PCIe Secure Stream Encryption for TLP Integrity Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing interconnect architectures in computing systems face challenges in ensuring data integrity and security, particularly in high-performance environments like PCI Express (PCIe) where data confidentiality, integrity, and replay protection are critical but often compromised by physical attacks and malicious devices.
Innovation Solution
Implementing a secure stream protocol that establishes confidentiality, integrity, and replay protection for Transaction Layer Packets (TLPs) through cryptographic mechanisms, such as AES-CTR 256b and GMAC 96b, to secure data transmission across PCIe links, using hop-by-hop or end-to-end encryption methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional multi-drop buses are used for communication, then device compatibility and ease of operation are improved, but data security and integrity are compromised due to physical attacks and malicious devices
Solution Approach 1:
The patent introduces an intermediary encryption layer between devices on the bus. Data packets are encrypted at the source device and decrypted only at the destination device, with intermediate devices unable to access or read the data. This mediator encryption mechanism maintains bus compatibility while securing data transmission against physical attacks and malicious interception.
2Reliability
If encryption mechanisms are added to secure data transmission, then data confidentiality and integrity are improved, but device complexity and processing overhead increase
Solution Approach 1:
The patent segments the encryption functionality into separate encryption and decryption modules located at the source and destination devices respectively. This segmentation allows each device to only perform its specific cryptographic function rather than implementing full encryption/decryption capabilities, reducing overall system complexity while maintaining security.
Solution Approach 2:
The patent implements preliminary action by pre-establishing encryption keys and security parameters between communicating devices before actual data transmission. This preliminary setup phase separates the complex key management and encryption configuration from the actual data transfer operation, simplifying the real-time transmission process.
3Reliability
If encryption and integrity checking are performed on all data packets, then data integrity and security are improved, but transmission speed and productivity decrease
Solution Approach 1:
The patent applies local quality by implementing selective encryption and integrity checking based on the specific security requirements of different data packets and communication channels. Not all packets require the same level of security processing - critical data receives full encryption and integrity verification, while less sensitive data uses simplified protection mechanisms, optimizing the balance between security and speed.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A system may include a root port and an endpoint upstream port. The root port may include transaction layer hardware circuitry to determine, by logic circuitry at a transaction layer of a protocol stack of a device, that a packet is to traverse to a link partner on a secure stream, authenticate a receiving port of the link partner, configure a transaction layer packet (TLP) prefix to identify the TLP as a secure TLP, associating the secure TLP with the secure stream, apply integrity protection and data encryption to the Secure TLP, transmit the secure TLP across the secure stream to the link partner.