UltraSoC’s Bus Sentinel: Real‑Time Hardware IP Securing SoC Bus Transactions

UltraSoC has unveiled the first member of a new family of hardware‑based embedded real‑time monitoring IP modules. Designed to detect, block, and log cyber‑attacks, these modules are tailored for high‑security environments such as automotive systems and factory robots.

Unveiled at Arm TechCon, the Bus Sentinel empowers SoC designers to control access to sensitive device regions, instantly identify and neutralise suspicious transactions, and compile long‑term operational profiles that safeguard against both current and emerging threats.

In a briefing with EE Times, Chief Strategy Officer Aileen Ryan highlighted that UltraSoC’s monitoring and analytics IP is already a proven, chip‑level data source. The new product line addresses cybersecurity challenges in OTA‑prone applications, offering hardware‑level visibility at clock speed to react in real time—critical in autonomous vehicles where microseconds matter.

The module tracks the SoC’s internal bus, monitoring interactions among interconnected sub‑blocks. It can be configured at runtime to flag specific transaction types—for example, a process attempting to access memory‑controller control registers outside of a system reboot, or an unauthorized attempt to reach protected memory.

Beyond detection, the Bus Sentinel can respond immediately: allow the transaction, block it via transaction gating, modify it (e.g., flagging), or generate a bus response. It can also trigger an event on the dedicated UltraSoC communications fabric, enabling instant action by other system blocks or external threat‑mitigation platforms.

Its suite of configurable filters, counters, and timers enables detection of known security threats and supports diverse defensive strategies. Suspicious transactions can be flagged, monitored covertly to profile attackers, blocked with optional responses to the initiator, or used to trigger system‑wide defenses via the UltraSoC fabric.

Integrated storage units record data for future transaction identification. Paired with UltraSoC’s broader infrastructure, the module can supply rich statistical insights to on‑chip analytics engines or external cloud systems, creating a “signature” of normal behavior across many device deployments—allowing threat‑mitigation logic to evolve with the threat landscape.

Transparent Monitoring and Forensic Capabilities

Embedded directly in hardware, the Bus Sentinel continuously verifies device operation, catching anomalous behavior that signals security breaches. Because it operates in hardware, it can react in microseconds, is difficult to subvert, and can counter zero‑day attacks the designers hadn’t anticipated. It also offers forensic “black‑box” recording, essential for post‑incident analysis.

Ryan noted that black‑box logs are becoming critical—for example, in autonomous vehicle incidents where liability can shift from driver to manufacturer or supply‑chain partners. “Being resident at bare metal gives us access to data no one else has, providing detailed evidence of attacks or failures,” she said.

David Rogers, CEO of cybersecurity firm Copper Horse, remarked: “As threats evolve and their impact grows, hardware‑centric security delivers unparalleled advantages. UltraSoC’s technology places protection at the heart of the SoC, monitoring, detecting, and addressing risks at the most fundamental level.”

The UltraSoC Bus Sentinel became generally available in Q1 2020. Its modular architecture supports any bus protocol, with immediate compatibility for common on‑chip buses such as Arm APB, AHB, AXI‑4, and ACE.