields of view. The sensors may be configured such that a UW sensor has a larger FOV than a W sensor, which has a larger FOV than a T sensor, which has a larger FOV than a UT sensor. For example, a sensor configured for wide FOV may capture fields of view in the range of 64-84 degrees, a sensor configured for ultra-side FOV may capture fields of view in the range of 100-140 degrees, a sensor configured for tele FOV may capture fields of view in the range of 10-30 degrees, and a sensor configured for ultra-tele FOV may capture fields of view in the range of 1-8 degrees.

The camera103may be a variable aperture (VA) camera in which the aperture can be controlled to a particular size. Example aperture sizes are f/2.0, f/2.8, f/3.2, f/8.0, etc. Larger aperture values correspond to smaller aperture sizes, and smaller aperture values correspond to larger aperture sizes. The camera103may have different characteristics based on the current aperture size, such as a different depth of focus (DOF) at different aperture sizes.

The image signal processor112processes image frames captured by the image sensors101and102. WhileFIG.1illustrates the device100as including two image sensors101and102coupled to the image signal processor112, any number (e.g., one, two, three, four, five, six, etc.) of image sensors may be coupled to the image signal processor112. In some aspects, depth sensors such as depth sensor140may be coupled to the image signal processor112, and output from the depth sensors are processed in a similar manner to that of image sensors101and102. Example depth sensors include active sensors, including one or more of indirect Time of Flight (iToF), direct Time of Flight (dToF), light detection and ranging (Lidar), mmWave, radio detection and ranging (Radar), and/or hybrid depth sensors, such as structured light. In embodiments without a depth sensor140, similar information regarding depth of objects or a depth map may be generated in a passive manner from the disparity between two image sensors (e.g., using depth-from-disparity or depth-from-stereo), phase detection auto-focus (PDAF) sensors, or the like. In addition, any number of additional image sensors or image signal processors may exist for the device100.

In some embodiments, the image signal processor112may execute instructions from a memory, such as instructions108from the memory106, instructions stored in a separate memory coupled to or included in the image signal processor112, or instructions provided by the processor104. In addition, or in the alternative, the image signal processor112may include specific hardware (such as one or more integrated circuits (ICs)) configured to perform one or more operations described in the present disclosure. For example, the image signal processor112may include one or more image front ends (IFEs)135, one or more image post-processing engines136(IPEs), one or more auto exposure compensation (AEC)134engines, and/or one or more engines for video analytics (EVAs). The AF133, AEC134, IFE135, IPE136, and EVA137may each include application-specific circuitry, be embodied as software code executed by the ISP112, and/or a combination of hardware and software code executing on the ISP112.

In some implementations, the memory106may include a non-transient or non-transitory computer readable medium storing computer-executable instructions108to perform all or a portion of one or more operations described in this disclosure. In some implementations, the instructions108include a camera application (or other suitable application) to be executed by the device100for generating images or videos. The instructions108may also include other applications or programs executed by the device100, such as an operating system and specific applications other than for image or video generation. Execution of the camera application, such as by the processor104, may cause the device100to generate images using the image sensors101and102and the image signal processor112. The memory106may also be accessed by the image signal processor112to store processed frames or may be accessed by the processor104to obtain the processed frames. In some embodiments, the device100does not include the memory106. For example, the device100may be a circuit including the image signal processor112, and the memory may be outside the device100. The device100may be coupled to an external memory and configured to access the memory for writing output frames for display or long-term storage. In some embodiments, the device100is a system-on-chip (SoC) that incorporates the image signal processor112, the processor104, the sensor hub150, the memory106, and input/output components116into a single package.

In some embodiments, at least one of the image signal processor112or the processor104executes instructions to perform various operations described herein, including packet routing operations. For example, execution of the instructions can instruct the image signal processor112to begin or end capturing an image frame or a sequence of image frames, in which the capture includes routing packets from multiple image sensors to various secure domains, as described in embodiments herein. In some embodiments, the processor104may include one or more general-purpose processor cores104A capable of executing scripts or instructions of one or more software programs, such as instructions108stored within the memory106. For example, the processor104may include one or more application processors configured to execute the camera application (or other suitable application for generating images or video) stored in the memory106.

In executing the camera application, the processor104may be configured to instruct the image signal processor112to perform one or more operations with reference to the image sensors101or102. For example, a camera application executing on processor104may receive a user command to begin a video preview display, upon which a video comprising a sequence of image frames is captured and processed from one or more image sensors101or102through the image signal processor112. Image processing to generate “output” or “corrected” image frames, such as according to techniques described herein, may be applied to one or more image frames in the sequence. Execution of instructions108outside of the camera application by the processor104may also cause the device100to perform any number of functions or operations. In some embodiments, the processor104may include ICs or other hardware (e.g., an artificial intelligence (AI) engine124or other co-processor) to offload certain tasks from the cores104A. The AI engine124may be used to offload tasks related to, for example, face detection and/or object recognition. In some other embodiments, the device100does not include the processor104, such as when all of the described functionality is configured in the image signal processor112.

In some embodiments, the display114may include one or more suitable displays or screens allowing for user interaction and/or to present items to the user, such as a preview of the image frames being captured by the image sensors101and102. In some embodiments, the display114is a touch-sensitive display. The I/O components116may be or include any suitable mechanism, interface, or device to receive input (such as commands) from the user and to provide output to the user through the display114. For example, the I/O components116may include (but are not limited to) a graphical user interface (GUI), a keyboard, a mouse, a microphone, speakers, a squeezable bezel, one or more buttons (such as a power button), a slider, a switch, and so on.

While shown to be coupled to each other via the processor104, components (such as the processor104, the memory106, the image signal processor112, the display114, and the I/O components116) may be coupled to each another in other various arrangements, such as via one or more local buses, which are not shown for simplicity. While the image signal processor112is illustrated as separate from the processor104, the image signal processor112may be a core of a processor104that is an application processor unit (APU), included in a system on chip (SoC), or otherwise included with the processor104. While the device100is referred to in the examples herein for performing aspects of the present disclosure, some device components may not be shown inFIG.1to prevent obscuring aspects of the present disclosure. Additionally, other components, numbers of components, or combinations of components may be included in a suitable device for performing aspects of the present disclosure. As such, the present disclosure is not limited to a specific device or configuration of components, including the device100.

The exemplary image capture device ofFIG.1may be operated to improve the processing and security of data received from image sensors by enabling the routing of data packets from different image sensors to be routed to different secure domains, even if the image sensors utilize the same PHY. One example method of operating one or more cameras, such as camera103, is shown inFIG.2and described below.

FIG.2is a block diagram illustrating an example data flow path for image data processing in an image capture device according to one or more embodiments of the disclosure. A processor104of system200may communicate with image signal processor (ISP)112through a bi-directional bus and/or separate control and data lines. The processor104may control camera103through camera control210, such as for configuring the camera103through a driver executing on the processor104. The camera control210may be managed by a camera application204executing on the processor104, which provides settings accessible to a user such that a user can specify individual camera settings or select a profile with corresponding camera settings. The camera control210communicates with the camera103to configure the camera103in accordance with commands received from the camera application204. The camera application204may be, for example, a photography application, a document scanning application, a messaging application, or other application that processes image data acquired from camera103.

The camera configuration may include parameters that specify, for example, a frame rate, an image resolution, a readout duration, an exposure level, an aspect ratio, an aperture size, etc. The camera103may obtain image data based on the camera configuration. For example, the processor104may execute a camera application204to instruct camera103, through camera control210, to set a first camera configuration for the camera103, to obtain first image data from the camera103operating in the first camera configuration, to instruct camera103to set a second camera configuration for the camera103, and to obtain second image data from the camera103operating in the second camera configuration.

In some embodiments in which camera103is a variable aperture (VA) camera system, the processor104may execute a camera application204to instruct camera103to configure to a first aperture size, obtain first image data from the camera103, instruct camera103to configure to a second aperture size, and obtain second image data from the camera103. The reconfiguration of the aperture and obtaining of the first and second image data may occur with little or no change in the scene captured at the first aperture size and the second aperture size. Example aperture sizes are f/2.0, f/2.8, f/3.2, f/8.0, etc. Larger aperture values correspond to smaller aperture sizes, and smaller aperture values correspond to larger aperture sizes. That is, f/2.0 is a larger aperture size than f/8.0.

The image data received from camera103may be processed in one or more blocks of the ISP112to form image frames230that are stored in memory106and/or provided to the processor104. The processor104may further process the image data to apply effects to the image frames230. Effects may include Bokch, lighting, color casting, and/or high dynamic range (HDR) merging. In some embodiments, functionality may be embedded in a different component, such as the ISP112, a DSP, an ASIC, or other custom logic circuit for performing the additional image processing.

FIG.3depicts a system300for routing packets received from image sensors according to one aspect of the present disclosure. In particular, the system300may be configured to route packets received from image sensors through different secure domains, even when the packets originate from multiple image sensors via the same PHY. The system300includes image sensors302,304,306, a PHY314, an ISP112, and a secure storage308. The image sensors302,304include packets310,312for transmission, such as stored in a buffer. The ISP112includes a secure domain module316, a secure storage engine318, an image processing engine320. The secure domain module316includes a virtual channel identifier322, a secure domain identifier324, and a secure domain mapping326. The secure storage engine318includes a secure storage mapping328. The secure storage308includes context bases330,332,334,336.

The ISP112may be configured to receive packets310,312from the image sensors302,304,306along the PHY314. In certain implementations, the packets310,312contains image data captured by the image sensors302,304. For example, the packet310may contain image data captured by the image sensor302and the packet312may contain image data captured by the image sensor304. The packets310,312may also contain additional information (e.g., metadata for an image, an identifier of the image sensors302,304,306, a virtual channel identifier). In certain implementations, the image data may be encoded according to various formats, such as high dynamic range (HDR) image data, raycasting game maker (RGM) image data, and YUV image data. In certain implementations, the PHY314may represent a PHY layer connection corresponding to a particular, physical data pathway between the image sensors302,304,306and the ISP112. In certain implementations, the PHY314may represent a PHY layer connection corresponding to a particular, physical data pathway between one or more image sensors302,304,306and the ISP112. In certain implementations, during operation, packets received from the image sensors may be serialized into a single data feed transmitted along the PHY314to the image signal processor112, which may deserialize the data feeds to separate data from the different image sensors302,304,306for further processing, such as image processing, processing within corresponding secure domains.

In various implementations, the image sensors302,304,306may include one or more of a dashcam, an occupancy camera, a driver facing camera, exterior cameras, and the like. These cameras may be used for different applications that require different levels of security. For example, the image sensor302may correspond to an exterior camera that requires a low level of security while in operation, the image sensor304may correspond to a driver-facing camera that captures biometric information of the driver and thus requires a high level of security, and the image sensor306may correspond to an occupancy camera that requires a medium level of security. In certain implementations, one or more of the image sensors302,304,306may change uses over time. For example, the image sensor304may initially be used to capture biometric data regarding a driver to verify that the driver is authorized to use the vehicle and may later be used by a different application for driver monitoring (such as for drowsiness or distraction detection). As another example, the image sensor302may be a front-facing smartphone camera and may be used for biometric verification of a user and later used to take a selfie image.

The ISP112may be configured to determine a virtual channel338,340,342associated with the packet310,312. In certain implementations, the virtual channel338,340,342represents a virtual communication pathway between a particular image sensor302,304,306and the ISP112(e.g., via the PHY314). In particular, the virtual channel338,340,342may represent a virtual communication pathway from the image sensor302,304,306, through the PHY314, through one or more processing steps within the ISP, and to a final destination, such as an application executing on a processor104of the device100. In other implementations, the virtual channel338,340,342may represent a virtual communication pathway from the image sensor302,304,306to the ISP112(e.g., to one or more processing components of the ISP112). For example, the virtual channel338may represent a virtual communication pathway from the image sensor302to the ISP112, the virtual channel340may represent a virtual communication pathway from the image sensor304to the ISP112, and the virtual channel342may represent a virtual communication pathway from the image sensor306to the ISP112. In certain implementations, the image sensor302,304,306adds a virtual channel identifier322to the packet310,312to indicate which virtual channel338,340,342the packet310,312corresponds to. In such instances, the virtual channel338,340,342may be identified based on the virtual channel identifier322. For example, the virtual channel338,340,342may be identified as the contents of the virtual channel identifier322. In certain implementations, the image sensor302,304,306may be one of a plurality of image sensors302,304,306and the virtual channel identifier322identifies the image sensor302,304,306from among the plurality of image sensors302,304,306. For example, as explained above, packets310,312from the image sensors302,304,306may be serialized for transmission along the PHY314and the virtual channel identifier322may be used to identify and distinguish between packets310,312received from different image sensors302,304, such as when the ISP112deserializes data received along the PHY314.

The ISP112may be configured to determine, based on the virtual channel338,340,342, secure domains344,346,348for the packets310,312. The secure domains344,346,348may be selected from a plurality of secure domains344,346,348available within the ISP112. In certain implementations, the secure domains344,346,348may be isolated data stream that are protected from access by data packets310,312and computing processes that are not part of the same secure domain. In certain implementations, secure domains represent isolated data streams of data packets310,312from image sensors302,304,306, through a processing pipeline within the ISP112, and to a final destination. The processing pipeline may include processing by one or more image processing engines320within the ISP112. For example, the image processing engine320may include one or more image processing procedures, such as image front end processing procedures, that alter or combine image data from one or more image frames. Final destinations for the packets310,312may include storage within a secure storage308, processing by a computing process executing on another processor such as the processor104, and the like.

In certain implementations, a particular secure domain, such as the secure domain344, may be isolated (1) to ensure data from other secure domains346,348or computing processes cannot access the secure domain344and/or (2) to ensure that data within the particular secure domain344does not leave the secure domain344, such as by overriding an assigned memory space, by violating corresponding hardware functionality, by deviating from a corresponding processing pipeline within the ISP112, and the like. In certain implementations, the secure domains344,346,348may correspond to various types of applications or use cases, such as handling biometric data, detecting and processing QR codes, processing and transmitting content protected by digital rights management (DRM), and the like. In various instances, each application requesting access to one of the image sensors302,304,306may have its own corresponding secure domain344,346,348. In other instances, one or more applications may share the same secure domain344,346,348. For example, applications with higher security requirements may request or require separate secure domains344,346,348, while other applications may not include such a request or requirement. In such instances, the other applications may share a single secure domain344,346,348.

In certain implementations, the secure domains344,346,348are implemented by at least one secure data storage device, such as the secure storage308. In such instances, each secure domain344,346,348may be implemented by a corresponding portion of the secure storage308. For example, data contained within the secure domains344,346,348may be stored within context bases330,332,334,336contained within the secure storage308. For instance, the secure domain344may correspond to the context base330, the secure domain346may correspond to the context base332, and the secure domain348may correspond to the context base334. In certain implementations, the context bases330,332,334,336may be implemented within separate portions of the secure storage308, such as separate address spaces within the secure storage308. In certain implementations, the at least one secure storage308may include a secure memory management unit (SMMU) configured to restrict access to the secure storage308, such as via a secure storage engine318. For example, the context bases330,332,334,336may be implemented as restricted address spaces that are separated within the secure storage308, such as with a separation of 2 kB or more. A size of the context bases330,332,334,336may be predetermined such that all of the context bases330,332,334,336are the same size. The size of the context bases330,332,334,336may additionally or alternatively be dynamically assigned, such as based on a type of application associated with the secure domain or based on a size indicated within a request received from the requesting application. In certain implementations, other types of secure storage and/or memory protection may be used, such as separate data transmission routes within the ISP112that are hardware limited to only access certain parts of memory, air gaps between different context bases, such as separate memory chips for one or more of the secure domains, and the like.

In particular, a secure domain module316may determine, for received packets310,312, which secure domains344,346,348corresponds to the virtual channels338,340,342of the packets310,312. For example, the secure domain module316may receive or maintain a secure domain mapping326that identifies corresponding secure domains for one or more of the virtual channels338,340,342. In certain implementations, the secure domain mapping326may store associations between virtual channel identifiers322for particular virtual channels338,340,342and secure domain identifiers324for particular secure domains344,346,348. In certain implementations, determining corresponding secure domains344,346,348for received packets310,312,314may include identifying corresponding secure domain identifiers324for virtual channel identifiers322extracted from the packets310,312.

To maintain the secure domain mapping326, the ISP112, such as the secure domain module316may receive a request from an application to access an image sensor302,304,306. In response, the secure domain module316may grant access to the image sensor302,304,306and may store, within the secure domain mapping326, a mapping between the virtual channel identifier322for the image sensor302,304,306and a domain identifier324for a secure domain344,346,348utilized by the requesting application. In certain implementations, the secure domain module316may determine that the requesting application corresponds to a particular secure domain344. For example, the request may include an identifier of a corresponding secure domain344. In certain implementations, the requesting application may not have a corresponding secure domain. In such instances, the secure domain module316may create a new secure domain, such as by creating a new context base336within the secure storage308and a new secure domain ID, and may store a mapping between the requesting application and the new secure domain ID.

In certain implementations, the mappings between virtual channels338,340,342and secure domains344,346,348may change over time, and secure domains may be created or deleted depending on operating conditions. For example, different applications may access the same image sensor302,304,306at different times, as explained above. In such instances, when a request is received to access an image sensor302that already has a corresponding secure domain344, the existing secure domain344may be deleted, such as by deleting the contents of a corresponding context base330and a corresponding association in the secure domain mapping326, and a new association may be made for the virtual channel338corresponding to the image sensor302, such as by creating a new secure domain or by storing an association between an existing secure domain346,348and the virtual channel338.

Requests to store data within context bases330,332,334,336within the secure storage308may be validated by the secure storage engine318. For example, the secure storage engine318may be configured to receive read/write requests for the secure storage308that contain virtual channel identifiers322and secure domain identifiers324and may grant or deny the requests based on whether the correct identifiers322,324are provided. For example, the secure storage engine318may maintain or have access to a copy of the secure domain mapping326and may compare received identifiers322,324to ensure that the received virtual channel identifier322and the received secure domain identifier324correspond to one another after receiving a read/write request. If so, read/write access to the secure storage308may be provided, such as via an SMMU of the secure storage308. In particular, the secure storage engine318may identify, within a secure storage mapping328, a corresponding portion of the secure storage308for the context base330that corresponds to the secure domain identifier324. If the identifiers322,324do not correspond, the secure storage engine318may reject the request. For example, the secure storage engine318may provide an invalid domain ID to the secure storage mapping328or an SMMU of the secure storage308, which may cause the request to be blocked or may cause the data to be written to a sequestered/quarantined memory space within the secure storage308or another storage device.

In certain implementations, one or more of the image sensors302,304,306or virtual channels338may have no associated secure domains. For example, the one or more image sensors302,304,306may not be actively accessed by any applications at a particular time. All requests from those virtual channels at that time may accordingly be rejected. In certain implementations, after an application has stopped accessing an image sensor302,304,306, the secure domain module316may delete a current secure domain344,346,348association for the corresponding virtual channel338,340,342, such as by deleting the mapping within the secure domain mapping326. This may prevent incursion into previous secure domains by new computing processes. For example, a compromised data feed from an image sensor302,304,306, or other application trying to access the sensor's previous secure domain344,346,348, may be blocked because no mapping exists for read/write requests to be routed to a corresponding context base330,332,334,336.

In certain implementations, access to the image sensors302,304,306by applications executing on the device100may be controlled by a driver. In such instances, identifying the corresponding secure domain344,346,348for a received packet310,312may be performed by the driver. For example, all or part of the functionality of the secure domain module316and the secure storage engine318may be performed by the driver, such as by the driver executing on the ISP112.

The ISP112may be configured to route the packets310,312within corresponding secure domains. For example, routing the packets310,312may include storing the packets310,312within corresponding context bases330,332,334,336within the secure storage308. In particular, the packet310may be stored in the context base330and the packet312may be stored in the context base332, such as via the secure storage engine318as described above. In certain implementations, routing the packets310,312within the secure domains344,346,348may include performing image processing on the data packet310,312without leaving the secure domain344,346,348. In particular, image processing may be performed by image processing engines320on image data contained with the packets310,320without leaving the secure domains344,346,348. In such instances, the image processing engine320may be configured to read the data from corresponding context bases330,332,334,336and to write resulting data do the corresponding context bases330,332,334,336, such as after completing each stop of the image process.

As mentioned above, the at least one secure storage308may include an SMMU configured to restrict access to the secure storage308. In such instances, routing packets310,312within the secure domains344,346,348may include validating access to the corresponding context bases330,332,334,336with the secure storage308. For example, as explained above, routing a packet310may include providing a secure domain identifier324for a corresponding secure domain344of the packet310to the SMMU, such as via the secure storage engine318. A corresponding portion of the secure storage308that contains the corresponding context base330may then be accessed if the secure domain identifier324is correct, such as based on the above-described verification process. The corresponding portion of the secure storage308may be determined based on a secure storage mapping328. Once access is granted, the data packet310,312may be written, such as via the secure storage engine318, to the secure storage308.

In certain implementations, the above-described techniques may be repeated for multiple data packets310,312received from multiple image sensors302,304,306. For example, data packets310,312may be received within a serialized data stream via the PHY314and may each be processed using the techniques above. As a specific example, the packet310may be first received via the PHY314and may be processed as described above to be routed to the secure domain344and stored in the corresponding context base330. The packet312may be received later via the PHY314and may be processed as described above to be routed to the secure domain346and stored in the corresponding context base332.

In certain implementations, the ISP112may receive data from multiple PHYs, and at least a subset of the PHYs may receive data from multiple image sensors. In such instances, the ISP112may receive and process data from each of the PHYs using the techniques described above. In certain implementations, each of the PHYs may have a corresponding secure domain module316and secure storage engine318. In other implementations, one or more of the PHYs may share a secure domain module316or secure storage engine318. In such instances, the ISP112may include a PHY select register, which may be used to selectively receive and process data packets from one of the PHYs at a time according to the above-described techniques.

The above-described techniques accordingly enable the routing of data packets from multiple image sensors to different secure domains, even if the image sensors communicated using the same PHY. Such implementations may improve the security of image processing, such as by protecting against data leakage between applications accessing different cameras on the same PHY or data leakage between multiple applications accessing the same camera. Such techniques may also improve the flexibility, cost, and complexity of image processing systems, as secure deployments that rely on fewer PHYs are still possible without adding additional PHYs.

One skilled in the art will appreciate that the above-described implementations are merely exemplary and that, in practice, specific implementations details may differ without departing from the scope of the present disclosure. In particular, the functions of the secure domain module316, secure storage engine318, and image processing engine320may be performed by other components, such as the ISP112or other portions of the device100, such as the processor104.

The systems200,300may be configured to perform the operations described with reference toFIG.4to receive and route data packets.FIG.4shows a flow chart of an example method400for processing image data to receive and route data packets from different image sensors utilizing the same PHY according to some embodiments of the disclosure. For example, the method400may be performed by the ISP112to receive and route data packets from different image sensors utilizing the same PHY314.

The method400includes receiving a packet from an image sensor along a PHY (block402). For example, the ISP112may receive a packet312from an image sensor304along a PHY314. In certain implementations, the packet312contains image data captured by the image sensor304. The packet312may also contain additional information (e.g., a virtual channel identifier322).

The method400includes determining a virtual channel associated with the packet (block404). For example, the ISP112may determine a virtual channel340associated with the packet312. In certain implementations, the ISP112may identify a virtual channel identifier322within the packet312and may determine the virtual channel340based on the virtual channel identifier322. For example, the secure domain module316of the ISP112may extract the virtual channel identifier322from the packet312.

The method400includes determining, based on the virtual channel, a secure domain for the packet (block406). For example, the ISP112may determine, based on the virtual channel340, a secure domain346for the packet312. The secure domain346may be selected from a plurality of secure domains344,346,348accessible via the PHY314. The secure domain346may be identified based on the virtual channel identifier322. For example, the secure domain module316may identify a secure domain identifier324that corresponds to the virtual channel identifier322extracted from the packet312. The secure domain identifier324may correspond to the current secure domain346for the virtual channel340.

The method400includes routing the packet within the secure domain (block408). For example, the ISP112may route the packet312within the secure domain346. In certain implementations, routing the packet312may include routing contents of the packet312to a secure storage308implementing the secure domain346. Routing the packet312may also include ensuring that all processing steps for the contents of the packet312are performed within the secure domain346, such as by ensuring that image processing steps read from and write to a corresponding context base332for the secure domain346.

FIG.5is a block diagram illustrating an example processor configuration for image data processing in an image capture device according to one or more embodiments of the disclosure. The processor104, or other processing circuitry, may be configured to operate on image data, such as data packets from image sensors, to perform one or more operations of the method ofFIG.4. The image data may be processed to receive and route data packets within corresponding secure domains.

The packet receiving logic502may be configured to receive a packet from an image sensor along a PHY. For example, the packet receiving logic502may receive a packet312from an image sensor304along a PHY314. In certain implementations, the packet312contains image data captured by the image sensor304. The packet312may also contain additional information (e.g., a virtual channel identifier322).

The virtual channel logic504may be configured to determine a virtual channel associated with the packet. For example, the virtual channel logic504may determine a virtual channel340associated with the packet312. In certain implementations, the virtual channel logic504may identify a virtual channel identifier322within the packet312and may determine the virtual channel340based on the virtual channel identifier322. For example, the virtual channel logic504may extract the virtual channel identifier322from the packet312.

The secure domain logic506may be configured to determine, based on the virtual channel, a secure domain for the packet. For example, the secure domain logic506may determine, based on the virtual channel340, a secure domain346for the packet312. The secure domain346may be selected from a plurality of secure domains344,346,348accessible via the PHY314. The secure domain346may be identified based on the virtual channel identifier322. For example, the secure domain logic506may identify a secure domain identifier324that corresponds to the virtual channel identifier322extracted from the packet312. The secure domain identifier324may correspond to the current secure domain346for the virtual channel340.

The secure domain routing logic508may be configured to route the packet within the secure domain. For example, the secure domain routing logic508may route the packet312within the secure domain346. In certain implementations, routing the packet312may include routing contents of the packet312to a secure storage308implementing the secure domain346. Routing the packet312may also include ensuring that all processing steps for the contents of the packet312are performed within the secure domain346, such as by ensuring that image processing steps read from and write to a corresponding context base332for the secure domain346.

In one or more aspects, techniques for supporting routing of packets received from multiple image sensors to different secure domains may include additional aspects, such as any single aspect or any combination of aspects described below or in connection with one or more other processes or devices described elsewhere herein. In a first aspect, supporting routing of packets received from multiple image sensors to different secure domains may include an apparatus including: an image signal processor; and a memory storing instructions which, when executed by the image signal processor, cause the processor to: receive a packet from an image sensor along a physical data connection; determine a virtual channel associated with the packet; determine, based on the virtual channel, a first secure domain for the packet, wherein the first secure domain is selected from a plurality of secure domains accessible via the physical data connection; and route the packet within the first secure domain. Additionally, the apparatus may perform or operate according to one or more aspects as described below. In some implementations, the apparatus includes a wireless device, such as a UE or BS. In some implementations, the apparatus may include at least one processor, and a memory coupled to the processor. The processor may be configured to perform operations described herein with respect to the apparatus. In some other implementations, the apparatus may include a non-transitory computer-readable medium having program code recorded thereon and the program code may be executable by a computer for causing the computer to perform operations described herein with reference to the apparatus. In some implementations, the apparatus may include one or more means configured to perform operations described herein. In some implementations, a method of wireless communication may include one or more operations described herein with reference to the apparatus.

In a second aspect according to the first aspect, the first secure domain is an isolated data stream that is protected from access by computing processes that are not part of the first secure domain.

In a third aspect according to one or more of the first through second aspects, routing the packet within the first secure domain includes performing image processing on the packet without leaving the first secure domain.

In a fourth aspect according to one or more of the first through third aspects, the apparatus further includes a secure data storage device configured to implement the plurality of secure domains, and wherein the first secure domain is implemented by a first portion of the secure data storage device.

In a fifth aspect according to one or more of the first through fourth aspects, the secure data storage device includes a secure memory management unit (SMMU) configured to restrict access to a secure memory, and wherein routing the packet within the first secure domain includes: providing a first domain identifier for the first secure domain to the SMMU; accessing the first portion of the secure data storage device; and writing the packet to the secure data storage device.

In a sixth aspect according to one or more of the first through fifth aspects, determining the first secure domain includes determining that a first domain identifier corresponds to a virtual channel identifier, wherein the image sensor is one of a plurality of image sensors and the virtual channel identifier identifies the image sensor from among the plurality of image sensors.

In a seventh aspect according to one or more of the first through sixth aspects, the instructions further cause the processor, before receiving the packet, to: receive a request to access the image sensor from an application; determine that the application corresponds to the first secure domain; and determine an association between the virtual channel identifier and the first domain identifier.

In an eighth aspect according to one or more of the first through seventh aspects, the virtual channel was previously used to access a second secure domain from the plurality of secure domains.

In a ninth aspect according to one or more of the first through tenth aspects, the physical data connection is a CSI PHY data connection between a plurality of image sensors and the apparatus.

In a tenth aspect according to one or more of the first through eleventh aspects, the physical data connection is one of a plurality of physical data connections for the apparatus, and wherein at least a subset of the plurality of secure domains are accessible via the plurality of physical data connections.

In an eleventh aspect, supporting routing of packets received from multiple image sensors to different secure domains may include a method that includes receiving, by an image signal processor, a packet from an image sensor along a physical data connection; determining, by the image signal processor, a virtual channel associated with the packet; determining, by the image signal processor based on the virtual channel, a first secure domain for the packet, wherein the first secure domain is selected from a plurality of secure domains accessible via the physical data connection; and routing, by the image signal processor, the packet within the first secure domain.

In a twelfth aspect according to the eleventh aspect, the first secure domain is an isolated data stream that is protected from access by computing processes that are not part of the first secure domain.

In a thirteenth aspect according to one or more of the eleventh through twelfth aspects, routing the packet within the first secure domain includes performing image processing on the packet without leaving the first secure domain.

In a fourteenth aspect according to one or more of the eleventh through thirteenth aspects, the plurality of secure domains are implemented by a secure data storage device, and wherein the first secure domain is implemented by a first portion of the secure data storage device.

In a fifteenth aspect according to one or more of the eleventh through fourteenth aspects, the secure data storage device includes a secure memory management unit (SMMU) configured to restrict access to a secure memory, and wherein routing the packet within the first secure domain includes: providing a first domain identifier for the first secure domain to the SMMU; accessing the first portion of the secure data storage device; and writing the packet to the secure data storage device.

In a sixteenth aspect according to one or more of the eleventh through fifteenth aspects, determining the first secure domain includes determining that a first domain identifier corresponds to a virtual channel identifier, wherein the image sensor is one of a plurality of image sensors and the virtual channel identifier identifies the image sensor from among the plurality of image sensors.

In a seventeenth aspect according to one or more of the eleventh through sixteenth aspects, a method, further including, before receiving the packet: receiving a request to access the image sensor from an application; determining that the application corresponds to the first secure domain; and determining an association between the virtual channel identifier and the first domain identifier.

In an eighteenth aspect according to one or more of the eleventh through seventeenth aspects, the virtual channel was previously used to access a second secure domain from the plurality of secure domains.

In a nineteenth aspect according to one or more of the eleventh through eighteenth aspects, the physical data connection is a shared PHY data connection between a plurality of image sensors and an image signal processor, and wherein the image signal processor is configured to perform the method.

In a twentieth aspect according to one or more of the eleventh through nineteenth aspects, the physical data connection is one of a plurality of physical data connections, and wherein at least a subset of the plurality of secure domains are accessible via the plurality of physical data connections.

In a twenty-first aspect, supporting routing of packets received from multiple image sensors to different secure domains may include a non-transitory, computer-readable medium storing instructions which, when executed by an image signal processor, cause the image signal processor to: receive a packet from an image sensor along a physical data connection; determine a virtual channel associated with the packet; determine, based on the virtual channel, a first secure domain for the packet, wherein the first secure domain is selected from a plurality of secure domains accessible via the physical data connection; and route the packet within the first secure domain.

In a twenty-second aspect according to the twenty-first aspect, the first secure domain is an isolated data stream that is protected from access by computing processes that are not part of the first secure domain.

In a twenty-third aspect according to one or more of the twenty-first through twenty-second aspects, routing the packet within the first secure domain includes performing image processing on the packet without leaving the first secure domain.

In a twenty-fourth aspect according to one or more of the twenty-first through twenty-third aspects, the plurality of secure domains are implemented by a secure data storage device, and wherein the first secure domain is implemented by a first portion of the secure data storage device.

In a twenty-fifth aspect according to one or more of the twenty-first through twenty-fourth aspects, the secure data storage device includes a secure memory management unit (SMMU) configured to restrict access to a secure memory, and wherein routing the packet within the first secure domain includes: providing a first domain identifier for the first secure domain to the SMMU; accessing the first portion of the secure data storage device; and writing the packet to the secure data storage device.

In a twenty-sixth aspect, supporting routing of packets received from multiple image sensors to different secure domains may include an image capture device including: a first image sensor; a second image sensor; an image signal processor; a first shared physical link coupling the first image sensor to the image signal processor and coupling the second image sensor to the image signal processor; and a memory storing instructions which, when executed by the image signal processor, cause the image signal processor to: receive a packet from an image sensor along a physical data connection; determine a virtual channel associated with the packet; determine, based on the virtual channel, a first secure domain for the packet, wherein the first secure domain is selected from a plurality of secure domains accessible via the physical data connection; and route the packet within the first secure domain.

In a twenty-seventh aspect according to the twenty-sixth aspect, the first secure domain is an isolated data stream that is protected from access by computing processes that are not part of the first secure domain.

In a twenty-eighth aspect according to one or more of the twenty-sixth through twenty-seventh aspects, routing the packet within the first secure domain includes performing image processing on the packet without leaving the first secure domain.

In a twenty-ninth aspect according to one or more of the twenty-sixth through twenty-eighth aspects, an image capture device, further including a secure data storage device configured to implement the plurality of secure domains, and wherein the first secure domain is implemented by a first portion of the secure data storage device.

In a thirtieth aspect according to one or more of the twenty-sixth through twenty-ninth aspects, the secure data storage device includes a secure memory management unit (SMMU) configured to restrict access to a secure memory, and wherein routing the packet within the first secure domain includes: providing a first domain identifier for the first secure domain to the SMMU; accessing the first portion of the secure data storage device; and writing the packet to the secure data storage device.

Those of skill in the art that one or more blocks (or operations) described with reference toFIGS.4and5may be combined with one or more blocks (or operations) described with reference to another one of the figures. For example, one or more blocks (or operations) ofFIG.4may be combined with one or more blocks (or operations) ofFIGS.1-3. As another example, one or more blocks associated withFIG.5may be combined with one or more blocks (or operations) associated withFIGS.1-4.

Additionally, a person having ordinary skill in the art will readily appreciate that opposing terms such as “upper” and “lower,” or “front” and back,” or “top” and “bottom,” or “forward” and “backward” are sometimes used for ease of describing the figures and indicate relative positions corresponding to the orientation of the figure on a properly oriented page and may not reflect the proper orientation of any device as implemented.

The term “substantially” is defined as largely, but not necessarily wholly, what is specified (and includes what is specified; for example, substantially 90 degrees includes 90 degrees and substantially parallel includes parallel), as understood by a person of ordinary skill in the art. In any disclosed implementations, the term “substantially” may be substituted with “within [a percentage] of” what is specified, where the percentage includes. 1, 1, 5, or 10 percent.