PCIe Switch Partitioning for Pre-Host Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing PCIe devices lack robust authentication mechanisms, particularly in systems that do not support the Security Protocol and Data Model (SPDM) specification, leading to potential impersonation and malfunction risks.
Innovation Solution
A PCIe switch system that authenticates devices using a control circuit to operate downstream ports in authentication mode, isolating them until validated, and then routes authenticated devices to upstream hosts, utilizing separate partitions and protocols like PCIe, TWI, or SMBus.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PCIe devices are connected directly to hosts without authentication, then device connectivity and system simplicity are improved, but security and reliability deteriorate due to impersonation and malfunction risks
Solution Approach 1:
The patent introduces a PCIe switch as an intermediary device between PCIe endpoint devices and hosts. The switch includes an embedded authentication mechanism that validates devices before allowing connection to hosts. This intermediary approach enables authentication without requiring modification of endpoint devices or host systems, thereby improving security while maintaining system simplicity.
Solution Approach 2:
The PCIe switch architecture segments the connection path into distinct stages: authentication stage (through internal partition) and data transmission stage (through first/second partitions). This segmentation allows authentication to occur in isolation before devices are routed to hosts, separating security validation from normal operation and reducing overall system complexity.
2Reliability
If authentication mode is implemented for all downstream ports, then device security is improved, but connection speed and system productivity deteriorate due to authentication overhead
Solution Approach 1:
The authentication process is performed as a preliminary action during device attachment, before the device is routed to any host. The PCIe switch's control circuit automatically executes authentication when a device is detected on a downstream port, and only after successful authentication does the device get connected to hosts. This preliminary authentication approach ensures security without impacting subsequent data transmission speed.
3Adaptability or versatility
If multiple PCIe devices share a single root port through a PCIe switch, then resource sharing and adaptability are improved, but security control and reliability worsen due to lack of individual device authentication
Solution Approach 1:
The patent implements local quality by providing individual authentication control for each downstream port of the PCIe switch. Each port can independently authenticate devices and control their access to hosts, allowing different security policies to be applied to different devices. This per-port authentication mechanism maintains security control even when multiple devices share the same root port through the switch.
Data Source
AI summary
A method including attaching a plurality of hosts to separate partitions in a PCIe switch, at reset, routing all downstream ports of the PCIe switch internally to an internal partition of the PCIe switch, detecting, with an embedded CPU, all PCIe devices connected to the internal partition, and authenticating the devices with a control circuit. Upon authentication, connecting the PCIe devices to hosts connected to upstream ports of the PCIe switch via separate partitions.