Integrated circuit for cyber security processing
View Patent ↗In one aspect, an integrated circuit (IC) includes a secure router configured as a trust anchor, a non-volatile random access memory (RAM) direct memory access (DMA) channel coupled to the secure router, a first DMA coupled to the secure router and configured to receive data with a first classification and a second DMA coupled to the secure router and configured to receive data with a second classification. The IC also includes a secure boot/key controller coupled to the secure router and configured as a trust anchor to boot the IC securely and a processor coupled to the secure router and configured to encrypt data, to store protocols, to store instructions to detect malicious intrusions on the IC and to provide key management.
1. An integrated circuit (IC) comprising:
a secure router configured as a trust anchor configured to perform a function that is trusted;
a non-volatile random access memory (RAM) direct memory access (DMA) channel coupled to the secure router;
a first DMA coupled to the secure router and configured to receive data with a first classification;
a second DMA coupled to the secure router and configured to receive data with a second classification, the data with the first classification requires more secure protection than the data with the second classification;
a secure boot/key controller coupled to the secure router and configured as a trust anchor to boot the IC securely; and
a processor coupled to the secure router and configured to encrypt data, to store protocols, to store instructions to detect malicious intrusions on the IC and to provide key management.
2. The IC of claim 1 wherein the processor comprises an encryption accelerator and a voice encoder.
3. The IC of claim 1 wherein the processor stores suite B protocols.
4. The IC of claim 1 wherein the secure router comprises a security policy.
5. The IC of claim 4 wherein the security policy is configurable by a user.
6. The IC of claim 1 , further comprising a memory coupled to the secure boot/key controller and configured to store keys.
7. The IC of claim 6 wherein the memory is battery-backed memory.
8. The IC of claim 1 wherein the data with the first classification is classified data and the data with the second classification is unclassified data.
9. An integrated circuit (IC) comprising:
a processor;
a secure router coupled to the processor and comprising a security policy;
a memory;
a secure boot/key controller coupled to the memory and the secure router;
a first port configured to receive data with a first classification;
a second port configured to receive data with a second classification, the data with the first classification requires more secure protection than the data with the second classification;
a third port configured to receive data with the first classification and to receive data from the second classification; and
a non-transitory machine-readable medium that stores executable instructions to boot the IC, the instructions causing a machine to:
fetch an application key stored in the memory, the application key being associated with an application;
validate an image against the security policy;
decrypt the image using built-in algorithms and keys stored in the memory;
transition the IC to a secure state if the image is validated and decrypted, the secure state allowing data to flow in and out of the first, second and third ports and allowing execution of the processor; and
transition control of the IC to the application.
10. The IC of claim 9 wherein the secure router and the secure boot/key controller are trust anchors each configured to perform a function that is trusted.
11. The IC of claim 10 wherein the processor comprises an encryption accelerator.
12. The IC of claim 11 wherein the processor stores suite B protocols.
13. The IC of claim 12 wherein the processor comprises a voice encoder.
14. An integrated circuit (IC), comprising:
a first port coupled to a first direct memory access (DMA) and configured to receive data with a first classification from outside the IC;
a second port coupled to the second DMA and configured to receive data with a second classification from outside the IC, the data with the first classification requires more secure protection than the data with the second classification;
a processor;
a secure router coupled to the processor and comprising a security policy;
a memory;
a secure boot/key controller coupled to the memory and the secure router;
the first DMA coupled to the secure router and configured to receive data with the first classification;
the second DMA coupled to the secure router and configured to receive data with the second classification; and
a non-transitory machine-readable medium that stores executable instructions, the instructions causing a machine to:
receive data from the first DMA provided by the first port;
validate the data against a security policy stored at the secure router;
process at the processor the data provided by the secure router if the data is validated;
validate post processing data against the security policy at the secure router after processing of the data by the processor; and
provide the post processing data to the second DMA for transmission out of the second port if the post processing data is validated.
15. The IC of claim 14 wherein the secure router and the secure boot/key controller are trust anchors each configured to perform a function that is trusted.
16. The IC of claim 15 wherein the processor comprises an encryption accelerator and a voice encoder.
17. The IC of claim 16 wherein the processor stores suite B protocols.
18. The IC of claim 17 wherein the processor comprises a voice encoder.
19. The IC of claim 1 wherein the trust anchor is trusted by the National Security Agency (NSA).
20. The IC of claim 10 wherein at least one of the trust anchors is trusted by the National Security Agency (NSA).
21. The IC of claim 15 wherein at least one of the trust anchors is trusted by the National Security Agency (NSA).