Patent Description:
Embedded and portable electronic systems are increasingly complex and are exposed to increasing security risks. In addition, demands for number of use cases for and flexibility of embedded and portable computer systems are increasingly expanding. Embedded and portable computer system are increasingly requested to conduct sensitive operations in a wide variety or scenarios, while also supporting open and flexible application operation. However, conventional systems may not effectively guard sensitive operations from unauthorized operations on an embedded or portable electronic system in sufficiently broad use cases. Thus, a technological solution for secure encryption key generation and management in open and secure processor environments is desired. Documents <CIT> and <CIT> are relevant documents related to guarding sensitive operations.

Example implementations include generating a guard service for a secure service at a secure region of a processing system by detecting a call to a secure service at a secure region of a processing device, obtaining a secure interface associated with the secure service, generating a guard interface based at least partially on the secure interface, generating a guard service based at least partially on the guard interface, locating the guard service at a secure region, and locating the guard interface at a secure address at the secure region.

Example implementations also include accessing a secure service at a secure region of a processing system, from an application at a system region of the processing system, by obtaining a service request associated with a secure service, validating a service parameter associated with service request, generating a secure service parameter based at least partially on the service parameter, generating a guard request based at least partially on the secure service parameter, generating a secure request based at least partially on the guard request, and processing the secure request at the secure service.

Example implementations also include a device with a processor and a secure memory operatively coupled to the processor. In some implementations, the secure memory includes a guard service object configured to obtain a service request associated with a secure service, validate a service parameter associated with service request, generate a secure service parameter based at least partially on the service parameter, and generate a guard request based at least partially on the secure service parameter, and a secure service object configured to generate a secure request based at least partially on the guard request, and process the secure request at the secure service.

These and other aspects and features of the present embodiments will become apparent to those ordinarily skilled in the art upon review of the following description of specific embodiments in conjunction with the accompanying figures, wherein:.

The invention is defined in the independent claim <NUM>. The present embodiments will now be described in detail with reference to the drawings, which are provided as illustrative examples of the embodiments so as to enable those skilled in the art to practice the embodiments and alternatives apparent to those skilled in the art. Notably, the figures and examples below are not meant to limit the scope of the present embodiments to a single embodiment, but other embodiments are possible by way of interchange of some or all of the described or illustrated elements. Moreover, where certain elements of the present embodiments can be partially or fully implemented using known components, only those portions of such known components that are necessary for an understanding of the present embodiments will be described, and detailed descriptions of other portions of such known components will be omitted so as not to obscure the present embodiments. Embodiments described as being implemented in software should not be limited thereto, but can include embodiments implemented in hardware, or combinations of software and hardware, and vice-versa, as will be apparent to those skilled in the art, unless otherwise specified herein. In the present specification, an embodiment showing a singular component should not be considered limiting; rather, the present disclosure is intended to encompass other embodiments including a plurality of the same component, and vice-versa, unless explicitly stated otherwise herein. Moreover, applicants do not intend for any term in the specification or claims to be ascribed an uncommon or special meaning unless explicitly set forth as such. Further, the present embodiments encompass present and future known equivalents to the known components referred to herein by way of illustration.

<FIG> illustrates an example processing system in accordance with present implementations. As illustrated by way of example in <FIG>, an example system <NUM> includes a secure processing region <NUM>, a system processing region <NUM>, and a system bus. In some implementations, the secure processing region <NUM> includes a secure memory <NUM>, a secure processor <NUM>, and a secure communication channel <NUM>. In some implementations, the system processing region <NUM> includes a secure memory <NUM>, a secure processor <NUM>, and a secure communication channel <NUM>. In some implementations, at least one of the secure region <NUM> and the system region <NUM> includes an electronic circuit board, printed circuit board, conductive substrate, or the like. In some implementations, the secure memory <NUM> and the system memory <NUM> are distinct memory devices or the like. Alternatively, in some implementations, the secure memory <NUM> and the system memory <NUM> are an integral device, a plurality of integrated devices, a plurality of coupled devices, or the like, logically separated respectively into a secure portion and a system portion. In some implementations, the secure processor <NUM> and the system processor <NUM> are distinct memory devices or the like. Alternatively, in some implementations, the secure processor <NUM> and the system processor <NUM> are an integral device, a plurality of integrated devices, a plurality of coupled devices, or the like, logically separated respectively into a secure portion and a system portion.

The secure memory <NUM> is operable to store data associated with the secure processing region <NUM>. In some implementations, the secure processing region <NUM> limits or prevents access to at least a portion of the secure memory <NUM> from the system processing region <NUM>. In some implementations, the secure processing region <NUM> limits or prevents direct addressing of at least a portion of the secure memory <NUM> from the system processing region <NUM>. In some implementations, the secure memory <NUM> includes ones or more hardware memory devices for storing binary data, digital data, or the like. In some implementations, the secure memory <NUM> includes one or more electrical components, electronic components, programmable electronic components, reprogrammable electronic components, integrated circuits, semiconductor devices, flip flops, arithmetic units, or the like. In some implementations, the secure memory <NUM> includes at least one of a non-volatile memory device, a solid-state memory device, a flash memory device, and a NAND memory device. In some implementations, the secure memory <NUM> includes one or more addressable memory regions disposed on one or more physical memory arrays. In some implementations, a physical memory array includes a NAND gate array disposed on a particular semiconductor device, integrated circuit device, printed circuit board device, and the like.

The secure processor <NUM> is operable to execute one or more instructions associated with the secure processing region <NUM>. In some implementations, the secure processor <NUM> limits or prevents access to at least a portion of the secure memory <NUM> from the system processing region <NUM>. In some implementations, the secure processor <NUM> limits or prevents direct addressing of at least a portion of the secure memory <NUM> from the system processing region <NUM>. In some implementations, the secure processor <NUM> is operable to perform one or more processing operations associated with restricted or preventing access to the secure processing region <NUM>. In some implementations, the secure processor is operatively coupled to the system bus <NUM>. In some implementations, the secure processor <NUM> includes one or more devices in accordance with the system processor <NUM>.

The secure communication channel <NUM> is operable to communicatively couple the secure processor <NUM> to one or more external devices, systems, or the like. In some implementations, external devices, system, or the like include integrated circuits, communication ports, communication port controllers, serial interfaces, USB interfaces, USB-C interfaces, I2C interfaces, and the like. The secure communication channel <NUM> is operable to communicate one or more instructions, signals, conditions, states, or the like between one or more of the secure processor <NUM> and the external devices, systems, or the like. In some implementations, the secure communication channel <NUM> includes one or more digital, analog, or like communication channels, lines, traces, or the like operable independently of the system processing region <NUM> and any component thereof. In some implementations, the secure processing region <NUM> includes one or more registers, switches, or the like, to assign, associate, couple, or the like, one or more external devices to the secure communication channel <NUM>. In some implementations, the secure processing region <NUM> includes one or more registers, switches, or the like, to assign, associate, couple, or the like, one or more portions of external devices to the secure communication channel <NUM>. As one example, a portion of an external device is a single serial communication line among multiple serial communication lines of a serial communication interface, and the secure processing region <NUM> is operable to couple the single line or a subset of the lines to the secure communication channel <NUM>.

The system memory <NUM> is operable to store data associated with the system processing region <NUM>. In some implementations, the system memory <NUM> includes ones or more hardware memory devices for storing binary data, digital data, or the like. In some implementations, the system memory <NUM> includes one or more electrical components, electronic components, programmable electronic components, reprogrammable electronic components, integrated circuits, semiconductor devices, flip flops, arithmetic units, or the like. In some implementations, the system memory <NUM> includes at least one of a non-volatile memory device, a solid-state memory device, a flash memory device, and a NAND memory device. In some implementations, the system memory <NUM> includes one or more addressable memory regions disposed on one or more physical memory arrays. In some implementations, a physical memory array includes a NAND gate array disposed on a particular semiconductor device, integrated circuit device, printed circuit board device, and the like.

The system processor <NUM> is operable to execute one or more instructions associated with the system processing region <NUM>. In some implementations, the system processor <NUM> is an electronic processor, an integrated circuit, or the like including one or more of digital logic, analog logic, digital sensors, analog sensors, communication buses, volatile memory, nonvolatile memory, and the like. In some implementations, the system processor <NUM> includes but is not limited to, at least one microcontroller unit (MCU), microprocessor unit (MPU), central processing unit (CPU), graphics processing unit (GPU), physics processing unit (PPU), embedded controller (EC), or the like. In some implementations, the system processor <NUM> includes a memory operable to store or storing one or more instructions for operating components of the system processor <NUM> and operating components operably coupled to the system processor <NUM>. In some implementations, the one or more instructions include at least one of firmware, software, hardware, operating systems, embedded operating systems, and the like. It is to be understood that the system processor <NUM> or the system processing region <NUM> generally can include at least one communication bus controller to effect communication between the system processor <NUM> and the other elements of the system processing region <NUM>.

The system communication channel <NUM> is operable to communicatively couple the system processor <NUM> to one or more external devices, systems, or the like. In some implementations, external devices, system, or the like include integrated circuits, communication ports, communication port controllers, serial interfaces, USB interfaces, USB-C interfaces, I2C interfaces, and the like. The system communication channel <NUM> is operable to communicate one or more instructions, signals, conditions, states, or the like between one or more of the system processor <NUM> and the external devices, systems, or the like. In some implementations, the system communication channel <NUM> includes one or more digital, analog, or like communication channels, lines, traces, or the like operable independently of the secure processing region <NUM> and any component thereof. In some implementations, the system processing region <NUM> includes one or more registers, switches, or the like, to assign, associate, couple, or the like, one or more external devices to the system communication channel <NUM>. In some implementations, the system processing region <NUM> includes one or more registers, switches, or the like, to assign, associate, couple, or the like, one or more portions of external devices to the system communication channel <NUM>. As one example, a portion of an external device is a single serial communication line among multiple serial communication lines of a serial communication interface, and the system processing region <NUM> is operable to couple the single line or a subset of the lines to the system communication channel <NUM>.

The system bus <NUM> is operable to communicate one or more instructions, signals, conditions, states, or the like between one or more of the secure processing <NUM> and the system processing region <NUM>, including the secure processor <NUM>, the secure memory <NUM>, the system memory <NUM>, and the system processor <NUM>. In some implementations, the system bus <NUM> includes one or more digital, analog, or like communication channels, lines, traces, or the like. In some implementations, the system bus <NUM> is operatively coupled to, operably couplable with, or the like, one or more of the secure communication channel <NUM> and the system communication channel <NUM>.

<FIG> illustrates an example non-transitory memory system further to the example processing system of <FIG>. As illustrated by way of example in <FIG>, an example non-transitory memory system <NUM> includes a system memory region, a secure memory region, and a secure access region <NUM> of the secure memory region. In some implementations, the secure access region <NUM> includes access points <NUM> and <NUM>. In some implementations, the example memory system <NUM> includes one or more of the secure memory <NUM> and the system memory <NUM> respectively as the secure memory region and the system memory region. In some implementations, the secure access region <NUM> is a logical or physical region of the secure memory <NUM>. In some implementations, the secure access region is a contiguous logical memory area of the secure memory <NUM>. In some implementations, at least a portion of the secure access region is directly addressable by the system processing region <NUM> or one or more components thereof, including but not limited to the system memory <NUM> and the system processor <NUM>. By way of example, the example memory of <FIG> is illustrated as having a plurality of contiguous blocks, but is not limited thereto.

In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> enforces addressing restrictions of the secure access region. In some implementations, the secure memory region includes system applications <NUM> and <NUM>, and system data objects <NUM>. In some implementations, the secure memory region includes guard services <NUM> and <NUM>, secure service <NUM> and <NUM>, a secure application <NUM>, and secure data objects <NUM>. In some implementations, one or more of the system applications <NUM> and <NUM>, the system data objects <NUM>, the guard services <NUM> and <NUM>, the secure services <NUM> and <NUM>, the secure application <NUM>, and the secure data objects <NUM> include one or more instructions generated based on at least one high-level computer language.

The system application <NUM> is operable to execute one or more instructions at the system processing region <NUM> and in communication with the secure processing region <NUM>. In some implementations, the system application <NUM> includes one or more instructions generated at an external compiler and transferred to the system memory <NUM> of the system processing unit <NUM> by the system communication channel <NUM>. In some implementations, the system application <NUM> is communicatively coupled to the guard service <NUM> by the access point <NUM>. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> restricts access by the system application <NUM> to one or more addresses associated with the access point <NUM>. Thus, in some implementations, the system application <NUM> is able to access the guard service <NUM> only at the one or more addresses associated with the access point <NUM>. The system data objects <NUM> include one or more structures, records, references, or the like accessible to one or more of the system application <NUM>, the system application <NUM>, and the system processor <NUM>. As one example, system data objects include configuration files, cache files, databases, alphanumeric values, hexadecimal values, and pointers. In some implementations, one or more of the system applications <NUM> and <NUM> have at least partial access to at least one of the system data objects <NUM>.

The access point <NUM> is operable to grant access to one or more addresses associated with the secure memory <NUM>. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> restricts access by the one or more of the system memory <NUM> and the system processor <NUM> to the secure memory <NUM> at addresses or address ranges corresponding to at least one of the access point <NUM> and the guard service <NUM>. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> generates the access point <NUM> in accordance with a hardware restriction on one more addresses or address ranges associated with the secure memory <NUM>. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> generates the access point <NUM> by overriding, replacing, removing, or the like, a hardware restriction on one more addresses or address ranges associated with the secure memory. In some implementations, the access point <NUM> is a modifiable access restriction to one or more addresses or address ranges of the secure memory <NUM>, and is not limited to any hardware restriction associated with those addresses or address ranges.

The guard service <NUM> includes one or more instructions for communicatively coupling the system application <NUM> to the secure service <NUM>. In some implementations, the guard service <NUM> includes an application programming interface (API) based at least partially on an API associated with the secure service <NUM>. In some implementations, the guard service <NUM> includes a subset of functions, operations, instructions, or the like, included with the secure service <NUM>. As one example, a guard function <NUM> can include an API function header associated with the secure service <NUM> that passes arguments received to a like API function header of the secure service <NUM>. Alternatively, in some implementations, the guard service <NUM> is directly communicatively coupled to the system application <NUM> in the absence of an access point <NUM> restricting addressing of the secure access region <NUM> of the secure memory <NUM>. In some implementations, the guard service <NUM> restricts transfer of data from the system processing region <NUM> to the secure processing region <NUM>, from the secure processing region <NUM> to the system processing region <NUM>, or a combination thereof. In some implementations, the guard service <NUM> is operable to authenticate one or more of the system applications <NUM> and <NUM>.

In some implementations, the guard service <NUM> is operable to authorize one or more of the system applications <NUM> and <NUM> to access the secure service <NUM>. In some implementations, the guard service <NUM> includes one or more API operations associated with the secure service <NUM> and includes modified instructions associated with one or more of the API operations associated with the secure service <NUM>. As one example, a guard function <NUM> can include an API function header associated with the secure service <NUM> and that returns a void, zero, false, true, null or like value. In some implementations, the guard service <NUM> does not include one or more API operations associated with the secure service <NUM>. The secure service <NUM> includes one or more instructions for communicatively coupling the guard service <NUM> to one or more of the secure application <NUM> and the secure data objects <NUM>. In some implementations, the secure service <NUM> includes one or more functions, operations, instructions, or the like, operable to perform operations within the secure memory <NUM>, and to access the secure application <NUM> and the secure data objects <NUM>. In some implementations, the secure service includes one or more API function headers restricted from use outside of the secure memory <NUM>.

The secure application <NUM> is operable to execute one or more instructions at the secure processing region <NUM> and in communication with the system processing region <NUM>. In some implementations, the secure application <NUM> includes one or more instructions generated at an external compiler and transferred to the system memory <NUM> of the system processing unit <NUM> by the system communication channel <NUM>. In some implementations, the secure application <NUM> is immutably stored at the secure memory <NUM>. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> restricts the system processing region <NUM> or any component thereof from modifying, accessing, or the like, the secure application <NUM>. In some implementations, the secure application <NUM> is communicatively coupled to one or more of the secure service <NUM> and the secure data objects <NUM>. The secure data objects <NUM> include one or more structures, records, references, or the like accessible to one or more of the guard service <NUM>, the secure service <NUM>, and the secure application <NUM>. As one example, system data objects include configuration files, cache files, databases, alphanumeric values, hexadecimal values, and pointers. In some implementations, one or more of the system applications <NUM> and <NUM> have at least partial access to at least one of the system data objects <NUM>.

The system application <NUM> is operable to execute one or more instructions at the system processing region <NUM> and in communication with the secure processing region <NUM>, in accordance with the operation and operability of the system application <NUM>. In some implementations, the system application <NUM> is distinct from and independent of the system application <NUM>. In some implementations, the system application is operable in a processor thread of the system processor <NUM> distinct from a processor thread of the system processor <NUM> associated with the system application <NUM>. In some implementations, the system application <NUM> is communicatively coupled to the guard service <NUM> by the access point <NUM>.

The access point <NUM> is operable to grant access to one or more addresses associated with the secure memory <NUM>. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> restricts access by the one or more of the system memory <NUM> and the system processor <NUM> to the secure memory <NUM> at addresses or address ranges corresponding to at least one of the access point <NUM> and the guard service <NUM>. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> generates the access point <NUM> in accordance with generation of the access point <NUM>. In some implementations, the access point <NUM> is a modifiable access restriction to one or more addresses or address ranges of the secure memory <NUM>, and is not limited to any hardware restriction associated with those addresses or address ranges.

The guard service <NUM> includes one or more instructions for communicatively coupling the system application <NUM> to the secure service <NUM>. In some implementations, the guard service <NUM> includes an API based at least partially on an API associated with the secure service <NUM>. In some implementations, the guard service <NUM> includes a subset of functions, operations, instructions, or the like, included with the secure service <NUM>. As one example, a guard function <NUM> can include an API function header associated with the secure service <NUM> that passes arguments received to a like API function header of the secure service <NUM>. Alternatively, in some implementations, the guard service <NUM> is directly communicatively coupled to the system application <NUM> in the absence of an access point <NUM> restricting addressing of the secure access region <NUM> of the secure memory <NUM>. In some implementations, the guard service <NUM> restricts transfer of data from the system processing region <NUM> to the secure processing region <NUM>, from the secure processing region <NUM> to the system processing region <NUM>, or a combination thereof. In some implementations, the guard service <NUM> is operable to authenticate one or more of the system applications <NUM> and <NUM>. In some implementations, the guard service <NUM> is operable to authorize one or more of the system applications <NUM> and <NUM> to access the secure service <NUM>. In some implementations, the guard service <NUM> includes one or more API operations associated with the secure services correspondingly to the guard service <NUM>. The secure service <NUM> includes one or more instructions for communicatively coupling the guard service <NUM> to one or more of the secure application <NUM> and the secure data objects <NUM> correspondingly to the secure service <NUM>.

<FIG> illustrates an example method of generating a guard service for a secure service in accordance with present implementations. In some implementations, at least one of the example processing system <NUM> and the example memory system <NUM> performs method <NUM> according to present implementations. In some implementations, the method <NUM> begins at step <NUM>.

At step <NUM>, an example system obtains a request at a secure region of a processing system. In some implementations, the secure processor <NUM> obtains the request from the system processor <NUM>. In some implementations, the example system obtains the request at an address associated with the secure memory <NUM>. The method <NUM> then continues to step <NUM>. At step <NUM>, the example system obtains an access address associated with the service request. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> obtains the access address. In some implementations, the access address includes one or more physical or logical memory locations associated with one or more of the secure memory <NUM> and the secure access region <NUM>. The method <NUM> then continues to step <NUM>.

At step <NUM>, the example system validates an address location associated with the access address. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> validates the address location. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> restricts or permits access to the secure memory <NUM> and any component thereof based on validating the address location. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> rejects the request and ends method <NUM> if the address location is not validated, and allows method <NUM> to continue if the address location is validated. In some implementations, step <NUM> includes at least one of step <NUM> and <NUM>. At step <NUM>, the example system validates the address location with a secure access region location. In some implementations, the example system validates the address location by determining whether the address location matches an address or range of addresses associated with the secure access region <NUM> of the secure memory <NUM>. At step <NUM>, the example system validates the address location with the secure access point location. In some implementations, the example system validates the address location by determining whether the address location matches an address or range of addresses associated with at least one of the access points <NUM> and <NUM>. The method <NUM> then continues to step <NUM>.

At step <NUM>, the example system validates a service parameter for the service request. In some implementations, a service parameter includes one or more arguments, variables, references, identifiers, objects, or the like obtained through an API between the secure processing region <NUM> and the system processing region <NUM>. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> restricts or permits access to the secure memory <NUM> and any component thereof based on validating the service. In some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> rejects the request and ends method <NUM> if the service parameter is not validated, and allows method <NUM> to continue if the service parameter is validated. Alternatively, in some implementations, at least one of the secure memory <NUM> and the secure processor <NUM> flags the request for modification if the service parameter is not validated, and allows method <NUM> to continue whether or not the service parameter is validated.

In some implementations, step <NUM> includes at least one of steps <NUM> and <NUM>. At step <NUM>, the example system validates a request parameter. In some implementations, a request parameter includes one or more of the system data objects <NUM>, one or more intermediary objects derived from the system data objects <NUM>, and the like. In some implementations, the example system validates the request parameter by determining whether the request parameter is authorized to be communicated with or from the secure memory <NUM>. As one example, the example system can validate a read request parameter from the secure memory <NUM> and can decline to validate a write request parameter to the secure memory <NUM>. At step <NUM>, the example system validates an application parameter. In some implementations, an application parameter includes one or more identifier objects, authentication objects, tokens, keys, and the like, associated with one or more of the system applications <NUM> and <NUM>. In some implementations, the example system validates the application parameter by determining whether the application parameter is associated with an application authorized to make the obtained requested from the secure memory <NUM>. As one example, the example system can validate an application parameter associated with a system application if that particular system application, class of application, or the like, is authorized to access the requested service, and can otherwise decline to validate the application parameter. The method <NUM> then continues to step <NUM>.

At step <NUM>, the example system generates a secure parameter. In some implementations, the secure processor <NUM> generates the secure parameter. In some implementations, the example system generates the secure parameter based on a data transmission restriction. As one example, a data transmission restriction includes a buffering restriction preventing buffering within the secure memory <NUM>, and the example system generates a secure parameter pointing to a buffer in a system memory <NUM>. As another example, a data transmission restriction includes a pointer restriction preventing transmitting pointers addressed to the system memory <NUM> to the secure memory <NUM>, and the example system generates a secure parameter including a copy of the referenced object. As another example, a data transmission restriction includes a quantity restriction preventing transmitting more than a particular number of API function arguments from the system memory <NUM> to the secure memory <NUM>, and the example system generates a secure parameter including a plurality of intermediary functions each including a number of arguments below the quantity restriction. The method <NUM> then continues to step <NUM>.

At step <NUM>, the example system generates a guard request based on the secure parameter. In some implementations, the secure processor <NUM> generates the guard request. In some implementations, the guard request is associated with a guard service. In some implementations, the guard request includes an API function call derived from the service request. In some implementations, the guard request includes one or more service parameters associated with the service request. In some implementations, the guard request includes one or more secure parameters modifying or replacing one or more of the service parameters. The method <NUM> then continues to step <NUM>. At step <NUM>, the example system generates a secure request based on the guard request. In some implementations, the secure processor <NUM> generates the secure request. In some implementations, the secure request is associated with a secure service. In some implementations, the secure request includes an API function call derived from the guard request. In some implementations, the service request includes one or more service parameters associated with the guard request. In some implementations, the service request includes one or more secure parameters associated with the guard request. The method <NUM> then continues to step <NUM>.

At step <NUM>, the example system processes the secure request at the secure service. In some implementations, the secure processor processes the secure service. In some implementations, the example system process the secure service by communicating with, accessing, modifying, or the like, one or more of the secure services <NUM> and <NUM>, the secure application <NUM>, and the secure data objects <NUM>. In some implementations, the method <NUM> ends at step <NUM>.

<FIG> illustrates an example method of accessing a secure service with a guard service in accordance with present implementations. In some implementations, a compiler device, system, or the like associated with at least one of the example processing system <NUM> and the example memory system <NUM> performs method <NUM> according to present implementations. In some implementations, the compiler device is operable to detect one or more conditions requiring generating, modifying, or the like, guard services and access points associated with particular applications. In some implementations, the method <NUM> begins at step <NUM>.

At step <NUM>, the example system detects a call to a secure service at a secure region. In some implementations, the exemplary system detects at least one instruction including a call from the system processing region <NUM> to the secure processing region <NUM>, or from the secure processing region <NUM> to the system processing region <NUM>. In some implementations, the call includes, but is not limited, to at least one of an API request from a system application to a secure service, an API response from a secure service to a system application, an API request from a secure service to a system data object, and the like. The method <NUM> then continues to step <NUM>. At step <NUM>, the example system obtains a secure interface associated with the secure service. In some implementations, the secure interface includes one or more API functions, and API function header file, or the like. In some implementations, the call includes an API request associated with one or more API functions associated with the secure interface. The method <NUM> then continues to step <NUM>.

At step <NUM>, the example system obtains a security policy associated with the secure service. In some implementations, the security policy includes one or more validation criteria associated with one or more secure parameters of the secure service. In some implementations, the validation criteria define conditions under which guard services are created for secure services. In some implementations, the validation criteria also define conditions under which access points are created for guard services. In some implementations, validation criteria include one or more of buffering restrictions, data transmission restrictions, access restrictions, and the like. In some implementations, access restrictions include, but are not limited to, preventing or limiting access to system application based on identifiers, keys, tokens, or the like associated therewith. In some implementations, the example system immutably stores validation criteria. The method <NUM> then continues to step <NUM>.

At step <NUM>, the example system validates the secure interface associated with the secure service. In some implementations, the example system validates the secure interface by determining whether the system processing region is authorized to access the secure service associated with the call under the validation criteria. In some implementations, the example system validates the secure interface by determining whether to a particular system application associated with the call is authorized to access the secure service associated with the call under the validation criteria. In some implementations, step <NUM> includes step <NUM>. At step <NUM>, the example system validates one or more operations associated with the secure interface. In some implementations, the example system validates the secure interface by determining whether at least one API function called by a particular system application is authorized to call the secure service under the validation criteria. In some implementations, the example system validates the secure interface by determining whether at least one API function called by a particular system application is authorized to call the secure service under the validation criteria. In some implementations, step <NUM> includes step <NUM>. The method <NUM> then continues to step <NUM>.

At step <NUM>, the example system the example system generates a guard interface based on the secure service. In some implementations, the example system generates a guard interface including one or more validated portions of the secure interface. In some implementations, the example system generates the guard interface including only validated portions of the secure interface. In some implementations, the guard interface includes an API interface including one or more calls to corresponding functions, operations, or the like, of the secure interface. As one example, the example system can generate a guard API including only validated functions of the secure API. As another example, the example system can generate a guard API including only validated arguments of the secure API. In some implementations, the example system modifies the call to the secure service to instead call the guard service. Thus, the example system can automatically generate a guard service logically interposed between a calling system application and a called secure service. In some implementations, step <NUM> includes at least one of steps <NUM> and <NUM>. At step <NUM>, the example system modifies one or more operations associated with the secure interface. At step <NUM>, the example system modifies one or more parameters associated with the secure interface. As one example, the example system replaces at least one service parameter associated with the call to the secure service with a secure parameter. The method <NUM> then continues to step <NUM>. At step <NUM>, the example system generates a guard service based on the guard interface. In some implementations, the guard service includes one or more operations, functions, or the like corresponding to the called secure service. The method <NUM> then continues to step <NUM>.

At step <NUM>, the example system locates the guard interface at a secure address. In some implementations, the example system locates the guard interface at a particular address or range of addresses at the secure memory <NUM>. In some implementations, the particular address or range of addresses is designated for allowing access by a system application from the system processing region. The method <NUM> then continues to step <NUM>. At step <NUM>, the example system generates an access point at the secure access address. In some implementations, the example system generates the access point by associating the secure access address or range of addresses with an access condition. In some implementations, the access condition allows one or more of a system application, the system memory <NUM>, and the system processor <NUM> to directly address the secure memory <NUM> at the secure access address. In some implementations, the access point overrides a default condition restricting or preventing access to any portion of the secure access region <NUM> or the secure memory <NUM> from the system application, the system memory <NUM>, and the system processor 124In some implementations, the method <NUM> ends at step <NUM>.

The herein described subject matter sometimes illustrates different components contained within, or connected with, different other components. It is to be understood that such depicted architectures are illustrative, and that in fact many other architectures can be implemented which achieve the same functionality. Likewise, any two components so associated can also be viewed as being "operably connected," or "operably coupled," to each other to achieve the desired functionality, and any two components capable of being so associated can also be viewed as being "operably couplable," to each other to achieve the desired functionality.

With respect to the use of plural and/or singular terms herein, those having skill in the art can translate from the plural to the singular and/or from the singular to the plural as is appropriate to the context and/or application.

It will be understood by those within the art that, in general, terms used herein, and especially in the appended claims (e.g., bodies of the appended claims) are generally intended as "open" terms (e.g., the term "including" should be interpreted as "including but not limited to," the term "having" should be interpreted as "having at least," the term "includes" should be interpreted as "includes but is not limited to," etc.).

Although the figures and description may illustrate a specific order of method steps, the order of such steps may differ from what is depicted and described, unless specified differently above. Also, two or more steps may be performed concurrently or with partial concurrence, unless specified differently above. Such variation may depend, for example, on the software and hardware systems chosen and on designer choice. All such variations are within the scope of the disclosure. Likewise, software implementations of the described methods could be accomplished with standard programming techniques with rule-based logic and other logic to accomplish the various connection steps, processing steps, comparison steps, and decision steps.

It will be further understood by those within the art that if a specific number of an introduced claim recitation is intended, such an intent will be explicitly recited in the claim, and in the absence of such recitation, no such intent is present. However, the use of such phrases should not be construed to imply that the introduction of a claim recitation by the indefinite articles "a" or "an" limits any particular claim containing such introduced claim recitation to inventions containing only one such recitation, even when the same claim includes the introductory phrases "one or more" or "at least one" and indefinite articles such as "a" or "an" (e.g., "a" and/or "an" should typically be interpreted to mean "at least one" or "one or more"); the same holds true for the use of definite articles used to introduce claim recitations. In addition, even if a specific number of an introduced claim recitation is explicitly recited, those skilled in the art will recognize that such recitation should typically be interpreted to mean at least the recited number (e.g., the bare recitation of "two recitations," without other modifiers, typically means at least two recitations, or two or more recitations).

Furthermore, in those instances where a convention analogous to "at least one of A, B, and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B, and C" would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and/or A, B, and C together, etc.). In those instances where a convention analogous to "at least one of A, B, or C, etc." is used, in general, such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B, or C" would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and/or A, B, and C together, etc.). It will be further understood by those within the art that virtually any disjunctive word and/or phrase presenting two or more alternative terms, whether in the description, claims, or drawings, should be understood to contemplate the possibilities of including one of the terms, either of the terms, or both terms.

Further, unless otherwise noted, the use of the words "approximate," "about," "around," "substantially," etc., mean plus or minus ten percent.

Claim 1:
A method of generating a guard service for a secure service at a secure processing region (<NUM>) of a processing system, the method being performed by a compiler and comprising:
(<NUM>) detecting a call from a system processing region (<NUM>) of the processing system to a secure service (<NUM>, <NUM>) included in a secure memory (<NUM>) of the secure processing region (<NUM>);
(<NUM>) obtaining a secure interface associated with the secure service (<NUM>, <NUM>);
(<NUM>) obtaining a security policy associated with the secure service (<NUM>, <NUM>), the security policy including an access restriction associated with the secure memory (<NUM>) of the secure processing region (<NUM>);
(<NUM>) validating the secure interface associated with the secure service (<NUM>, <NUM>) based on the access restriction;
(<NUM>) generating a guard interface based at least partially on the secure interface;
(<NUM>) generating a guard service (<NUM>, <NUM>) based at least partially on the guard interface;
locating the guard service (<NUM>, <NUM>) at the secure memory (<NUM>) of the secure processing region (<NUM>);
(<NUM>) locating the guard interface at a secure address at the secure memory (<NUM>) of the secure processing region (<NUM>); and
(<NUM>) generating an access point (<NUM>, <NUM>) at the secure address at the secure memory (<NUM>) of the secure processing region (<NUM>) by associating the secure address with an access condition allowing one or more of a system memory (<NUM>) and a system processor (<NUM>) included in the system processing region (<NUM>) to directly address the secure memory (<NUM>) at the secure address, the access point (<NUM>, <NUM>) overriding a default condition restricting or preventing access to the secure memory (<NUM>) from the system memory (<NUM>) and the system processor (<NUM>) included in the system processing region (<NUM>).