Programmable micro-core processors for security processing
View Patent ↗A security processing system includes one or more micro-cores that can operate in conjunction with one or more security cores to process packets. The micro-core can perform any suitably programmed tasks upon packets, such as encryption/decryption and authentication tasks. The combination of having both the hard-coded security engines and the programmable micro-core within the same system permits the security system to effectively obtain the benefit of the speed and performance advantages of having dedicated security hardware, in addition to the flexibility and expandability of being able to use a programmable micro-core.
1. A system for performing security processing, comprising:
a first security circuit that is hardcoded with a first set of security functionality to address a first specific security protocol, and that has an input and an output;
a second security circuit that is hardcoded with a second set of security functionality to address a second specific security protocol, and that has an input and an output;
a micro-core that is programmable to implement a third set of security functionality, and that has an input and an output;
a first multiplexer having a first input coupled to the output of the micro-core, and an output coupled to the input of the first security circuit;
a memory having an output coupled to a second input of the first multiplexer and to the input of the micro-core;
a second multiplexer having a first input coupled to the output of the first security circuit, a second input coupled to the output of the first multiplexer, a third input coupled to the output of the micro-core, and an output coupled to the input of the micro-core;
a third multiplexer having a first input coupled to the output of the first multiplexer, a second input coupled to the output of the second multiplexer, a third input coupled to the output of the micro-core, and an output coupled to the input of the second security circuit;
wherein the micro-core is configured to execute program code with deterministic latency.
2. The system of claim 1 in which the third set of security functionality comprises encryption, decryption, or authentication functions.
3. The system of claim 2 in which the micro-core is programmable to generate a key for the encryption, the decryption, or the authentication functions.
4. The system of claim 1 in which the micro-core is programmable to operate in conjunction with the first security circuit.
5. The system of claim 1 in which the micro-core is programmable to operate as a replacement for the first security circuit.
6. The system of claim 1 further comprising a multi-core processor, in which a core of the multi-core processor is configured to offload the first or third set of security functionality to the first security circuit or the micro-core, respectively.
7. The system of claim 1 further comprising a multi-core processor, in which a core of the multi-core processor is configured to offload the first and third set of security functionality to the security circuit or micro-core.
8. The system of claim 1 in which the system comprises a networking system.
9. The system of claim 1 in which the micro-core comprises a register to hold segmented data for the micro-core.
10. The system of claim 9 in which the segmented data is a unit of processing for the micro-core.
11. The system of claim 1 in which the memory comprises an instruction cache configured to hold instructions for the micro-core.
12. A method for performing security processing, comprising:
in an integrated circuit including a first security circuit having an input and an output, a second security circuit having an input and an output, a micro-core having an input and an output, a memory having an output, and a plurality of signal source selecting circuits, each signal source selecting circuit configured to receive a plurality of input signals and to provide a selected one of the plurality of input signals as an output signal;
receiving instructions, at the micro-core, to perform security processing;
configuring a first signal selector circuit of the plurality of signal selector circuits to provide a signal pathway between a selected one of the memory output and the micro-core output, and the input of the first security circuit; p 1 configuring a second signal selector circuit of the plurality of signal selector circuits to provide a signal pathway between a selected one of the first security circuit output and the micro-core output, and the input of the micro-core; and
configuring a third signal selector circuit of the plurality of signal selector circuits to provide a signal pathway between a selected one of micro-core output and an output of the second signal selector circuit;
wherein the first security circuit is hardcoded to perform a first set of security functionality to address a first specific security protocol; the local resources store at least program instructions for the micro-core, and the micro-core is programmable to perform a second set of security functionality, and performing the security processing by the micro-core is deterministic.
13. The method of claim 12 in which the micro-core performs encryption, decryption, or authentication functions.
14. The method of claim 13 in which the micro-core generates a key for the encryption, the decryption, or the authentication functions.
15. The method of claim 12 in which the micro-core is programmable to operate in conjunction with the first security circuit.
16. The method of claim 12 in which the micro-core is programmable to operate as a replacement for the first security circuit.
17. The method of claim 12 in which a core of a multi-core processor is configured to offload the first or second set of security functionality to the first security circuit or the micro-core.
18. The method of claim 12 in which a core of a multi-core processor is configured to offload the first and second set of security functionality to the first security circuit or the micro-core.
19. The method of claim 12 in which the micro-core operates on segmented data in a register.
20. The method of claim 19 in which the segmented data is a unit of processing for the micro-core.