Security Technology for Peripheral Component Interconnect (PCI) Express (PCIE) Systems

Abstract

Security technology for peripheral component interconnect (PCI) express (PCIE) systems includes a transport layer protocol (TLP) packet having a pre-placed TLP prefix indicating the security features of the TLP packet and an integrity check value (ICV) attached to the TLP packet. The ICV is based on the TLP packet and any TLP prefix (including the security prefix). At the receiver, if the ICV does not match, the receiver has evidence that the TLP packet may have been tampered with. In addition, the TLP packet can be encrypted to prevent eavesdropping, and this feature will be indicated in the TLP prefix. Further, the TLP prefix can include a counter that can be used to prevent replay attacks. PCIE allows for flexible TLP prefixes, and therefore, the standard can easily adapt to the addition of a TLP prefix indicating the security features of the TLP packet.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is related to and claims the benefit of U.S. Provisional Patent Application Serial No. 62 / 731,286, filed on September 14, 2018, entitled “SECURITY TECHNIQUES FOR APERIPHERAL COMPONENT INTERCONNECT (PCI) EXPRESS (PCIE) SYSTEM”.

[0003] This application also relates to and claims the benefit of U.S. Provisional Patent Application Serial No. 62 / 745,542, filed on October 15, 2018, entitled “SECURITY TECHNIQUESFOR A PERIPHERAL COMPONENT INTERCONNECT (PCI) EXPRESS (PCIE) SYSTEM”.

[0004] This application also relates to and claims the benefit of U.S. Provisional Patent Application Serial No. 62 / 788,264, filed on January 4, 2019, entitled “SECURITY TECHNIQUES FORA PERIPHERAL COMPONENT INTERCONNECT (PCI) EXPRESS (PCIE) SYSTEM”.

[0005] This application also relates to and claims the benefit of U.S. Provisional Patent Application Serial No. 62 / 840,643, filed on April 30, 2019, entitled “SECURITY TECHNIQUES FORA PERIPHERAL COMPONENT INTERCONNECT (PCI) EXPRESS (PCIE) SYSTEM”.

[0006] This application also relates to and claims the benefit of U.S. patent application serial number 16 / 569,816, filed on September 13, 2019, entitled “SECURITY TECHNIQUES FORA PERIPHERAL COMPONENT INTERCONNECT (PCI) EXPRESS (PCIE) SYSTEM”.

[0007] The above-listed applications are incorporated herein by reference in their entirety. Technical Field

[0008] The technology of the present disclosure relates generally to Peripheral Component Interconnect (PCI) Express (PCIE) systems, and more particularly to providing security to such PCIE systems. Background Art

[0009] Computing devices have become commonplace in modern society. The increase in the use of computing devices is due in part to the increase in the functionality of the devices. In many cases, the increase in functionality is the result of different integrated circuits (ICs) within the computing device, each with different capabilities. A byproduct of having multiple ICs in a computing device is the requirement to have some mechanism through which the ICs can communicate.

[0010] One popular mechanism is a bus that complies with the Peripheral Component Interconnect (PCI) standard. PCI has evolved to multiple versions and has multiple variants. At the time of writing, perhaps the most popular variant is PCI Express (PCIE). At the time of the parent case provisional application, the latest version of PCIE was revision 5.0 (i.e., version 0.7), which was released on March 31, 2018. The most recent revision 5.0 (i.e., version 1.0) was released on May 28, 2019. Although the PCIE standard is flexible and widely used, it has not yet included any security measures to prevent unauthorized tampering, eavesdropping, replay, etc.

[0011] Historically, the lack of security measures has been mitigated by the fact that the conductors carrying PCIE-compatible signals are relatively inaccessible within computing devices. However, recent developments have seen PCIE being adopted outside of traditional computing devices and expanded into roles not previously considered. For example, PCIE can be used within wiring harnesses within vehicles. The longer the conductors between components, the greater the vulnerability, and the greater the need for security systems for PCIE links. Summary of the invention

[0012] Aspects disclosed in the specific implementation include security techniques for peripheral component interconnect (PCI) express (PCIE) systems. In an exemplary aspect, a transport layer protocol (TLP) packet is prepended with a TLP prefix indicating the security features of the TLP packet. Such security features may include a counter or equivalent counter for preventing replay attacks, encrypting the payload of the TLP packet to prevent eavesdropping, and / or an authentication value for detecting tampering calculated from one or more parts of the TLP packet. The TLP prefix may indicate which security features (if any) exist in the associated TLP packet. In an exemplary aspect, the counter may be a monotonically increasing number included in each packet. In an exemplary aspect, the authentication value may be an integrity check value (ICV) attached to the TLP packet. The ICV is based on the TLP packet and any TLP prefix (which includes the security prefix). At the receiver, if the ICV does not match, the receiver has evidence that the TLP packet may have been tampered with.

[0013] In this regard, in one aspect, a method for providing secure communication between devices at either end of a PCIE link is disclosed. The method includes prepending a TLP prefix to a TLP packet. The TLP prefix includes an indication that the TLP packet is a secure packet. The method also includes appending to the TLP packet an identifier generated by a cryptographic calculation at least in part on a portion of the TLP packet. The method also includes sending the TLP packet from a first device in the device to another device in the device via the PCIE link.

[0014] In another aspect, a method for providing secure communication between devices at either end of a PCIE link is disclosed. The method includes prepending a TLP prefix to a TLP packet. The TLP prefix includes an indication that the TLP packet is a secure packet. The method also includes encrypting a payload of the TLP packet. The method also includes sending the TLP packet from a first device in the device to another device in the device via the PCIE link.

[0015] In another aspect, a method for providing secure communication between devices at either end of a PCIE link is disclosed. The method includes prepending a TLP prefix to a TLP packet. The TLP prefix includes an indication that the TLP packet is a secure packet and includes a counter value representing a monotonically increasing counter for detecting a replay attack. The method also includes sending a TLP packet from a first device in the device to another device in the device via the PCIE link.

[0016] On the other hand, a PCIE system is disclosed. The PCIE system includes a host device. The host device includes a root complex, a host encryption / decryption engine, and a host interface. The PCIE system also includes a PCIE link coupled to the host interface. The PCIE system also includes an endpoint device. The endpoint device includes an endpoint interface coupled to the PCIE link and an endpoint encryption / decryption engine. The root complex is configured to prepend a TLP prefix to a TLP packet. The TLP prefix includes an indication that the TLP packet is a secure packet and a counter value representing a monotonically increasing counter for detecting replay attacks. The root complex is also configured to encrypt the payload of the TLP packet. The root complex is also configured to attach a cryptographically generated identifier calculated at least in part on a portion of the TLP packet to the TLP packet. The root complex is also configured to send the TLP packet from the first of the host device and the endpoint device to the other of the host device and the endpoint device via the PCIE link. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a block diagram of an exemplary computing system having devices coupled via a peripheral component interconnect (PCI) express (PCIE) link;

[0018] Figure 2A block diagram showing an exemplary PCIE endpoint device, in particular, configuration registers within an endpoint;

[0019] Figure 3 A block diagram of a host having a processor and PCIE hardware with registers according to an exemplary aspect of the present disclosure is shown;

[0020] Figure 4 is a simplified schematic diagram of an exemplary computing system within a vehicle;

[0021] Figure 5 is a simplified PCIE write packet with a prefix and a suffix according to an exemplary aspect of the present disclosure;

[0022] Figure 6 is a simplified PCIE read packet with a prefix and a suffix according to an exemplary aspect of the present disclosure;

[0023] Figure 7 is a simplified PCIE completion packet with a prefix and a suffix according to an exemplary aspect of the present disclosure;

[0024] Figure 8 A simplified diagram of packet flow through a PCIE system according to an exemplary aspect of the present disclosure is provided;

[0025] Fig. 9 is a block diagram of an exemplary mobile terminal that may include a PCIE system using security features according to the present disclosure; and

[0026] Fig. 10A and 10B Flowcharts of an exemplary security-driven process according to the present disclosure from the perspective of a root complex and an endpoint, respectively. DETAILED DESCRIPTION

[0027] Referring now to the accompanying drawings, several exemplary aspects of the present disclosure are described. The word "exemplary" as used herein means "serving as an example, instance, or illustration." Any aspect described herein as "exemplary" is not necessarily to be construed as being preferred or advantageous over other aspects.

[0028] Aspects disclosed in the specific implementation include security techniques for peripheral component interconnect (PCI) express (PCIE) systems. In an exemplary aspect, a transport layer protocol (TLP) packet is prepended with a TLP prefix indicating the security features of the TLP packet. Such security features may include a counter or equivalent counter for preventing replay attacks, encrypting the payload of the TLP packet to prevent eavesdropping, and / or an authentication value for detecting tampering calculated from one or more parts of the TLP packet. The TLP prefix may indicate which security features (if any) exist in the associated TLP packet. In an exemplary aspect, the counter may be a monotonically increasing number included in each packet. In an exemplary aspect, the authentication value may be an integrity check value (ICV) attached to the TLP packet. The ICV is based on the TLP packet and any TLP prefix (which includes the security prefix). At the receiver, if the ICV does not match, the receiver has evidence that the TLP packet may have been tampered with.

[0029] Before launching into specific aspects of the present disclosure, reference is made to Figure 1-4 Provides an overview of the PCIE system and example use cases. Figure 5 Initially, exemplary groupings according to the present disclosure are provided.

[0030] At this point, Figure 1A computing environment 100 is shown in which a host 102 is directly coupled to a plurality of devices 104(1)-104(N) and is coupled to a second plurality of devices 106(1)-106(M) through a switch 108. The host 102 may include a PCIE root complex (RC) 110, which includes a link interface (not directly shown) configured to couple to a plurality of PCIE links 112(1)-112(N+1). Note that PCIE links may sometimes be referred to as one or more buses. However, since PCIE links are point-to-point links, the term "link" is used in the PCIE specification. The switch 108 communicates with the devices 106(1)-106(M) via the PCIE links 114(1)-114(M). The devices 104(1)-104(N) and 106(1)-106(M) may be or may include PCIE endpoints. In a first exemplary aspect, computing environment 100 may be a single computing device, such as a computer, where host 102 is a central processing unit (CPU) and devices 104(1)-104(N) and 106(1)-106(M) are internal components such as hard drives, disk drives, etc. In a second exemplary aspect, computing environment 100 may be a computing device where host 102 is an integrated circuit (IC) on a board and devices 104(1)-104(N) and 106(1)-106(M) are other ICs within the computing device. In a third exemplary aspect, computing environment 100 may be a computing device having an internal host 102 coupled to external devices 104(1)-104(N) and 106(1)-106(M), such as a server coupled to one or more external memory drives. Note that these aspects are not necessarily mutually exclusive, as different devices in the device may be ICs that are internal or external relative to a single host 102.

[0031] Figure 2 Provides can be Figure 1A block diagram of a device 200 that is one of the devices 104 (1)-104 (N) or the devices 106 (1)-106 (M) of the present invention. Specifically, the device 200 acts as an endpoint in a PCIE system and can be, for example, a memory device that includes a memory element 202 and a control system 204. In addition, the device 200 includes a PCIE hardware element 206, which includes a link interface configured to be coupled to a PCIE link. The PCIE hardware element 206 may include a physical layer (PHY) 208, which is a link interface or works with a link interface to communicate on the PCIE link. The control system 204 communicates with the PCIE hardware element 206 via a system bus 210. The PCIE hardware element 206 may also include a plurality of registers 212. The registers 212 can be conceptually divided into configuration registers 214 and capability registers 216. The configuration registers 214 and capability registers 216 are defined by the original PCI standard, and the latest devices that include the registers 214 and 216 are backward compatible with legacy devices. The ability to use the encryption system or other security mechanisms of the present disclosure may be stored in the capability register 216 or the extended configuration register space 218 and accessed at startup or initialization. The PCIE hardware element 206 may also have an encryption / decryption engine 220 that encrypts and decrypts packets sent according to the present disclosure.

[0032] Similarly, Figure 3 It shows that it can be Figure 1 The host 300 of the host 102 of the present invention. The host 300 may include an application processor 302 or other processor core communicating with a memory element 304 having an operating system 306 operating therewith. A system bus 308 interconnects the application processor 302 with the memory element 304 and the PCIE RC 310. The PCIE RC 310 may include a PHY 312, which works with or is a link interface configured to be coupled to a PCIE link. The PCIE RC 310 also includes a plurality of registers, including a configuration address register 318 (CONFIG_ADDR) and a data register 320 (CONFIG_DATA). The capabilities and configurations of various endpoints may be stored in the data register 320, so that the root complex may use the security features of the present disclosure with the endpoints so enabled. In addition, the PCIE RC 310 may include an encryption / decryption engine 322, which encrypts and decrypts packets sent according to the present disclosure.

[0033] Note that having encryption / decryption engines 220 and 322 at both the endpoint and the root complex enables two-way encrypted communications.

[0034] Figure 4 4 is a simplified block diagram of a vehicle 400 in which one or more PCIE links may be included. The vehicle 400 is shown as a car, but may be another form of vehicle, such as a motorcycle, a boat, an airplane, etc. The vehicle 400 may include various sensors 402 (1)-402 (N), where N=7 as shown. It should be understood that there may be more or less than seven sensors 402. The sensors 402 (1)-402 (N) may be proximity sensors that use sonar, laser, or some form of radar to detect nearby objects. In addition, the vehicle 400 may include one or more interior sensors 404 (1)-404 (2). The interior sensors 404 (1)-404 (2) may detect whether the door 406 is open or other interior conditions of the vehicle 400. The vehicle 400 may also include one or more cameras 408 (1)-408 (M), where M=4 as shown. It should be understood that there may be more or less than four cameras 408. Vehicle 400 may have a network 410 that couples some or all of sensors 402 and 404 to a hub 412. A bridge 414 may be present to help provide network 410. A display 416 and speakers 418 may also be associated with network 410. Hub 412 may include a control system that accesses software stored in memory 420.

[0035] It should be understood that Figure 4 The illustration of vehicle 400 in is greatly simplified. Network 410 can be a single homogeneous network, such as a common bus with a multi-point or ring topology, or can be formed by different communication links (such as separate point-to-point cables). Likewise, there may be multiple hubs for multiple purposes. Some inputs can reach one or more hubs. Hubs can be interconnected and / or replicated for redundancy purposes. In the case where the communication link is a point-to-point cable, PCIE can be used, and therefore, an automobile or other vehicle environment can benefit from the exemplary aspects of the present disclosure. Specifically, automotive suppliers may not want their algorithms to be exposed to competitors or damaged, thereby compromising autonomous driving or engine performance.

[0036] Exemplary aspects of the present disclosure provide three supporting security measures to assist in providing secure messaging between a host and an endpoint over a PCIE link. The first security measure is to encrypt the payload of a packet so that the packet cannot be intercepted. The second security measure is to use a counter or equivalent counter to prevent replay attacks. The third security measure is to provide a cryptographically generated identifier or authentication mechanism that is calculated at least in part on the content of the packet to detect tampering. To assist in the use of these security measures, exemplary aspects of the present disclosure provide a TLP prefix that includes an indication of whether a particular security measure is being used.

[0037] In this regard, please refer to Fig. 10Aand 10B Processes 1000A and 1000B are provided for implementing the security technology of the present disclosure. Process 1000A is from the perspective of the root complex and process 1000B is from the perspective of the endpoint. Although processes 1000A and 1000B take certain perspectives for illustration, it should be understood that communication can be bidirectional and that endpoint 200 can read and write from root complex 310 within host 300. At this point, process 1000A begins with the initialization of the system (box 1002). This initialization can occur at startup, reboot, etc., but involves the root complex 310 recognizing that endpoint 200 has been connected to a PCIE link. Root complex 310 reads the capabilities of endpoint 200, such as by reading registers in capability registers 216 (box 1004). Once root complex 310 knows that endpoint 200 has the ability to secure PCIE, root complex 310 can enable security functions in endpoint 200 and establish and exchange security keys (box 1006). The keys may be negotiated through Diffie-Helman key exchange or any other key exchange protocol based on a public key infrastructure (PKI) system. The keys may be supplied and used as is or may have some derivation as needed or desired.

[0038] Process 1000A continues, and root complex 310 determines whether the payload should not be snooped (box 1008). This determination may be based on default rules, the type of endpoint with which root complex 310 is communicating, or other rules, as needed or desired. At some point, root complex 310 is informed that host 300 has data to be written to the endpoint. Therefore, a write command (box 1010) is required to provide the data to endpoint 200. Root complex 310 creates a header corresponding to the write command with the appropriate address (box 1012). The header may include a packet number that acts as a counter to prevent replay attacks. A TLP prefix is ​​created that contains an indication of which (if any) security features are being used (box 1014). Depending on whether encryption is indicated at box 1008 and / or whether tamper detection is desired, the payload is encrypted and an integrity check value (ICV) is calculated (box 1016). If the payload does not need to be protected from snooping or tamper detection, this step can be skipped. The root complex 310 appends the ICV based on the prefix, header, and payload (block 1018). A write command is sent to the endpoint 200 over the PCIE link (block 1020).

[0039] In the case where the root complex 310 is instructed to obtain data from the endpoint 200, a read command is required (box 1022), and the process 1000A continues. The root complex 310 creates a header with the address from which the data is to be read (box 1024). The root complex 310 creates a TLP prefix indicating the security nature of the packet (box 1026). The root complex 310 calculates and appends the ICV based on the combined header and prefix (box 1028). The root complex 310 then sends a read command (box 1030). As a read command, there is usually no payload, and therefore encryption can be omitted. The root complex 310 should eventually receive a security completion packet from the endpoint 200 (box 1032). If encryption is indicated, the root complex 310 decrypts the payload of the security completion packet (box 1034), and checks the ICV of the security completion packet (box 1036) to see if the data in the payload of the security completion packet has been corrupted. Note that without departing from the scope of the present disclosure, the decryption of the payload of the packet and the verification of the ICV can occur simultaneously or in reverse order. If the ICV check fails, the receiver can call a fault similar to an end-to-end cyclic redundancy check (ECRC) error. That is, for a memory read command, a completion with an unsupported request (UR) completion status will be returned. Since the receiver cannot distinguish between naturally occurring errors and attacks, software can be used to make this determination. Alternatively, the receiver can terminate the connection because it is damaged. After termination, a new encrypted link can be established using a new key. Similarly, an alert can be provided to an intrusion detection system, etc. Other moves of encryption (algorithms, key lengths, etc.) can also be performed to facilitate the re-establishment of a secure or safe state. The packet numbering of the TLP prefix can also be verified to stop replay attacks. The root complex 310 can then use the received data (block 1038).

[0040] Note that the read and write commands may occur in the reverse order, in duplicate, or in other orders than those presented in process 1000A. It should also be noted that the ICV may be replaced with other authentication values ​​or cryptographically generated identifiers calculated at least in part based on one or more portions of the packet. Likewise, while it is contemplated that the packet number acting as a monotonically increasing counter is used to detect replay attacks, other forms of counter equivalents may be used without departing from the scope of the present disclosure.

[0041] The process 1000B from the endpoint 200 side is similar in that the process 1000B begins with system initialization (block 1050). During initialization, the endpoint 200 may provide an indication that the endpoint 200 is security-capable (block 1052). If the root complex 310 enables secure communications, the root complex 310 and the endpoint 200 exchange keys (block 1054). At some point, the root complex 310 sends a receive write command, and the endpoint 200 receives the write command (block 1056). If the payload is encrypted, the endpoint 200 decrypts the payload (block 1058) and checks the ICV of the command (block 1060). If necessary, the ICV can be checked before the payload is decrypted. The endpoint 200 also checks the packet number to see if the packet is the next packet to prevent replay attacks (or at least detect attempted replay attacks). Out-of-order packets can be discarded. If the ICV is correct, the endpoint 200 writes the data from the payload to the address in the header (block 1062). Such addresses may correspond to addresses in memory element 202 .

[0042] At other times, a read command is received (block 1064). Endpoint 200 checks the ICV (block 1066). If the ICV is correct, endpoint 200 retrieves the data from the address indicated in the header (in memory element 202) (block 1068) and creates a packet with the header (block 1070). The packet may include an appropriate packet number. Endpoint 200 may then create a TLP prefix (block 1072). If encryption is indicated, endpoint 200 encrypts the payload and calculates the ICV of the packet (block 1074), and appends the ICV to the packet (block 1076). Endpoint 200 then sends a security completion packet with the payload to root complex 310 (block 1078).

[0043] Again, it should be noted that the nature of the bidirectional communication may reverse the roles of the root complex 310 and the endpoint 200 with respect to the source of the read / write commands and corresponding responses.

[0044] In addition, it should be noted that in the presence of an intermediate switch or bridge (e.g., switch 108), aspects of the present disclosure are end-to-end secure, so that such an intermediate switch does not affect encryption. For example, switch 108 can pass packets without inspecting or changing the data. Switch 108 only needs to evaluate the header of the address so that it can be passed, and the header is not encrypted. It should be understood that if there is no intermediate switch, the exemplary aspects of the present disclosure are effective link-based security (e.g., the link between host 102 and EP 104 (1) is both end-to-end secure and link-based security). Note that each link of a multi-step PCIE system (e.g., from host 102 through switch 108 to EP 106 (1)) can be link-based security, although in this case, each component may need to be authenticated. This structure requires switch 108 to have encryption capabilities. In such a system, it may be necessary to replace a traditional switch that does not have encryption capabilities.

[0045] To implement processes 1000A and 1000B, a new TLP prefix is ​​defined and prepended to the packet. Also, an ICV or other authentication value calculated based at least in part on a portion of the packet is appended to the packet. Figure 5-7 An exemplary modified grouping is shown in FIG. Figure 5 A secure write packet 500 is shown having a header 502, a payload 504 to be written to the endpoint 200 (or to the host 300 if originating from the endpoint 200), a TLP prefix 506, and an ICV 508. The TLP prefix 506 is prepended to the header 502, and the ICV 508 is appended after the payload 504. The header 502 is never encrypted because the information in the header 502 is needed for routing purposes. The header 502 can be well understood by the fields defined by the PCIE specification.

[0046] It should be understood that the header 502 may be signed (but still not encrypted) as outlined in AES-GCM-128. Such a signed header may be referred to as "Additional Authentication Data" (AAD).

[0047] The TLP prefix 506 includes a TLP identifier field 510 indicating that the TLP prefix 506 is a security prefix. In addition, the TLP prefix 506 includes a key number (KN) bit 512, a long ICV (LI) bit 514, a payload encryption (PE) bit 516 (or alternatively referred to as a TLP encryption (TE) bit) and a packet number field 518. It should be understood that the TLP prefix is ​​defined based on eight-bit portions. The TLP identifier field 510 is eight bits, and the KN bit 512, the LI bit 514, and the PE bit 516 are another three bits. The packet number field 518 can be twenty-one (21) bits to provide a TLP prefix 506 of appropriate size.

[0048] Payload 504 may be encrypted as needed or desired. If payload 504 is encrypted, this state is indicated by setting PE bit 516. If the data in payload 504 only needs to avoid tampering and does not involve monitoring, the data in payload 504 may not be encrypted. Abandoning encryption in this way can reduce the total overhead, otherwise the data in payload 504 will be encrypted at root complex 310 and decrypted at endpoint 200. Note that in an exemplary aspect, if PE bit 516 is set in a read request, the return completion payload should be encrypted. Note that TLP data is DWORD aligned (e.g., 4 bytes). Block ciphers can accept 16 bytes of data (e.g., block aligned). Therefore, padding data may not be sent, but may be attached by the security layer at the receiver to perform calculations.

[0049] ICV 508 may be a long ICV having thirty-two (32) bytes or a short ICV having sixteen (16) bytes. The difference in length of ICV 508 is indicated in L1 bits 514. As described above, ICV 508 may be calculated using an integrity cryptographic algorithm such as AES-GCM-128 and may be calculated in the secure TLP prefix, TLP header, and payload (i.e., calculated based at least in part on one or more portions of the packet).

[0050] Note that although specific fields and bits are contemplated, these bits and fields may be modified without departing from the scope of the present disclosure. For example, if only one size of ICV is allowed, the LI bit 514 may be omitted. Similarly, the LI bit 514 may more generally indicate the presence or absence of an authentication value (or cryptographically generated identifier) ​​appended to the packet. Although exemplary aspects of the present disclosure contemplate that the ICV may replace a cyclic redundancy check (CRC) field in a packet (e.g., a CRC field defined by the PCIE specification), the ICV or other authentication value may be added after the CRC field. It should be understood that in addition to detecting tampering, the use of an ICV or other cryptographically generated identifier may also detect bit errors, such as bit error detection currently performed using a CRC.

[0051] KN bit 512 indicates which key is being used. As is understood in the art of cryptography, a key may expire after a certain period of time. Rekeying is an understandable process. However, because the present disclosure relies on a shared key, an endpoint may also be rekeyed when the first key expires. In order for the endpoint to know which key is being used (e.g., before or after a key update), KN bit 512 may be toggled to indicate which key is being used.

[0052] Packet number field 518 contains the packet number, which is a monotonically increasing number used to prevent replay attacks. The packet number can also be used to help detect lost packets as needed or desired. In use, the receiver expects valid packets to have increasing packet numbers. If the received packets have non-sequential packet numbers, the packets may be discarded even if the ICV is valid. By discarding packets with duplicate or non-sequential packet numbers, replay attacks can be avoided (reusing the same packet to achieve duplicate results). If twenty-one bits are inappropriate for some reason, the packet number can be shortened or only the least significant bit can be sent.

[0053] Likewise, instead of counting packets with packet number field 518, packet number field 518 may reference the TLP number, or some other element may be counted (e.g., sets of four packets or sets of three write commands) as long as it is monotonically increasing and can be compared to an easily verifiable metric to defeat replay attacks. It should be appreciated that the packet number may also be used to formulate an initialization vector (IV) as an input to a block cipher algorithm such as AES-GCM-128.

[0054] In an exemplary aspect, the group number represents the twenty-first least significant bit of a larger counter (e.g., 50 bits) to indicate how long the key can last before being refreshed. When the larger counter is about to overflow, the KN bit 512 can be toggled to indicate that the second bit will be used. The larger the counter, the less frequently the key is refreshed.

[0055] To prevent replay, a larger counter is incremented on both the root complex and the endpoint. It should be understood that if the counter is reset during a power cycle event, a replay attack can be enabled. Therefore, in an exemplary aspect, the counter is maintained during the power cycle. To this end, one side can store the last counter value in a secure non-volatile memory. Note that the device exchanging keys during session startup can restart the counter. Configuration registers can also be used to set the counter. As another option, each type of PCIE TLP (issued, unissued, completed) can have a separate counter.

[0056] Similarly, Figure 6 A secure read packet 600 is shown with a header 602, a TLP prefix 606, and an ICV 608. The TLP prefix 606 is prepended to the header 602, and the ICV 608 is appended after the header 602. Since this is a read command, there is no payload. The header 602 is never encrypted because the information in the header 602 is needed for routing purposes. The header 602 is well understood through the fields defined by the PCIE specification.

[0057] It should be understood that the header 602 may be signed (but still not encrypted) as outlined in AES-GCM-128. Such a signed header may be referred to as "Additional Authentication Data" (AAD).

[0058] The TLP prefix 606 includes a TLP identifier field 610 indicating that the TLP prefix 606 is a security prefix. In addition, the TLP prefix 606 includes a KN bit 612, a LI bit 614, a PE bit 616, and a packet number field 618. It should be understood that the TLP prefix is ​​defined according to an eight-bit portion. The TLP identifier field 610 is eight bits, and the KN bit 612, the LI bit 614, and the PE bit 616 are another three bits. The packet number field 618 can be twenty-one (21) bits to provide a TLP prefix 606 of appropriate size. The sub-parts of the TLP prefix 606 work as described above. The PE bit 616 indicates whether the returned payload should be encrypted.

[0059] It should be understood that Figure 5 Like TLP prefix 506, the bits and fields of TLP prefix 606 may be changed, renamed, or alternatively implemented without departing from the present disclosure.

[0060] Similarly, Figure 7 A security completion packet 700 is shown in response to a read command. The security completion packet 700 has a header 702, a payload 704 to be written to the endpoint, a TLP prefix 706, and an ICV 708. The TLP prefix 706 is prepended to the header 702, and the ICV 708 is appended after the payload 704. The header 702 is never encrypted because the information in the header 702 is needed for routing purposes. The header 702 is well understood through the fields defined by the PCIE specification.

[0061] It should be understood that the header 702 may be signed (but still not encrypted) as outlined in AES-GCM-128. Such a signed header may be referred to as "Additional Authentication Data" (AAD).

[0062] The TLP prefix 706 includes a TLP identifier field 710 indicating that the TLP prefix 706 is a security prefix. In addition, the TLP prefix 706 includes a KN bit 712, a LI bit 714, a PE bit 716, and a packet number field 718. It should be understood that the TLP prefix is ​​defined based on eight-bit portions. The TLP identifier field 710 is eight bits, and the KN bit 712, the LI bit 714, and the PE bit 716 are another three bits. The packet number field 718 can be twenty-one (21) bits to provide a TLP prefix 706 of appropriate size.

[0063] It should be understood that Figure 5 Like TLP prefix 506, the bits and fields of TLP prefix 706 may be changed, renamed, or alternatively implemented without departing from the present disclosure.

[0064] Figure 8 Shows where in the stack various aspects of security signaling occur. At this point, Figure 8 A system 800 with a transmitter 802 and a receiver 804 is shown. In the transmitter 802, at the transaction layer 806, a TLP header (e.g., 502, 602, 702) is generated together with a TLP prefix (e.g., 506, 606, 706) and the payload is optionally encrypted. Based on this, an ICV (e.g., 508, 608, 708) is calculated and attached. The combined packet is then passed to the data link layer 808 and the physical layer 810, where the packet is sent to the receiver 804 via a PCIE link 812. At the receiver 804, the packet passes through the physical layer 814 and the data link layer 816 before arriving at the transaction layer 818, where the payload is decrypted (including any padding), the ICV is verified and the TLP header is evaluated to output the payload to the appropriate address. As described above, in an end-to-end secure system, the intermediate switch 108 does not change the TLP packet and does not need to decrypt or verify the data. The PCIE port can send secure or unsecure TLP packets based on whether the secure TLP prefix is ​​prepended. It should be understood that the completion of the secure read request TLP with the secure TLP prefix must be returned.

[0065] It should be understood that the RC 110 that is generating the security request should know which key and counter should be used to protect the data. If only one endpoint 200 is secure, this determination is relatively simple. However, if multiple endpoints (e.g., 104(1)-104(N)) are using secure messaging, this determination is important. As described above, the keys and counters are end-to-end attributes and will be different between PCIE links for a single RC 110. Therefore, the RC 110 needs to be able to distinguish the destination endpoint. One solution is to use software that will sniff data within the RC 110 to determine the destination and alert the PHY to the destination. The second solution is to define PCIE capabilities, where the PCIE driver will build an address range and corresponding security attribute table.

[0066] Secure Memory Map:

[0067] Cardinality limit Safety encryption Key table index 5000 10000 Y Y 1 15000 1000 N N - 20000 10000 Y Y 1 30000 5000 Y N 2 40000 1000 Y Y 3 45000 1000 Y Y 1

[0068] Note that the dashed line in the second row may indicate an unsecure endpoint, or if the address is not in the table, the unsecure nature may be inferred.

[0069] Note that an endpoint can have multiple entries corresponding to different memory areas for the same endpoint (e.g., for different functions), but since the endpoint is the same, the same key will still be used.

[0070] When there is a Figure 1 Some additional precautions may be present when using switches such as the switch 108 of the RC108. Such switches should be trusted and authenticated. Likewise, the switch 108 should prevent traffic received on a secure link from being sent on an unsecure link. The key management entity should maintain secure key pairs throughout the entire PCIE topology. Secure PCIE links may be established sequentially, starting with the link closest to the RC 110 and then moving outward, to help ensure that the end-to-end link is secure (e.g., Figure 1 1, first link 112(N+1) and then link 114(1)). Note that switch 108 may have other vulnerabilities caused by internal vulnerabilities. For example, a packet from endpoint 106(1) to endpoint 106(M) may traverse internal conductors within switch 108. If the data is encrypted end-to-end, the data remains secure on the internal conductors. However, if security is link-based, the data may be unencrypted when it arrives at switch 108 and then re-encrypted when it leaves switch 108, leaving the data unprotected on the internal conductors. Alternatively, other security measures may be provided to protect the data in this situation.

[0071] The security technology for PCIE system according to various aspects disclosed herein can be set in or integrated into any processor-based device. Examples include, but are not limited to, set-top boxes, entertainment units, navigation devices, communication devices, fixed location data units, mobile location data units, global positioning system (GPS) devices, mobile phones, cellular phones, smart phones, session initiation protocol (SIP) phones, tablet computers, tablet phones, servers, computers, portable computers, mobile computing devices, wearable computing devices (e.g., smart watches, health or fitness trackers, glasses, etc.), desktop computers, personal digital assistants (PDAs), displays, computer displays, televisions, tuners, radios, satellite broadcasts, music players, digital music players, portable music players, digital video players, video players, digital video discs (DVD) players, portable digital video players, automobiles, vehicle components, avionics systems, drones, automobiles, vehicles, and multirotor aircraft.

[0072] At this point, Fig. 9 900 (such as a smartphone, a mobile computing device tablet, etc.). The mobile terminal 900 includes an application processor 904 (sometimes referred to as a host) that communicates with a mass storage element 906 via a universal flash memory (UFS) bus 908. The application processor 904 may also be connected to a display 910 via a display serial interface (DSI) bus 912 and to a camera 914 via a camera serial interface (CSI) bus 916. Various audio elements such as a microphone 918, a speaker 920, and an audio codec 922 may be coupled to the application processor 904 via a serial low-power chip-to-chip multimedia bus (SLIMbus) 924. In addition, the audio elements may communicate with each other via a SOUNDWIRE bus 926. A modem 928 may also be coupled to the SLIMbus 924 and / or the SOUNDWIRE bus 926. The modem 928 may also be connected to the application processor 904 via a PCIe bus 930 and / or a system power management interface (SPMI) bus 932. A PCIE bus, such as PCIE bus 930, may benefit from exemplary aspects of the present disclosure.

[0073] Continue to refer Fig. 9, the SPMI bus 932 may also be coupled to a wireless local area network (LAN or WLAN) IC (LAN IC or WLAN IC) 934, a power management integrated circuit (PMIC) 936, a companion IC (sometimes referred to as a bridge chip) 938, and a radio frequency IC (RFIC) 940. It should be understood that separate PCI buses 942 and 944 may also couple the application processor 904 to the companion IC 938 and the WLAN IC 934. The application processor 904 may also be connected to a sensor 946 via a sensor bus 948. The modem 928 and the RFIC 940 may communicate using a bus 950.

[0074] Continue to refer Fig. 9 , the RFIC 940 may be coupled to one or more RFFE elements, such as an antenna tuner 952, a switch 954, and a power amplifier 956, via a radio frequency front end (RFFE) bus 958. In addition, the RFIC 940 may be coupled to an envelope tracking power supply (ETPS) 960 via a bus 962, and the ETPS 960 may communicate with the power amplifier 956. The RFFE elements including the RFIC 940 may be collectively referred to as an RFFE system 964. It should be understood that the RFFE bus 958 may be formed by a clock line and a data line (not shown).

[0075] It should be understood that designers may have different priorities with respect to security. There are trade-offs when using link-based security versus end-to-end security. These differences are noted in the accompanying second appendix.

[0076] Those skilled in the art will further appreciate that the various illustrative logic blocks, modules, circuits and algorithms described in conjunction with the various aspects disclosed herein can be implemented as electronic hardware, stored in a memory or another computer-readable medium and executed by a processor or other processing device, or a combination of the two. As an example, the device described herein can be used in any circuit, hardware component, IC, or IC chip. The memory disclosed herein can be a memory of any type and size, and can be configured to store any type of information desired. In order to clearly illustrate this interchangeability, various illustrative components, blocks, modules, circuits and steps have been generally described in terms of function above. How to implement such a function depends on a specific application, design selection and / or the design constraints imposed on the entire system. The technician can implement the described function in different ways for each specific application, but such implementation decision should not be interpreted as causing a departure from the scope of the present disclosure.

[0077] The various illustrative logical blocks, modules, and circuits described in conjunction with the various aspects disclosed herein may be implemented or performed with a processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The processor may be a microprocessor, but in an alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration).

[0078] The various aspects disclosed herein may be implemented as hardware and instructions stored in hardware, and may reside in, for example, random access memory (RAM), flash memory, read-only memory (ROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disks, removable disks, CD-ROMs, or any other form of computer-readable media known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from and write information to the storage medium. In an alternative, the storage medium may be an integral part of the processor. The processor and storage medium may reside in an ASIC. The ASIC may reside in a remote station. In an alternative, the processor and storage medium may reside in a remote station, a base station, or a server as discrete components.

[0079] It should also be noted that the operational steps described in any exemplary aspects of this article are described to provide examples and discussions. The described operations can be performed in many different orders except for the order shown. In addition, the operations described in a single operational step can actually be performed in many different steps. In addition, one or more operational steps discussed in the exemplary aspects can be combined. It should be understood that the operational steps shown in the flow chart can be modified in many different ways, which is very clear to those skilled in the art. Those skilled in the art will also understand that information and signals can be represented using any of a variety of different technologies and techniques. For example, the data, instructions, commands, information, signals, bits, symbols and chips that can be referenced throughout the above description can be represented by voltage, current, electromagnetic waves, magnetic fields or particles, light fields or particles or any combination thereof.

[0080] The previous description of the disclosure is provided to enable those skilled in the art to make or use the present invention. Various modifications to the disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other variations. Therefore, the present invention is not intended to be limited to the examples and designs described herein, but is consistent with the widest range of principles and novel features disclosed herein.

Claims

1. A method for providing secure communication between devices on either end of a Peripheral Component Interconnect (PCI) Express (PCIE) link, comprising: Prepending a transport layer protocol TLP prefix to a TLP packet, wherein the TLP packet has a header different from the TLP prefix, and the TLP prefix includes an indication that the TLP packet is a security packet; appending to the TLP packet a cryptographically generated identifier computed at least in part on a portion of the TLP packet; as well as sending the TLP packet from a first device among the devices to another device among the devices through the PCIE link, wherein the TLP packet includes the TLP prefix and the encrypted generated identifier, and The payload in the TLP packet is encrypted.

2. The method according to claim 1, further comprising: The TLP grouping is formed.

3. The method of claim 2, wherein forming the TLP packet comprises: A write command is made in the TLP packet.

4. The method of claim 2, wherein forming the TLP packet comprises: A read command is made in the TLP packet.

5. The method according to claim 4, further comprising: A security completion packet is received in response to sending the TLP packet.

6. The method according to claim 5, further comprising: The payload in the security completion packet is decrypted.

7. The method of claim 1 , wherein prepending the TLP prefix to the TLP packet comprises: Prepended with a TLP prefix that includes the payload encryption bits.

8. The method of claim 1 , wherein appending the cryptographically generated identifier to the TLP packet comprises: An integrity check value (ICV) is appended to the TLP packet.

9. The method of claim 1, wherein prepending the TLP prefix to the TLP packet comprises: Prepended with a TLP prefix including the packet number.

10. The method of claim 1, wherein prepending the TLP prefix to the TLP packet comprises: Prepended with a TLP prefix including the key number bits.

11. A method for providing secure communications between devices on either end of a Peripheral Component Interconnect (PCI Express) (PCIE) link, comprising: Prepending a transport layer protocol TLP prefix to a TLP packet, wherein the TLP packet has a header different from the TLP prefix, and the TLP prefix includes an indication that the TLP packet is a security packet; Encrypting the payload of the TLP packet; as well as The TLP packet is sent from a first device among the devices to another device among the devices through the PCIE link, wherein the TLP packet includes the TLP prefix and a cryptographically generated identifier.

12. The method according to claim 11, further comprising: The TLP grouping is formed.

13. The method of claim 12, wherein forming the TLP packet comprises: A write command is made in the TLP packet.

14. The method of claim 12, wherein prepending the TLP prefix to the TLP packet comprises: Prepended with a TLP prefix that includes the payload encryption bits.

15. The method of claim 11, wherein prepending the TLP prefix to the TLP packet comprises: Prepended with a TLP prefix including the packet number.

16. A method for providing secure communications between devices on either end of a Peripheral Component Interconnect (PCI Express) (PCIE) link, comprising: Prepending a transport layer protocol TLP prefix to a TLP packet, wherein the TLP packet has a header different from the TLP prefix, and the TLP prefix includes an indication that the TLP packet is a secure packet and includes a counter value representing a monotonically increasing counter for detecting a replay attack; as well as sending the TLP packet from a first device among the devices to another device among the devices through the PCIE link, wherein the TLP packet includes the TLP prefix and a cryptographically generated identifier, and The payload in the TLP packet is encrypted.

17. The method according to claim 16, further comprising: The TLP grouping is formed.

18. The method of claim 17, wherein forming the TLP packet comprises: A write command is made in the TLP packet.

19. The method of claim 17, wherein forming the TLP packet comprises: A read command is made in the TLP packet.

20. The method of claim 16, wherein prepending the TLP prefix to the TLP packet comprises: Prepended with a TLP prefix that includes the payload encryption bits.

21. The method of claim 16, further comprising: A cryptographically generated identifier is appended to the TLP packet.

22. The method of claim 16, further comprising: Run different counters for different types of packets.

23. The method of claim 16, further comprising separate counters for read commands, write commands, and completion packets.

24. A peripheral component interconnect (PCI Express) system, comprising: Host equipment, including: Root Complex; Host encryption / decryption engine; and Host interface; A PCIE link coupled to the host interface; and Endpoint devices, including: An endpoint interface coupled to the PCIE link; and Endpoint encryption / decryption engine; The root complex is configured as follows: Prepending a transport layer protocol TLP prefix to a TLP packet, wherein the TLP packet has a header different from the TLP prefix, and the TLP prefix includes: An indication that the TLP packet is a security packet; and Counter value, representing a monotonically increasing counter used to detect replay attacks; Encrypting the payload of the TLP packet; appending to the TLP packet a cryptographically generated identifier computed at least in part on a portion of the TLP packet; and The TLP packet is sent from a first one of the host device and the endpoint device to the other one of the host device and the endpoint device through the PCIE link, wherein the TLP packet includes the TLP prefix and the cryptographically generated identifier.

25. The PCIE system according to claim 24, further comprising a switch located within the PCIE link.

26. The PCIE system of claim 25, wherein the host device is configured to provide end-to-end security, and the switch is configured to pass the TLP packet without modification.

27. The PCIE system of claim 25, wherein the switch is configured to decrypt the TLP packet and re-encrypt before sending the TLP packet to the endpoint device.

28. The PCIE system of claim 24, wherein the PCIE system is integrated into a device selected from the group consisting of: a set-top box; an entertainment unit; a navigation device; a communication device; a fixed location data unit; a mobile location data unit; a global positioning system (GPS) device; a mobile phone; a tablet computer; a tablet phone; a server; a computer; a wearable computing device; a personal digital assistant (PDA); a display; a television; a tuner; a radio; a satellite broadcast; a music player; a video player; an automobile; and an avionics system.

29. The PCIE system of claim 28, wherein the mobile phone comprises at least one of a cellular phone, a smart phone, and a Session Initiation Protocol (SIP) phone, the computer comprises at least one of a portable computer, a mobile computing device, and a desktop computer, the display comprises a computer display, the music player comprises at least one of a digital music player and a portable music player, the video player comprises at least one of a digital video player, a digital video disc (DVD) player, and a portable digital video player, the car comprises a vehicle assembly, and the avionics system comprises at least one of a drone and a multi-rotor aircraft.

Images