PCIe Stream Routing for Encrypted IDE TLP Headers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The PCIe architecture's distributed decode architecture for TLP routing exposes routing information in the clear, making it vulnerable to side-channel attacks and fragile due to misconfigurations, especially when Advanced Encryption Standard-Galois Counter Mode (AES-GCM) authenticated encryption is used for pairwise relationships between sources and destinations.
Innovation Solution
Implement a Stream Routing mechanism based on the Stream ID field within TLPs, prioritizing encryption of TLP header components, including addresses, to enhance security and robustness, while allowing legacy routing for non-Stream-associated TLPs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If distributed decode architecture is used for TLP routing, then routing flexibility and device independence are improved, but security against side-channel attacks deteriorates due to routing information being exposed in the clear
Solution Approach 1:
The patent segments the TLP into multiple parts with different encryption treatments. The TLP header containing routing information is encrypted separately from the payload, allowing routing functionality to be maintained while protecting sensitive routing information from side-channel attacks. This segmentation enables selective encryption of only the critical routing fields.
Solution Approach 2:
The patent applies different quality properties to different parts of the TLP structure. Specifically, routing information in the TLP header is encrypted to protect it from attacks, while other parts of the packet maintain their original properties. This local differentiation allows security to be enhanced in critical areas without compromising overall system functionality.
2Reliability
If AES-GCM authenticated encryption is implemented for pairwise relationships, then security between sources and destinations is improved, but system complexity increases due to configuration and management overhead
Solution Approach 1:
The patent extracts the security management complexity from the core routing functionality. By separating the encryption/decryption operations into dedicated security modules and using pre-configured security contexts, the complex AES-GCM operations are isolated from the main routing logic, reducing the perceived complexity in system configuration and management.
Solution Approach 2:
The patent implements preliminary configuration of security contexts and encryption keys before actual TLP routing occurs. Security parameters, including AES-GCM keys and authentication data structures, are pre-established in the security contexts, allowing rapid secure operations during runtime without adding operational complexity during packet processing.
3Object-affected harmful factors
If TLP header components including addresses are encrypted, then security against side-channel attacks is improved, but routing capability deteriorates due to loss of readable routing information
Solution Approach 1:
The patent segments the TLP header into encrypted and unencrypted portions. Critical routing information that must remain readable for switch forwarding is kept unencrypted, while sensitive address and control information is encrypted. This segmentation allows both security protection and routing functionality to coexist by applying different encryption treatments to different header fields.
Solution Approach 2:
The patent introduces security contexts as intermediary structures that hold encryption keys and parameters. These contexts act as mediators between the encrypted TLP header and the routing logic, allowing secure decryption and interpretation of routing information without exposing it in the clear during transmission.
4Reliability
If Stream Routing mechanism is implemented, then security and robustness are improved, but device complexity increases due to additional routing infrastructure
Solution Approach 1:
The patent designs the Stream ID field and security context structures to serve multiple functions simultaneously. The Stream ID field is used both for identifying encrypted streams and for routing decisions, while security contexts handle both encryption operations and routing information storage. This multi-functionality reduces the need for separate dedicated infrastructure components.
Solution Approach 2:
The patent merges the Stream Routing functionality with the existing AES-GCM security framework. By combining stream identification, encryption context management, and routing logic into an integrated security context structure, the patent reduces overall device complexity compared to implementing separate Stream Routing and security systems.
Data Source
AI summary
Embodiments described herein may be directed to apparatus, systems, techniques, or processes for a routing mechanism based on the Stream ID field, already present in IDE TLPs, applicable to switches, root complexes (RC) and multifunction devices. This in turn allows additional header content for IDE TLPs to be encrypted instead of being sent in the clear (not encrypted). Additionally, Stream routing may be used for non-IDE TLPs as well by allowing the inclusion and application of the Stream mechanism to non-IDE TLPs. Other embodiments may be described and/or claimed.