Security plugin for a system-on-a-chip platform
Systems and techniques for a System-on-a-Chip (SoC) security plugin are described herein. A component message may be received at an interconnect endpoint from an SoC component. The interconnect endpoint may pass the component message to a security component via a security interlink. The security component may secure the component message, using a cryptographic engine, to create a secured message. The secured message is delivered back to the interconnect endpoint via the security interlink and transmitted across the interconnect by the interconnect endpoint.
1. A security plugin for a system-on-a-chip platform, the security plugin comprising:
a cryptographic circuit including:
a selected cryptographic engine selected from a plurality of cryptographic engines available to designers of the system-on-a-chip, selection of the selected cryptographic engine from the plurality of cryptographic engines based on security or manufacturing goals of the designers and at least one of die size, power consumption, cost, throughput performance, or cryptographic performance of the selected cryptographic engine;
wherein the cryptographic circuit includes an integrity engine selected from a plurality of integrity engines; and
a standard interface that is generic to the plurality of cryptographic engines, wherein, in operation, an unencrypted message from an initiator component received by a system-on-a-chip interconnect interface is provided to the selected cryptographic engine via the standard interface to produce an encrypted message that is transmitted to a destination component, the standard interface comprising:
a messaging bus; and
a translator corresponding to the selected cryptographic engine, the translator, when in operation, to translate messages of the messaging bus to hardware inputs of each cryptographic engine of the plurality of cryptographic engines, the plurality of cryptographic engines each having a different hardware interface for each respective hardware input, the hardware interfaces defining respective inputs for the plurality of cryptographic engines;
a cryptographic controller to manage a cryptographic key used by the selected cryptographic engine to create the encrypted message; and
a cryptographic state manager to manage cryptographic session states of a cryptographic session between the initiator component and the destination component.
2. The security plugin of claim 1 , wherein the standard interface is generic to the plurality of integrity engines.
3. The security plugin of claim 1 , wherein the plurality of cryptographic engines includes a set of Advanced Encryption Standard cryptographic engines.
4. The security plugin of claim 1 , wherein the plurality of cryptographic engines are classified by at least one of die size, power consumption, cost, throughput performance, or cryptographic performance.
5. The security plugin of claim 1 , wherein the cryptographic controller is to negotiate with a communication peer to obtain a session key.
6. The security plugin of claim 1 , wherein to manage cryptographic session states between the initiator component and the destination component includes the cryptographic state manager to maintain a data structure of cryptographic sessions, the data structure including fields for a destination component, a sequence number, and a session key.
7. The security plugin of claim 1 , comprising an access controller to manage access rights of system-on-a-chip components, the access controller including:
a security-attributes-of-the-initiators registry to store access rights of the system-on-a-chip components; and
a filter to block the message in response to a determination that the initiator component does not have access to the destination component based on the security-attributes-of-the-initiators registry.
8. The security plugin of claim 1 , comprising an interconnect message header analyzer to:
determine whether a message received by the interconnect interface from another system-on-a-chip interconnect interface is an encrypted message;
relay the message to the cryptographic circuit if the message is an encrypted message; and
pass the message through to the interconnect interface if the message is not an encrypted message.
9. A method for a security plugin for a system-on-a-chip, the method comprising:
receiving a component message at a bus endpoint from a system-on-a-chip component;
passing, by the bus endpoint, the component message to a security component via a security interconnect;
receiving the component message by the security component via the security interconnect;
encrypting the component message using a selected cryptographic engine, the selected cryptographic engine being a selected one of a plurality of cryptographic engines available to designers of the system-on-a-chip, selection of the selected cryptographic engine from the plurality of cryptographic engines being based on security or manufacturing goals of the designers and at least one of die size, power consumption, cost, throughput performance, or cryptographic performance of the selected cryptographic engine, the security interconnect used for each of the plurality of cryptographic engines, the plurality of cryptographic engines each having a different hardware interface for each respective input, the hardware interfaces defining respective inputs for the plurality of cryptographic engines and a plurality of integrity circuits, the encrypting including:
transmitting the component message to the selected cryptographic engine by the security component via a messaging bus;
translating a bus communication from the messaging bus to hardware input accepted by the selected cryptographic engine; and
translating an output of the selected cryptographic engine produced in response to the input to a second bus communication including an encrypted message form of the component message;
communicating the encrypted message to the bus endpoint via the security interconnect; and
transmitting the encrypted message across the interconnect by the bus endpoint.
10. The method of claim 9 , wherein encrypting the component message includes adding a message integrity element from a message integrity circuit of the security component.
11. The method of claim 10 comprising:
receiving a second encrypted message over the interconnect;
relaying the second encrypted message to the security component to verify the integrity of the second encrypted message; and
dropping the second encrypted message in response to being unable to verify the integrity of the second encrypted message.
12. The method of claim 9 comprising:
receiving a second encrypted message over the interconnect;
reading a message header for the second encrypted message to determine that it is encrypted;
passing, by the bus endpoint, the second encrypted message to the security component via the security interconnect;
decrypting, by the security component, the second encrypted message to create a second component message; and
transmitting the second component message to the system-on-a-chip component.
13. The method of claim 9 comprising:
receiving a second component message including an initiator identifier and a destination identifier;
accessing a security-attributes-of-the-initiators registry to determine that an initiator component does not have access to a destination component based on the initiator identifier and the destination identifier; and
discarding the second component message in response to the determination that an initiator component does not have access to a destination component.
14. The method of claim 9 comprising establishing a cryptographic session for a communications between the system-on-a-chip component and a destination component.
15. The method of claim 14 , wherein a session key for the cryptographic session is used by the selected cryptographic engine to encrypt the component message, and wherein the session key corresponds to the communications stream and no other communications stream of the interconnect.
16. The method of claim 9 , wherein every message traversing a bus to which the bus endpoint is a terminus is encrypted by respective security components in endpoints of the bus.
17. At least one non-transitory machine readable medium including instructions that, when executed by a machine, cause the machine to perform operations for a security plugin for a system-on-a-chip, the operations comprising:
receiving a component message at a bus endpoint from a system-on-a-chip component;
passing, by the bus endpoint, the component message to a security component via a security interconnect;
receiving the component message by the security component via the security interconnect;
encrypting the component message using a selected cryptographic engine, the selected cryptographic engine being a selected one of a plurality of cryptographic engines available to designers of the system-on-a-chip, selection of the selected cryptographic engine from the plurality of cryptographic engines being based on security or manufacturing goals of the designers and at least one of die size, power consumption, cost, throughput performance, or cryptographic performance of the selected cryptographic engine, the security interconnect used for each of the plurality of cryptographic engines, the plurality of cryptographic engines each having a different hardware interface for each respective input, the hardware interfaces defining respective inputs for the plurality of cryptographic engines and a plurality of integrity circuits, the encrypting including:
transmitting the component message to the selected cryptographic engine by the security component via a messaging bus;
translating a bus communication from the messaging bus to hardware input accepted by the selected cryptographic engine; and
translating an output of the selected cryptographic engine produced in response to the input to a second bus communication including an encrypted message form of the component message;
communicating the encrypted message to the bus endpoint via the security interconnect; and
transmitting the encrypted message across the interconnect by the bus endpoint.
18. The at least one machine readable medium of claim 17 , wherein encrypting the component message includes adding a message integrity element from a message integrity circuit of the security component.
19. The at least one machine readable medium of claim 18 , wherein the operations comprise:
receiving a second encrypted message over the interconnect;
relaying the second encrypted message to the security component to verify the integrity of the second encrypted message; and
dropping the second encrypted message in response to being unable to verify the integrity of the second encrypted message.
20. The at least one machine readable medium of claim 17 , wherein the operations comprise:
receiving a second encrypted message over the interconnect;
reading a message header for the second encrypted message to determine that it is encrypted;
passing, by the bus endpoint, the second encrypted message to the security component via the security interconnect;
decrypting, by the security component, the second encrypted message to create a second component message; and
transmitting the second component message to the system-on-a-chip component.
21. The at least one machine readable medium of claim 17 , wherein the operations comprise:
receiving a second component message including an initiator identifier and a destination identifier;
accessing a security-attributes-of-the-initiators registry to determine that an initiator component does not have access to a destination component based on the initiator identifier and the destination identifier; and
discarding the second component message in response to the determination that an initiator component does not have access to a destination component.
22. The at least one machine readable medium of claim 17 , wherein the operations comprise establishing a cryptographic session for a communications between the system-on-a-chip component and a destination component.
23. The at least one machine readable medium of claim 22 , wherein a session key for the cryptographic session is used by the selected cryptographic engine to encrypt the component message, and wherein the session key corresponds to the communications stream and no other communications stream of the interconnect.
24. The at least one machine readable medium of claim 17 , wherein every message traversing a bus to which the bus endpoint is a terminus is encrypted by respective security components in endpoints of the bus.