CXL Link Security via Preliminary Authentication and Partial MACs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current interconnect architectures, such as PCIe and CXL, face challenges in providing secure and efficient communication across computing systems, particularly in ensuring confidentiality, integrity, and replay protection for data transmitted over CXL links, which are critical for preventing adversaries from modifying or intercepting data.
Innovation Solution
Implementing cryptographic techniques, including encryption and integrity protection using Advanced Encryption Standard (AES)-based protocols like AES-GCM and AES-CTR, along with message authentication codes (MACs), to secure flits transmitted over CXL links, ensuring that only protected flits are processed and integrity checks are performed to maintain data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic techniques (encryption, integrity protection, MACs) are implemented to secure communications over CXL links, then data security (confidentiality, integrity, replay protection) is improved, but bandwidth overhead and latency increase
Solution Approach 1:
Security credentials and cryptographic parameters are established and configured before communication begins. The system performs preliminary authentication and key exchange during link initialization, so that subsequent data transmissions can proceed with minimal security-related overhead. This allows security to be built-in rather than added in real-time, reducing latency.
Solution Approach 2:
The patent employs configurable security parameters including different MAC generation frequencies (e.g., every N transactions), variable credential lengths, and selectable cryptographic algorithms. These parameters can be adjusted based on security requirements and performance needs, allowing optimization of the balance between security strength and bandwidth/latency overhead.
2Reliability
If security credentials are transmitted and verified for each transaction, then authentication reliability is improved, but processing complexity and time overhead increase
Solution Approach 1:
Authentication credentials are established during link initialization before actual data transactions begin. The system performs preliminary credential verification and establishes trusted relationships upfront, reducing the complexity of per-transaction authentication while maintaining security. Subsequent transactions can rely on pre-established credentials with minimal additional verification overhead.
Solution Approach 2:
The patent implements MAC verification at configurable frequencies rather than for every single transaction. MACs can be generated and verified for every N transactions or at selected intervals, providing adequate security while significantly reducing processing complexity and time overhead compared to verifying every transaction.
3Reliability
If comprehensive integrity protection is applied to all data transmissions, then data integrity is improved, but bandwidth consumption increases due to additional authentication data
Solution Approach 1:
The patent applies integrity protection selectively rather than uniformly to all transactions. MACs can be generated for every N transactions or only for transactions containing sensitive data, rather than for every byte transmitted. This partial application of integrity protection maintains security for critical data while significantly reducing bandwidth consumption compared to comprehensive protection of all transmissions.
Solution Approach 2:
The system allows configuration of MAC length and generation frequency as adjustable parameters. By optimizing these parameters based on security requirements and available bandwidth, the system can achieve adequate integrity protection with minimal bandwidth overhead. Variable parameter adjustment enables dynamic optimization of the trade-off between integrity protection strength and bandwidth consumption.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
An apparatus includes a port with circuitry to implement one or more layers of a Compute Express Link (CXL)-based protocol. The port includes an agent to obtain information to be transmitted to another device over a link based on the CXL-based protocol via a flit, encrypt at least a portion of the information to yield a ciphertext, generate a cyclic redundancy check (CRC) code based on the ciphertext, and cause a flit to be generated comprising the ciphertext. The port is to use the circuitry to transmit the flit and the CRC code to the other device over the link.