A system on a chip (SoC), comprising: multiple functional blocks; a system bus coupled to the functional blocks, the functional blocks configured to perform at least one of sending messages to or receiving messages from other ones of the functional blocks through the system bus; multiple initiator-side firewall blocks, different ones of the initiator-side firewall blocks corresponding to different ones of the functional blocks, the initiator-side firewall blocks having respective initiator-side memories configured to store configuration settings of the respective initiator-side firewall blocks, the initiator-side firewall blocks configured so that, when a sending one of the functional blocks sends a sent message to a receiving functional block, the initiator-side firewall block corresponding to the sending functional block adds an identifier to the sent message in at least partial dependence on the configuration settings of the corresponding initiator-side firewall block; multiple receiver-side firewall blocks, different ones of the receiver-side firewall blocks corresponding to different ones of the functional blocks, the receiver-side firewall blocks having respective receiver-side firewall block memories configured to store configuration settings of the respective receiver-side firewall blocks, the receiver-side firewall blocks configured so that, when the receiving functional block receives the sent message, the receiver-side firewall block corresponding to the receiving functional block allows or refuses permission for the sent message to be accessed by the receiving functional block in at least partial dependence on the configuration settings of the corresponding receiver-side firewall block and on the identifier; a security bus which is electrically isolated from the system bus, the security bus coupled to the initiator-side firewall blocks and to the receiver-side firewall blocks; and a single security configuration controller coupled to the security bus and configured to use the security bus to exclusively control the configuration settings to be stored in all of the initiator-side firewall block memories and all of the receiver-side firewall block memories. multiple functional blocks; a system bus coupled to the functional blocks, the functional blocks configured to perform at least one of sending messages to or receiving messages from other ones of the functional blocks through the system bus; multiple initiator-side firewall blocks, different ones of the initiator-side firewall blocks corresponding to different ones of the functional blocks, the initiator-side firewall blocks having respective initiator-side memories configured to store configuration settings of the respective initiator-side firewall blocks, the initiator-side firewall blocks configured so that, when a sending one of the functional blocks sends a sent message to a receiving functional block, the initiator-side firewall block corresponding to the sending functional block adds an identifier to the sent message in at least partial dependence on the configuration settings of the corresponding initiator-side firewall block; multiple receiver-side firewall blocks, different ones of the receiver-side firewall blocks corresponding to different ones of the functional blocks, the receiver-side firewall blocks having respective receiver-side firewall block memories configured to store configuration settings of the respective receiver-side firewall blocks, the receiver-side firewall blocks configured so that, when the receiving functional block receives the sent message, the receiver-side firewall block corresponding to the receiving functional block allows or refuses permission for the sent message to be accessed by the receiving functional block in at least partial dependence on the configuration settings of the corresponding receiver-side firewall block and on the identifier; a security bus which is electrically isolated from the system bus, the security bus coupled to the initiator-side firewall blocks and to the receiver-side firewall blocks; and a single security configuration controller coupled to the security bus and configured to use the security bus to exclusively control the configuration settings to be stored in all of the initiator-side firewall block memories and all of the receiver-side firewall block memories.