NoC Data Protection Device Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network-on-Chip (NoC) systems face challenges in ensuring secure communication and data protection due to increased complexity and integration, with existing solutions like cryptographic key exchange and firewalls being insufficient against power and electromagnetic attacks.
Innovation Solution
A data protection device for NoC systems, comprising an access control unit with memory for storing access rules and a security address decoder, which encodes packet headers and controls access based on source and destination addresses, ensuring secure routing and programming access through a re-programmable secure programming manager system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic key exchange is used for security in NoC, then protection from power and electromagnetic attacks is improved, but device complexity increases
Solution Approach 1:
The security function is segmented into separate modules: access control unit, security address decoder, and firewall. Each module handles specific security tasks independently, allowing cryptographic operations to be isolated and managed separately from the main NoC routing logic, thus reducing overall system complexity while maintaining security.
Solution Approach 2:
The patent introduces an access control unit as an intermediary component between transaction sources and the NoC. This unit intercepts and validates access requests before they enter the network, providing security filtering without requiring cryptographic key exchange throughout the entire system, thereby reducing complexity.
2Measurement precision
If access control rules are stored in memory for each destination address, then security precision is improved, but memory requirements and device complexity increase
Solution Approach 1:
The patent implements local quality by associating specific access control rules with particular destination addresses or address ranges. The security address decoder identifies relevant rules based on the target address, applying precise control only where needed rather than requiring comprehensive memory storage for all possible addresses, thus reducing overall memory requirements.
Solution Approach 2:
The system changes parameters by organizing access rules into groups based on destination address patterns and transaction source types. This parametric organization allows the access control unit to efficiently retrieve applicable rules without storing exhaustive permission sets for every possible address combination, reducing memory complexity while maintaining precision.
3Reliability
If firewall is used to protect system integrity, then security is improved, but communication speed and productivity decrease
Solution Approach 1:
The access control unit performs security validation in advance, before packets are routed through the NoC. By pre-evaluating access requests against stored rules and making accept/reject decisions upfront, the system ensures security without requiring continuous firewall inspection of every packet during transmission, thus maintaining communication speed.
Solution Approach 2:
The patent extracts the security filtering function from the main communication path by implementing it in the access control unit at the network interface. This separation allows the firewall-like access control to operate independently on incoming requests, while approved packets flow through the NoC without additional security checks, preserving communication productivity.
Data Source
AI summary
A data protection device for an interconnect network on chip (NoC) includes a header encoder that receives input requests for generating network packets. The encoder routes the input requests to a destination address. An access control unit controls and allows access to the destination address. The access control unit uses a memory to store access rules for controlling access to the network as a function of the destination address and of a source of the input request.