Mitigating a compromised network on chip
For mitigating a compromised network-on-chip, code appends a node identifier of a destination node to a packet transmitted in a multiprocessor system-on-chip (MPSOC). The MPSOC may include third-party components such as a network-on-chip. The code may detect a copy of the packet from the node identifier. In addition, the code may drop the copy of the packet in response to the copy of the packet being routed to an unintended node.
1. An apparatus comprising:
a processor;
a memory that stores code executable by the processor to perform:
appending a node identifier of a destination node to a packet transmitted in a multiprocessor system-on-chip (MPSOC) comprising third-party components, the third-party components comprising a third-party network-on-chip (NoC) interconnect, wherein the node identifier is embedded in a packet payload of the packet and is distinct from a packet header that specifies routing the packet to the destination node, the node identifier is encrypted, and the packet is scrambled with an encryption;
receiving the packet;
decrypting the node identifier;
detecting a copy of the packet if the node identifier does not match the packet header;
in response to detecting the copy of the packet, dropping the copy of the packet;
detecting an unintended node from the packet header if the node identifier does not match the packet header; and
in response to detecting the unintended node, identifying the unintended node as a malicious node.
2. The apparatus of claim 1 , wherein the processor further periodically moves a process from a first node to a second node in the MPSOC.
3. The apparatus of claim 1 , wherein the processor further scrambles the packet for transmission within the MPSOC.
4. The apparatus of claim 1 , wherein the process is moved after an obfuscation time interval.
5. The apparatus of claim 1 , wherein the processor further isolates the malicious node.
6. The apparatus of claim 1 , wherein the processor further disables the malicious node.
7. The apparatus of claim 1 , wherein the processor further blocks outside communications with the malicious node.
8. The apparatus of claim 1 , wherein the processor further identifies an accomplice node of the malicious node.
9. A method comprising:
appending, by use of a processor, a node identifier of a destination node to a packet transmitted in a multiprocessor system-on-chip (MPSOC) comprising third-party components, the third-party components comprising a third-party network-on-chip (NoC) interconnect, wherein the node identifier is embedded in a packet payload of the packet and is distinct from a packet header that specifies routing the packet to the destination node, the node identifier is encrypted, and the packet is scrambled with an encryption;
receiving the packet;
decrypting the node identifier;
detecting a copy of the packet if the node identifier does not match the packet header;
in response to detecting the copy of the packet, dropping the copy of the packet;
detecting an unintended node from the packet header if the node identifier does not match the packet header; and
in response to detecting the unintended node, identifying the unintended node as a malicious node.
10. The method of claim 9 , the method further comprising periodically moving a process from a first node to a second node in the MPSOC.
11. A program product comprising a non-transitory computer readable storage medium that stores code executable by a processor, the executable code comprising code to perform:
appending a node identifier of a destination node to a packet transmitted in a multiprocessor system-on-chip (MPSOC) comprising third-party components, the third-party components comprising a third-party network-on-chip (NoC) interconnect, wherein the node identifier is embedded in a packet payload of the packet and is distinct from a packet header that specifies routing the packet to the destination node, the node identifier is encrypted, and the packet is scrambled with an encryption;
receiving the packet;
decrypting the node identifier;
detecting a copy of the packet if the node identifier does not match the packet header;
in response to detecting the copy of the packet, dropping the copy of the packet;
detecting an unintended node from the packet header if the node identifier does not match the packet header; and
in response to detecting the unintended node, identifying the unintended node as a malicious node.
12. The program product of claim 11 , the code further periodically moving a process from a first node to a second node in the MPSOC.