SoC Crypto Packet Channel ID Key Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face challenges in securely communicating encrypted data between subsystems on a chip (SoCs) due to vulnerabilities to direct memory access (DMA) attacks, which can breach cross-subsystem data secrecy and compromise data integrity.
Innovation Solution
The implementation of systems on a chip (SoCs) that use a unique channel ID field in the encryption header of crypto packets to select and apply different secret keys for encryption and decryption, ensuring secure communication by thwarting DMA attacks through cryptographic signatures and strict traffic flow constraints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single secret key is used for encryption across all channels in an SoC, then hardware overhead is reduced and performance is improved, but cross-subsystem data secrecy is compromised due to vulnerability to DMA attacks
Solution Approach 1:
The patent segments the encryption key space by introducing channel-specific secret keys (one key per communication channel between subsystems). This segmentation isolates compromise to individual channels, preventing a single DMA attack from affecting all cross-subsystem communications. Each channel maintains its own cryptographic identity, ensuring that even if one channel is attacked, other channels remain secure.
Solution Approach 2:
The patent applies local quality by making encryption properties channel-specific rather than uniform across the entire SoC. Each communication channel between subsystems has its own unique secret key and security parameters, allowing security to be tailored to the specific requirements and risk profiles of individual channels while maintaining overall system security.
2Reliability
If multiple secret keys are used for different channels to prevent DMA attacks, then cross-subsystem data secrecy is improved, but hardware overhead and system complexity increase
Solution Approach 1:
The patent implements a universal key management architecture that handles multiple channel-specific keys through a single standardized interface and protocol. The security subsystem maintains a key registry that maps channel identifiers to their corresponding secret keys, allowing the system to manage multiple keys efficiently without requiring separate management mechanisms for each channel. This universal approach reduces the operational complexity despite having multiple keys.
Solution Approach 2:
The patent introduces an intermediary key management layer that sits between the multiple channel-specific keys and the encryption/decryption operations. This intermediary layer handles key selection, validation, and rotation transparently, shielding the rest of the system from the complexity of managing multiple keys. The intermediary translates high-level channel identifiers into the appropriate cryptographic keys without exposing the underlying key management complexity.
3Reliability
If channel-specific encryption is implemented, then resistance to DMA attacks is improved, but processing time and performance may be diminished
Solution Approach 1:
The patent performs preliminary action by pre-establishing and caching the mapping between channel identifiers and secret keys before encryption operations begin. The key selection and validation processes are completed in advance, allowing the actual encryption/decryption operations to proceed without repeated key management overhead. This preliminary setup reduces the per-packet processing time while maintaining channel-specific security.
Solution Approach 2:
The patent implements self-service mechanisms where the security subsystem automatically selects and manages the appropriate keys based on channel identifiers without requiring external intervention or complex decision-making processes. The system serves itself by maintaining local key caches and making autonomous key selection decisions, minimizing the processing overhead associated with key management while ensuring the correct key is used for each channel.
Data Source
AI summary
This disclosure describes system on a chip (SOC) communications that prevent direct memory access (DMA) attacks. An example SoC includes an encryption engine and a security processor. The encryption engine is configured to encrypt raw input data using a cipher key to form an encrypted payload. The security processor is configured to select the cipher key from a key store holding a plurality of cipher keys based on a channel ID describing a {source subsystem, destination subsystem} tuple for the encrypted payload, to form an encryption header that includes the channel ID, to encapsulate the encrypted payload with the encryption header that includes the channel ID to form a crypto packet, and to transmit the crypto packet to a destination SoC that is external to the SoC.