Security device with programmable systolic-matrix cryptographic module and programmable input/output interface
A system includes programmable systolic cryptographic modules for security processing of packets from a data source. A first programmable input/output interface routes each incoming packet to one of the systolic cryptographic modules for encryption processing. A second programmable input/output interface routes the encrypted packets from the one systolic cryptographic module to a common data storage. In one embodiment, the first programmable input/output interface is coupled to an interchangeable physical interface that receives the incoming packets from the data source. In another embodiment, each cryptographic module includes a programmable systolic packet input engine, a programmable cryptographic engine, and a programmable systolic packet output engine, each configured as a systolic array (e.g., using FPGAs) for data processing.
1 . A system comprising:
a plurality of cryptographic modules each configured to process packets and indicate when ready to process new packets by flagging a corresponding readiness indicator, wherein:
the packet processing includes encrypting a packet based on a security key associated with the packet;
a first interface coupled to the plurality of cryptographic modules and configured to receive an incoming packet, associate a first security key with the incoming packet, select a ready one of the plurality of cryptographic modules based on the corresponding readiness indicator, and route the incoming packet to the selected cryptographic module; and
a second interface coupling the plurality of cryptographic modules to a data storage.
2 . The system of claim 1 , wherein each of the plurality of cryptographic modules comprises at least one systolic-matrix array.
3 . The system of claim 1 , wherein the readiness indicator corresponds to a semaphore flag.
4 . The system of claim 3 , wherein the first interface selects the ready one of the plurality of cryptographic modules based on the semaphore flag.
5 . The system of claim 1 , wherein the readiness indicator corresponds to one or more packet header bits.
6 . The system of claim 5 , wherein the first interface selects the ready one of the plurality of cryptographic modules based on the one or more packet header bits.
7 . The system of claim 1 , wherein the first interface is further configured to:
receive the incoming packet on a port;
receive an outgoing packet from the selected cryptographic module corresponding to the incoming packet; and
route the outgoing packet to the port.
8 . The system of claim 7 , wherein the incoming packet is tagged to identify the port.
9 . The system of claim 7 , wherein the outgoing packet is tagged to identify the port.
10 . A system comprising:
a plurality of cryptographic modules each configured to process packets, wherein the packet processing includes encrypting a packet based on a security key associated with the packet, and wherein each cryptographic module is configured to execute a secure boot for verifying at least one systolic-matrix array of the cryptographic module; and
a first interface coupled to the plurality of cryptographic modules and configured to receive an incoming packet, associate a first security key with the incoming packet, select one of the plurality of cryptographic modules, and route the incoming packet to the selected cryptographic module.
11 . The system of claim 10 , wherein the secure boot is executed for verifying FPGA code for the at least one systolic-matrix array of the cryptographic module.
12 . The system of claim 11 , wherein the secure boot includes programming an FPGA of the cryptographic module with the verified FPGA code.
13 . The system of claim 10 , wherein each cryptographic module comprises a memory, coupled to the systolic-matrix array, for storing data generated during the packet processing.
14 . The system of claim 10 , wherein in response to detecting an anomaly during the secure boot, an alert is provided to a user.
15 . The system of claim 10 , wherein the secure boot is executed for verifying software or a processor of the cryptographic module.
16 . The system of claim 10 , further comprising a key manager coupled to the first interface.
17 . A method comprising:
flagging, by a ready cryptographic module of a plurality of cryptographic modules, a readiness indicator to indicate the ready cryptographic module is ready to process new packets;
receiving, by a first interface coupled to the plurality of cryptographic modules, an incoming packet;
selecting, by the first interface and based on the corresponding readiness indicator, the ready cryptographic module for processing the incoming packet;
routing, by the first interface, the incoming packet to the ready cryptographic module;
processing, by the ready cryptographic module, the incoming packet into a processed packet;
sending, by a second interface coupling the plurality of cryptographic modules to a data storage, the processed packet for storage.
18 . The method of claim 17 , wherein the readiness indicator corresponds to a semaphore flag or one or more packet header bits.
19 . The method of claim 17 , further comprising:
receiving, by the second interface from the data storage, the processed packet;
processing, by at least one of the plurality of cryptographic modules, the processed packet into an outgoing packet; and
sending, by the first interface, the outgoing packet.
20 . The method of claim 19 , wherein receiving the incoming packet and sending the outgoing packet uses a same port.