Snooping Invalidation Module for Manycore Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manycore processors face challenges in ensuring secure execution due to potentially untrusted hardware and software components, particularly with third-party NoC designs that can introduce hardware trojans, making it difficult to detect and mitigate data-snooping attacks that compromise data integrity and security.
Innovation Solution
Implementing a snooping invalidation module at the network interface to discard duplicate packets and a snooping detection circuit to identify the source of attacks, providing a comprehensive protection framework that mitigates future attacks and safeguards application data, even when hardware trojans are reverse-engineered or tampered with.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If third-party NoC designs are used to reduce hardware design time, then device complexity is reduced, but security reliability deteriorates due to potential hardware trojans
Solution Approach 1:
The patent implements preliminary security validation by attaching unique identifiers and cryptographic signatures to packets at the source before transmission through the NoC. This preliminary action enables detection of hardware trojans that duplicate or modify packets, as the security attributes will not match the original packet's signature, thus preventing security breaches before they can compromise the system
2Reliability
If hardware trojan detection mechanisms are implemented, then security reliability is improved, but device complexity and area overhead increase
Solution Approach 1:
The patent uses cryptographic copying by creating a digital signature (copy) of the packet's security attributes and attaching it to the packet. This copied signature can be verified without duplicating the entire packet or adding complex detection hardware, as the verification process only requires comparing the signature against the original packet's attributes using lightweight cryptographic operations
3Reliability
If comprehensive security validation is performed on all packets, then security reliability is improved, but processing time and energy consumption increase
Solution Approach 1:
The patent extracts only the essential security attributes (unique identifier, destination address, cryptographic signature) from the full packet and performs validation only on these extracted elements. This selective extraction approach allows security verification to be performed with minimal processing overhead, as the validation logic only needs to check a small subset of packet fields rather than analyzing the entire packet content
Data Source
AI summary
A snooping invalidation module is implemented at the network interface for a given core, or processing element, of a multicore or manycore device, e.g., NoC device, to discard packets with invalid header flits (e.g., duplicate packets) from being injected into the device, e.g., by a malicious hardware trojan implemented in the network interface. In some embodiments, a data-snooping detection circuit is implemented to detect a source of an on-going attack.