Unified architecture for crypto functional units
In described embodiments, a unified Crypto Functional Unit (CFU) block architecture provides a capability for advanced communication processors to provide parallel and concurrent processing of multiple crypto operations/transactions within high-speed hardware to support different security standards (e.g. from IPsec, 3GPP). In particular, each CFU block of the unified CFU block architecture comprises a FIFO-based interface, switch, and wrapped cipher/hasher. The unified CFU block architecture allows for drop-in solutions for cipher blocks in ASIC designs with crypto function blocks.
1. A crypto function unit (CFU), the CFU comprising:
an input buffer configured to receive crypto-function data for one or more transactions from a host;
a wrapped cipher/hasher module configured to apply a crypto-function algorithm to the crypto-function data corresponding to each transaction based on a playing card template associated with each transaction; and
a switch configured to transfer of the crypto-function data for each transaction between the input buffer and the wrapped cipher/hasher module based on control signals exchanged between the switch and the wrapped cipher/hasher module,
wherein the wrapped cipher/hasher module provides processed crypto data for each transaction based on the crypto-function data in accordance with the applied crypto-function algorithm,
wherein the wrapped cipher/hasher module comprises:
a cipher/hasher core module configured to apply the crypto-function algorithm to the crypto-function data for a transaction based on the playing card template associated with the transaction, and the cipher/hasher core module is configured to be bypassed by the unpack module by a selection through a bypass channel to the pack module,
an unpack module configured to translate/reformat the crypto-function data between a first format of the crypto-function data to a second format of the cipher/hasher core module;
a pack module configured to translate/reformat the processed crypto data of the second format of the cipher/hasher core module to the first format; and
a cipher/hasher core module configured to apply the crypto-function algorithm to the crypto-function data for a transaction based on the playing card template associated with the transaction, wherein the cipher/hasher core module is configured to be bypassed by the unpack module by a selection through a bypass channel to the pack module, wherein the cipher/hasher module comprises:
a finite state machine (FSM) cipher/hasher controller, coupled to the cipher/hasher core module, configured to initialize the cipher/hasher core module for the crypto-function algorithm associated with the playing card identifier, wherein the FSM cipher/hasher controller is configured to (i) verify the playing card template associated with the transaction and, if the playing card template is valid, (ii) begin processing of the crypto-function data for the transaction by the cipher/hasher core module.
2. The CFU of claim 1 , wherein, if the playing card template is not valid, the FSM cipher/hasher controller is further configured to terminate processing of the crypto-function data for the transaction by the cipher/hasher core module.
3. The CFU of claim 1 , wherein the first format is a Super Language format.
4. The CFU of claim 1 , wherein signals generated from the unpack/pack module are sent to the FSM cipher/hasher controller to indicate the end of processing of the transaction by the cipher/hasher core module.
5. The CFU of claim 1 , wherein the unpack/pack module is further configured to provide signaling to an output buffer to read the processed crypto data based on a water level signal from the output buffer.
6. The CFU of claim 1 , wherein the crypto-function algorithm is one or more of AES, MD4, MD5, SHA-1, SHA-2, SHA-2, Triple-DES, KASUMI/SNOW, confidentiality algorithm (f8) or integrity algorithm (f9).
7. The CFU of claim 1 , wherein the CFU is one of a plurality of CFUs embodied in an application specific integrated circuit (ASIC).
8. The CFU of claim 7 , wherein the plurality of CFUs are coupled in a parallel processing architecture with virtual pipelining of a network processor.
9. A method of processing crypto-function data by a crypto function unit (CFU), the method comprising the steps of:
receiving crypto-function data for one or more transactions from a host;
applying, by a wrapped cipher/hasher module, a crypto-function algorithm to the crypto-function data corresponding to each transaction based on a playing card template associated with each transaction;
coordinating, with a switch, transfer of the crypto-function data for each transaction between the input buffer and the wrapped cipher/hasher module based on control signals exchanged between the switch and the wrapped cipher/hasher module; and
providing, by the wrapped cipher/hasher module, processed crypto data for each transaction based on the crypto-function data in accordance with the applied crypto-function algorithm,
wherein the step of the applying a crypto-function algorithm comprises the steps of translating/reformatting, by an unpack module of the wrapped cipher/hasher module,
the crypto-function data between a first format of the cipher/hasher core module to a second format of the cipher/hasher core module;
translating/reformatting, by a pack module of the wrapped cipher/hasher module, the processed crypto data of the second format of the cipher/hasher core module to the first format;
initializing, by a finite state machine (FSM) cipher/hasher controller coupled to the cipher/hasher core module, the cipher/hasher core module for the crypto-function algorithm associated with the playing card identifier;
verifying the playing card template associated with the transaction; and, if the playing card template is valid:
applying, by a cipher/hasher core module of the wrapped cipher/hasher module, the crypto-function algorithm to the crypto-function data for a transaction based on the playing card template associated with the transaction, wherein the cipher/hasher core module is bypassed by the unpack module by a selection through a bypass channel to the pack module; and
supporting, by a finite state machine (FSM) cipher/hasher controller, a communication protocol to work with the cipher/hasher core module.
10. The method of claim 9 , wherein, if the playing card template is not valid:
terminating the processing, by the FSM cipher/hasher controller, of the crypto-function data for the transaction by the cipher/hasher core module; and
bypassing, by the bypass channel, the cipher/hasher core module.
11. The method of claim 9 , further comprising translating/reformatting the crypto-function data between i) a first format of the crypto-function data to a second format of the cipher/hasher core module and ii) translating/reformatting the processed crypto data of the second format of the cipher/hasher core module to the first format.
12. The method of claim 11 , wherein the first format is a Super Language format.
13. The method of claim 11 , further comprising providing signaling to the FSM cipher/hasher controller to indicate the end of processing of the transaction by the cipher/hasher core module.
14. The method of claim 11 , further comprising providing signaling to an output buffer and reading the processed crypto data based on a water level signal from the output buffer.
15. The method of claim 9 , wherein the crypto-function algorithm applied is one or more of AES, MD4, MD5, SHA-1, SHA-2, SHA-3, Triple-DES, KASUMI, and SNOW crypto-function algorithms.
16. A non-transitory machine-readable storage medium, having encoded thereon program code, wherein, when the program code is executed by a machine, the machine implements a method for processing crypto-function data by a crypto function unit (CFU), the method comprising the steps of:
receiving crypto-function data for one or more transactions from a host;
applying, by a wrapped cipher/hasher module, a crypto-function algorithm to the crypto-function data corresponding to each transaction based on a playing card template associated with each transaction;
coordinating, with a switch, transfer of the crypto-function data for each transaction between the input buffer and the wrapped cipher/hasher module based on control signals exchanged between the switch and the wrapped cipher/hasher module; and
providing, by the wrapped cipher/hasher module, processed crypto data for each transaction based on the crypto-function data in accordance with the applied crypto-function algorithm,
wherein the step of the applying a crypto-function algorithm comprises the steps of translating/reformatting, by an unpack module of the wrapped cipher/hasher module, the crypto-function data between a first format of the cipher/hasher core module to a second format of the cipher/hasher core module;
translating/reformatting, by a pack module of the wrapped cipher/hasher module, the processed crypto data of the second format of the cipher/hasher core module to the first format;
initializing, by a finite state machine (FSM) cipher/hasher controller coupled to the cipher/hasher core module, the cipher/hasher core module for the crypto-function algorithm associated with the playing card identifier;
verifying the playing card template associated with the transaction; and, if the playing card template is valid:
applying, by a cipher/hasher core module of the wrapped cipher/hasher module, the crypto-function algorithm to the crypto-function data for a transaction based on the playing card template associated with the transaction, wherein the cipher/hasher core module is bypassed by the unpack module by a selection through a bypass channel to the pack module; and
supporting, by a finite state machine (FSM) cipher/hasher controller, a communication protocol to work with the cipher/hasher core module.