System on a chip (SOC) communications to prevent direct memory access (DMA) attacks
This disclosure describes system on a chip (SOC) communications that prevent direct memory access (DMA) attacks. An example SoC includes an encryption engine and a security processor. The encryption engine is configured to encrypt raw input data using a cipher key to form an encrypted payload. The security processor is configured to select the cipher key from a key store holding a plurality of cipher keys based on a channel ID describing a {source subsystem, destination subsystem} tuple for the encrypted payload, to form an encryption header that includes the channel ID, to encapsulate the encrypted payload with the encryption header that includes the channel ID to form a crypto packet, and to transmit the crypto packet to a destination SoC that is external to the SoC.
1. A method comprising:
selecting, by one or more processors of a system-on-chip (SoC), a cipher key from a key store holding a plurality of cipher keys based on a channel ID describing source and destination information for an encrypted payload;
forming, by the one or more processors, an encryption header that includes the channel ID;
encapsulating the encrypted payload with the encryption header that includes the channel ID to form an encrypted packet; and
transmitting, by a security processor, the encrypted packet to a destination SoC.
2. The method of claim 1 , wherein selecting the cipher key based on the channel ID further includes selecting the cipher key on a unique per-channel ID basis.
3. The method of claim 1 , further comprising identifying the channel ID at least in part by identifying, from a plurality of subsystems of the SoC, a source subsystem that originated raw input data.
4. The method of claim 3 , further comprising loading, by a direct memory access (DMA) engine, the raw input data from an address memory reserved for the source subsystem in a shared memory (SMEM) to a wireless memory (WMEM) of the SoC.
5. The method of claim 1 , wherein the SoC is coupled to an egress interface, and wherein transmitting the encrypted packet to the destination SoC comprises transmitting the encrypted packet to the destination SoC via the egress interface.
6. The method of claim 1 , wherein the SoC comprises a source SoC, and wherein forming the encryption header comprises including a source SoC-identifier in the encryption header.
7. The method of claim 6 , further comprising:
applying the cipher key to the source SoC-identifier and the channel ID to form a cryptographic signature; and
signing the encryption header and the encrypted payload of the encrypted packet using the cryptographic signature.
8. The method of claim 1 , wherein the SoC is integrated into one of a head-mounted device (HMD) of an artificial reality system or a peripheral device of the artificial reality system.
9. The method of claim 1 , wherein the destination SOC is external to the SoC.
10. The method of claim 1 , wherein transmitting the encrypted packet to the destination SoC further includes transmitting the encrypted packet to the destination SoC via an egress interface.
11. A method comprising:
receiving an encapsulated encrypted packet including an encryption header and an encrypted payload, wherein the encryption header includes a channel ID describing source and destination information for the encrypted payload;
decapsulating the encapsulated encrypted packet to obtain the encryption header and the encrypted payload;
parsing the encryption header to obtain the channel ID describing the source and destination information for the encrypted payload; and
selecting a decryption key from a key store holding a plurality of decryption keys based on the channel ID obtained from the encryption header.
12. The method of claim 11 , further comprising:
decrypting the encrypted payload using the decryption key to form a decrypted payload.
13. The method of claim 11 , wherein selecting the decryption key further includes selecting the decryption key on a unique per-channel ID basis.
14. The method of claim 11 , wherein receiving an encapsulated encrypted packet further includes receiving an encapsulated encrypted packet via an ingress interface.