System and method for a secure I/O interface
View Patent ↗A security processor performs all or substantially all security and network processing to provide a secure I/O interface system to protect computing hardware from unauthorized access or attack. The security processor sends and receives all incoming and outgoing data packets for a host device and includes a packet engine, coupled to a local data bus, to process the incoming and outgoing packets. The processor further comprises a cryptographic core coupled to the packet engine to provide encryption and decryption processing for packets processed by the packet engine. The packet engine also handles classification processing for the incoming and outgoing packets. A modulo engine may be coupled to the local data bus.
1. A security processor to process incoming packets and outgoing packets, the security processor comprising:
a switching system to send the outgoing packets and receive the incoming packets;
a packet engine, coupled to the switching system, to handle classification processing for the incoming packets received by the packet engine from the switching system and the outgoing packets sent by the packet engine to the switching system, wherein the packet engine is one of a plurality of packet engines and substantially all of the incoming packets and outgoing packets to the security processor transit one of the plurality of packet engines, and wherein the incoming packets and outgoing packets are provided with a tag upon ingress to one of the plurality of packet engines and the tag determines an egress path within the security processor upon exit from a corresponding cryptographic core;
a cryptographic core, coupled to the packet engine and receiving the incoming packets from the switching system via the packet engine and communicating the outgoing packets to the switching system via the packet engine, to provide encryption and decryption processing for packets received from and sent to the packet engine, wherein the packet engine is interposed between the switching system and the cryptographic core;
a signature database; and
an intrusion detection system coupled between the cryptographic core and the packet engine and responsive to at least one packet matching a signature stored in the signature database.
2. The security processor of claim 1 wherein the packet engine is further operable to handle security context management processing for the incoming and outgoing packets.
3. The security processor of claim 1 further comprising:
a local data bus coupled to the switching system; and
a modulo engine coupled to the local data bus.
4. The security processor of claim 3 wherein the packet engine, the cryptographic core, and the modulo engine are formed on a single chip.
5. The security processor of claim 4 further comprising a control processor, coupled to the local data bus, for exception handling of the incoming and outgoing packets.
6. The security processor of claim 4 further comprising a key management engine coupled to the local data bus.
7. The security processor of claim 4 wherein the security processor handles substantially all security processing for the incoming and outgoing packets.
8. The security processor of claim 7 wherein the security processor further handles substantially all network processing for the incoming and outgoing packets.
9. The security processor of claim 1 wherein the cryptographic core is one of a plurality of cryptographic cores coupled one-to-one to the plurality of packet engines and substantially all of the incoming and outgoing packets to the security processor transit a corresponding one of the plurality of cryptographic cores after transiting one of the plurality of packet engines.
10. The security processor of claim 1 wherein the packet engine is further operable to add at least one of an IP header or a MAC address to the outgoing packets.
11. The security processor of claim 1 wherein the packet engine is further operable to remove an IP header from the incoming packets.
12. The security processor of claim 1 , wherein the at least one packet matching the signature stored in the signature database comprises a plain text packet.
13. A security processing system comprising:
(a) a security processor comprising:
a switching system to send outgoing packets and to receive incoming packets;
a packet engine, coupled to the switching system, to handle classification processing for the incoming packets received by the packet engine from the switching system and the outgoing packets sent by the packet engine to the switching system, wherein the packet engine is one of a plurality of packet engines and substantially all of the incoming packets and outgoing packets to the security processor transit one of the plurality of packet engines, and wherein the incoming and outgoing packets are provided with a tag upon ingress to one of the plurality of packet engines and the tag determines an egress path within the security processor upon exit from a corresponding cryptographic core;
a cryptographic core, coupled to the packet engine and receiving the incoming packets from the switching system via the packet engine and communicating the outgoing packets to the switching system via the packet engine, to provide encryption and decryption processing for packets received from and sent to the packet engine, wherein the packet engine is interposed between the switching system and the cryptographic core;
a signature database; and
an intrusion detection system coupled between the cryptographic core and the packet engine and responsive to at least one packet matching a signature stored in the signature database; and
a local data bus coupled to the switching system; and
(b) a memory coupled to the local data bus.
14. The security processing system of claim 13 further comprising a modulo engine coupled to the local data bus.
15. The security processing system of claim 14 further comprising a key management engine coupled to the local data bus.
16. The security processing system of claim 13 wherein the memory and the security processor are within the same cryptographic boundary.
17. The security processing system of claim 13 wherein the security processor is formed on a single chip.
18. The security processing system of claim 13 further comprising:
a memory interface coupled to the local data bus, wherein the memory is coupled to the local data bus using the memory interface; and
a translator coupled to the memory interface to perform translation of data received by the memory interface from the memory.
19. The security processing system of claim 18 wherein the translator performs steganographic translation of the received data.
20. The security processing system of claim 18 wherein the translator performs encryption translation of the received data.
21. The security processing system of claim 13 wherein the security processor is operable to (i) execute boot code to load firmware for execution by the security processor and (ii) authenticate the boot code using a mechanism internal to the security processor prior to operation of the security processor.
22. The security processing system of claim 13 , wherein the at least one packet matching the signature stored in the signature database comprises a plain text packet.