Application Domain Security
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for application domain security. One of the methods includes maintaining, for each ingress port of a plurality of ingress ports of each top-level router of each processing device in a system, information representing one or more valid destination device ids for packets arriving at the ingress port. If an extracted destination device id of a packet received at a first ingress port of a first top-level router of a first processing device is an invalid destination device id according to information associated with the first internal ingress port, the first top-level router modifies a path of the received packet.
1 . A computer-implemented method comprising:
processing, by a plurality of processing devices, packets originating from a plurality of different applications executing on one or more of the processing devices, wherein each processing device has one or more integrated processing cores and an integrated top-level router, wherein each processing device is assigned to exactly one application of the plurality of different applications, and wherein all processing devices assigned to a particular application belong to a corresponding application domain;
maintaining, for each ingress port of a plurality of ingress ports of each top-level router of each processing device of the plurality of processing devices, information representing one or more valid destination device ids for packets arriving at the ingress port;
receiving, by a first ingress port of a first top-level router of a first processing device, a packet;
extracting a destination device id from the received packet;
determining that the extracted destination device id of the received packet is an invalid destination device id according to information associated with the first ingress port; and
in response to the determination, modifying, by the first top-level router, a path of the received packet.
2 . The method of claim 1 , wherein modifying the path of the received packet comprises dropping the packet without forwarding the packet to a device having the destination device id.
3 . The method of claim 1 , wherein modifying the path of the received packet comprises routing the packet to a default port.
4 . The method of claim 1 , wherein the first ingress port is an internal ingress port, and wherein the packet originated from within the first processing device.
5 . The method of claim 1 , wherein the first ingress port is an external ingress port, and wherein the packet originated from a different second processing device.
6 . The method of claim 1 , wherein the information representing the one or more valid destination device ids comprises a first lookup table having information representing a plurality of valid destination device ids, and wherein each top-level router of each processing device has a second main lookup table for routing packets arriving at ingress ports of the top-level router to egress ports of the top-level router.
7 . The method of claim 1 , wherein the top-level router has a main lookup table for routing packets arriving at the top-level router to a particular egress port of the top-level router, and wherein maintaining the information representing the one or more valid destination device ids for packets arriving at the ingress port comprises maintaining the information in the main lookup table.
8 . The method of claim 7 , wherein each top-level router does not query the main lookup table for packets having invalid destination device ids according to the information associated with each ingress port.
9 . The method of claim 1 , wherein each processing device has an on-chip, packet-based communications subsystem.
10 . The method of claim 1 , wherein the packet does not identify a source device from which the packet originated.
11 . A computer-implemented method comprising:
processing, by a plurality of processing devices, packets originating from a plurality of different applications executing on one or more of the processing devices, wherein each processing device has one or more integrated processing cores and an integrated top-level router, wherein each processing device is assigned to exactly one application of the plurality of different applications, and wherein all processing devices assigned to a particular application belong to a corresponding application domain;
maintaining, for each external egress port of a plurality of external egress ports of each top-level router of each processing device of the plurality of processing devices, information representing one or more valid destination device ids for packets arriving at the external egress port;
receiving, by a first external egress port of a first top-level er of a first processing device, a packet;
extracting a destination device id from the received packet;
determining that the extracted destination device id of the received packet is an invalid destination device id according to information associated with the first external egress port; and
in response to the determination, modifying, by the first top-level router, a path of the received packet.
12 . The method of claim 11 , wherein modifying the path of the received packet comprises dropping the packet without forwarding the packet to a device having the destination device id.
13 . The method of claim 11 , wherein modifying the path of the received packet comprises routing the packet to a default port.
14 . The method of claim 11 , wherein the packet originated from within the first processing device.
15 . The method of claim 11 , wherein the packet has an invalid destination device id due to a hardware error within the top-level router.
16 . The method of claim 11 , wherein the packet is routed to an invalid egress port due to a configuration error.
17 . The method of claim 11 , wherein the information representing the one or more valid destination device ids comprises a first lookup table having information representing a plurality of valid destination device ids, and wherein each top-level router of each processing device has a second main lookup table for routing packets arriving at the top-level router.
18 . The method of claim 11 , wherein the top-level router has a main lookup table for routing packets arriving at the top-level router to a particular egress port of the top-level router, and wherein maintaining the information representing the one or more valid destination device ids for packets arriving at the external egress port comprises maintaining the information in the main lookup table.
19 . The method of claim 11 , wherein each processing device has an on-chip, packet-based communications subsystem.
20 . The method of claim 11 , wherein the packet does not identify a source device from which the packet originated.
21 . A system comprising:
a plurality of processing devices, each processing device comprising one or more integrated processing cores and an integrated top-level router,
wherein each processing device is configured to receive an assignment to exactly one application of a plurality of different applications,
wherein each processing device of the plurality of processing devices is configured to perform operations comprising:
maintaining, for each ingress port of a plurality of ingress ports of the top-level router of the processing device, information representing one or more valid destination device ids for packets arriving at the ingress port, wherein the information represents an assignment of the plurality of processing devices to a plurality of different application domains,
receiving, by an ingress port of a top-level router of the processing device, a packet;
extracting a destination device id from the received packet;
determining that the extracted destination device id of the received packet is an invalid destination device id according to information associated with the ingress port; and
in response to the determination, modifying a path of the received packet.
22 . The system of claim 21 , wherein modifying the path of the received packet comprises dropping the packet without forwarding the packet to a device having the destination device id.
23 . The system of claim 21 , wherein modifying the path of the received packet comprises routing the packet to a default port.
24 . The system of claim 21 , wherein the ingress port is an internal ingress port configured to receive packets originating from within the processing device.
25 . The system of claim 21 , wherein the ingress port is an external ingress port configured to receive packets originating from a different processing device.
26 . The system of claim 21 , wherein the information representing the one or more valid destination device ids comprises a first lookup table having information representing a plurality of valid destination device ids, and wherein the top-level router of the processing device has a second main lookup table for routing packets arriving at ingress ports of the top-level router to egress ports of the top-level router.
27 . The system of claim 21 , wherein the top-level router has a main lookup table for routing packets arriving at the top-level router to a particular egress port of the top-level router, and wherein maintaining the information representing the one or more valid destination device ids for packets arriving at the ingress port comprises maintaining the information in the main lookup table.
28 . The system of claim 27 , wherein each top-level router does not query the main lookup table for packets having invalid destination device ids according to the information associated with each ingress port.
29 . The system of claim 21 , wherein each processing device has an on-chip, packet-based communications subsystem.
30 . The system of claim 21 , wherein the processing device is configured to process packets that do not identify a source device from which the packet originated.
31 . A system comprising:
a plurality of processing devices, each processing device comprising one or more integrated processing cores and an integrated top-level router,
wherein each processing device is configured to receive an assignment to exactly one application of a plurality of different applications,
wherein each processing device of the plurality of processing devices is configured to perform operations comprising:
maintaining, for each external egress port of a plurality of external egress ports of the processing device, information representing one or more valid destination device ids for packets arriving at the external egress port, wherein the information represents an assignment of the plurality of processing devices to a plurality of different application domains;
receiving, by an external egress port of a top-level router of the processing device, a packet;
extracting a destination device id from the received packet;
determining that the extracted destination device id of the received packet is an invalid destination device id according to information associated with the external egress port; and
in response to the determination, modifying a path of the received packet.
32 . The system of claim 31 , wherein modifying the path of the received packet comprises dropping the packet without forwarding the packet to a device having the destination device id.
33 . The system of claim 31 , wherein modifying the path of the received packet comprises routing the packet to a default port.
34 . The system of claim 31 , wherein the external egress port is configured to filter packets originating from within the processing device.
35 . The system of claim 31 , wherein the external egress port is configured to filter packets having an invalid destination device id due to a hardware error within the top-level router.
36 . The system of claim 31 , wherein the external egress port is configured to filter packets routed to an invalid egress port due to a configuration error.
37 . The system of claim 31 , wherein the information representing the one or more valid destination device ids comprises a first lookup table having information representing a plurality of valid destination device ids, and wherein the top-level router of the processing device has a second main lookup table for routing packets arriving at the top-level router.
38 . The system of claim 31 , wherein the top-level router has a main lookup table for routing packets arriving at the top-level router to a particular egress port of the top-level router, and wherein maintaining the information representing the one or more valid destination device ids for packets arriving at the external egress port comprises maintaining the information in the main lookup table.
39 . The system of claim 31 , wherein each processing device has an on-chip, packet-based communications subsystem.
40 . The system of claim 31 , wherein the processing device is configured to process packets that do not identify a source device from which the packet originated.