Cryptographic Engine for DMA I/O Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing devices face challenges in securing Input/Output (I/O) data, particularly for DMA capable I/O controllers, as they lack comprehensive protection mechanisms for confidentiality, integrity, and authenticity, especially when dealing with multiple connected devices and dynamic switching between secure and non-secure modes.
Innovation Solution
A computing device equipped with a cryptographic engine that performs on-the-fly encryption and decryption of I/O data using channel identifiers (CIDs) to identify secure transactions, allowing for hardware-based protection and minimizing impact on existing controllers, while supporting high bandwidth and scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software agents are used for security, then security protection is provided, but it is difficult to keep up with increasing malware attacks
Solution Approach 1:
The patent replaces software-based security agents with a hardware-based cryptographic engine that performs encryption/decryption operations in dedicated security circuitry. This hardware implementation provides more reliable security protection that cannot be easily compromised by malware, while maintaining high performance through parallel cryptographic operations.
Solution Approach 2:
The cryptographic engine acts as an intermediary between I/O controllers and memory, intercepting DMA transactions and performing cryptographic operations. This intermediary approach allows security to be inserted into the data path without requiring changes to existing I/O controllers or applications, providing protection while maintaining system productivity.
2Reliability
If TEE is used to protect secrets, then secrets within TEE are protected, but I/O data communicated into and/or out of the secure container is not protected
Solution Approach 1:
The patent segments the security protection into two layers: the TEE protects secrets within the secure container, while the cryptographic engine protects I/O data in transit. This segmentation allows each component to focus on its specific security function, with the cryptographic engine handling encryption/decryption of DMA transactions to and from the TEE without requiring the entire system to be within the secure boundary.
Solution Approach 2:
The cryptographic engine serves as an intermediary that bridges the secure TEE environment and the untrusted external world. It performs cryptographic operations on I/O data before it enters or leaves the TEE, ensuring that data protection is extended beyond the container boundaries while the TEE continues to protect internal secrets.
3Reliability
If multiple I/O devices are secured for a given usage, then security is provided for all devices, but device complexity increases
Solution Approach 1:
The cryptographic engine provides a universal security service that can protect multiple different types of I/O devices through a single unified interface. Rather than implementing separate security mechanisms for each device type (keyboard, USB device, Bluetooth device, touch screen), the cryptographic engine handles cryptographic operations for all devices centrally, reducing overall system complexity.
Solution Approach 2:
The patent merges the cryptographic functionality into a single dedicated engine that consolidates security operations for all I/O devices. This combines what would otherwise be distributed security logic across multiple devices into one centralized component, making the system easier to manage and maintain while providing comprehensive security.
4Adaptability or versatility
If I/O devices switch dynamically between secure and non-secure modes, then flexibility is provided, but security management complexity increases
Solution Approach 1:
The cryptographic engine automatically determines whether to encrypt or decrypt each DMA transaction based on the channel identifier, without requiring manual configuration or complex security management logic. The engine self-manages the switching between secure and non-secure modes by examining the CID and making decisions autonomously, reducing the burden on system software.
Solution Approach 2:
The system implements dynamic security where the cryptographic engine can change its behavior on-the-fly based on the specific transaction being processed. Each DMA transaction is independently evaluated and handled according to its security requirements, allowing flexible adaptation to different security contexts without requiring static pre-configuration for all possible scenarios.
5Reliability
If hardware-based cryptographic protection is implemented, then security is improved, but impact on existing controllers must be minimized
Solution Approach 1:
The cryptographic engine is positioned as an intermediary in the DMA data path between I/O controllers and memory. It intercepts transactions using standard bus interfaces without requiring modifications to existing I/O controller hardware or firmware. This intermediary approach allows hardware-based cryptographic protection to be added while maintaining compatibility with legacy controllers.
Solution Approach 2:
The cryptographic functionality is extracted from the I/O controllers themselves and placed in a separate dedicated cryptographic engine. This extraction allows the cryptographic protection to be implemented independently without modifying existing controller designs, simplifying integration into systems with various legacy controllers while still providing the desired security enhancements.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Technologies for cryptographic protection of I/O data include a computing device with one or more I/O controllers. Each I/O controller may be coupled to one or more I/O devices. Each I/O controller may generate a direct memory access (DMA) transaction that includes a channel identifier that is indicative of the I/O controller and that is indicative of an I/O device coupled to the I/O controller. The computing device intercepts the DMA transaction and determines whether to protect the DMA transaction as a function of the channel identifier. If so, the computing device performs a cryptographic operation using an encryption key associated with the channel identifier. The computing device may include a cryptographic engine that intercepts the DMA transaction and determines whether to protect the DMA transaction by determining whether the channel identifier matches an entry in a channel identifier table of the cryptographic engine. Other embodiments are described and claimed.