Secure stream protocol for serial interconnect
Methods, systems, and apparatuses associated with a secure stream protocol for a serial interconnect are disclosed. An apparatus comprises a first device comprising circuitry to, using an end-to-end protocol, secure a transaction in a first secure stream based at least in part on a transaction type of the transaction, where the first secure stream is separate from a second secure stream. The first device is further to send the transaction secured in the first secure stream to a second device over a link established between the first device and the second device, where the transaction is to traverse one or more intermediate devices from the first device to the second device. In more specific embodiments, the first secure stream is based on one of a posted transaction type, a non-posted transaction type, or completion transaction type.
1. An apparatus comprising:
first interface circuitry to:
secure a first transaction layer packet (TLP) in a first stream of a plurality of streams based, at least in part, on a first transaction type of the first TLP, wherein the first stream is to include one or more transaction layer packets (TLPs) of the first transaction type, wherein the first transaction type is one of a plurality of transaction types including a posted transaction type and a non-posted transaction type, wherein to secure the first TLP in the first stream is to include:
encrypting a first data portion of the first TLP based at least in part on a first encryption key assigned to the first stream;
computing a first message authentication code over at least the encrypted first data portion and a first header in the first TLP; and
adding the first message authentication code to the first TLP; and
secure a second TLP in a second stream of the plurality of streams based at least in part on a second transaction type that is different from the first transaction type, wherein the second stream is to include one or more other transaction layer packets (TLPs) of the second transaction type, wherein to secure the second TLP in the second stream is to include:
encrypting a second data portion of the second TLP based at least in part on a second encryption key that is different than the first encryption key and is assigned to the second stream.
2. The apparatus of claim 1 , wherein the first interface circuitry is further to:
send the first TLP secured in the first stream to second interface circuitry of a target device, wherein the first TLP is to traverse one or more intermediate devices from the first interface circuitry to the second interface circuitry; and
send the second TLP secured in the second stream to the second interface circuitry of the target device.
3. The apparatus of claim 2 , wherein two or more transaction layer packets (TLPs) of the posted transaction type in the first stream are to be received by the second interface circuitry in a same order that the first interface circuitry is to send the two or more TLPs.
4. The apparatus of claim 1 , wherein the first TLP comprises a first prefix including a trusted bit.
5. The apparatus of claim 4 , wherein the first prefix is to include the trusted bit to indicate whether the first TLP originated from a trusted domain.
6. The apparatus of claim 4 , wherein the first message authentication code is to be computed, in part, over the first prefix.
7. The apparatus of claim 1 , wherein the first data portion of the first TLP is to be encrypted based, in part, on a first counter assigned to the first stream.
8. The apparatus of claim 1 , wherein to secure the second TLP in the second stream is to include:
encrypting the second data portion of the second TLP based, in part, on a second counter assigned to the second stream;
computing a second message authentication code over at least the encrypted second data portion and a second header in the second TLP; and
adding the second message authentication code to the second TLP.
9. The apparatus of claim 1 , wherein the first interface circuitry is further to:
insert a first value of a first posted request sent counter in the second TLP, wherein the first value is to represent a number of transaction layer packets (TLPs) of the posted transaction type sent by the first interface circuitry to second interface circuitry of a target device since a last TLP of the non-posted transaction type was sent.
10. The apparatus of claim 9 , wherein the first interface circuitry is further to:
increment the first posted request sent counter based on the first TLP being the posted transaction type.
11. The apparatus of claim 1 , wherein the first interface circuitry is further to:
receive, from second interface circuitry of a target device, a third TLP of a completion transaction type, the third TLP secured in a third stream of the plurality of streams based, at least in part, on the completion transaction type of the third TLP.
12. The apparatus of claim 11 , wherein the first interface circuitry is further to:
compute a third message authentication code based, at least in part, on an encrypted third data portion and a third header in the third TLP; and
verify integrity of the third TLP based on comparing the third message authentication code and another message authentication code in the third TLP.
13. The apparatus of claim 11 , wherein the first interface circuitry is further to:
obtain, from the third TLP, a second value of a second posted request sent counter maintained by the second interface circuitry of the target device; and
based in part on the second value, determine whether any TLPs of the posted transaction type were dropped or delayed since a last TLP of the completion transaction type was sent via the third stream.
14. The apparatus of claim 1 , wherein the encrypted first data portion and the first message authentication code are to be computed using an Advanced Encryption Standard-Galois Counter Mode (AES-GCM) security scheme.
15. The apparatus of claim 1 , wherein a link for communication between the first interface circuitry and second interface circuitry of a target device, is to be established based on a peripheral component interconnect express (PCIe) protocol with a secure stream protocol.
16. A system comprising:
a first endpoint including a processor and a first input/output (I/O) interface; and
a second endpoint including a second I/O interface, the second I/O interface communicatively coupled to the first I/O interface, wherein the first I/O interface is to:
secure a first transaction layer packet (TLP) in a first stream of a plurality of streams based, at least in part, on a first transaction type of the first TLP, the first transaction type being a posted transaction type, wherein to secure the first TLP in the first stream is to include:
encrypting a first data portion of the first TLP based in part on a first counter assigned to the first stream;
computing a first message authentication code over at least the encrypted first data portion and a first header in the first TLP; and
adding the first message authentication code to the first TLP;
increment a second counter based on the first TLP being a posted transaction type;
send the first TLP to the second endpoint;
secure a second TLP in a second stream of the plurality of streams based, at least in part, on a second transaction type of the second TLP, the second transaction type being a non-posted transaction type;
insert, in the second TLP, a value of the second counter; and
set the second counter to zero based on the second TLP being the non-posted transaction type.
17. The system of claim 16 , wherein the second I/O interface is to:
receive the first TLP and one or more other transaction layer packets (TLPs) of the posted transaction type in the first stream in a same order that the first I/O interface is to send the first TLP and the one or more other TLPs.
18. The system of claim 16 , wherein the first TLP comprises a trusted bit in a prefix, the trusted bit to indicate whether the first TLP originated from a trusted domain in the first endpoint.
19. The system of claim 16 , wherein the second I/O interface is to:
secure a third TLP in a third stream of the plurality of streams based, at least in part, on a completion transaction type of the third TLP, wherein to secure the third TLP in the third stream is to include:
encrypting a second data portion of the third TLP based, in part, on a third counter assigned to the third stream;
computing a second message authentication code over at least the encrypted second data portion and a second header in the third TLP; and
adding the second message authentication code to the third TLP; and
send the third TLP to the first endpoint.
20. The system of claim 16 , wherein the first I/O interface comprises a transmitter, and wherein the second I/O interface comprises a receiver.
21. One or more non-transitory computer-readable media with instructions stored thereon, wherein the instructions are executable to cause a machine to:
secure, at a first device, a first transaction layer packet (TLP) in a first stream of a plurality of streams based, at least in part, on a first transaction type of the first TLP, wherein the first stream is to include one or more transaction layer packets (TLPs) of the first transaction type, wherein the first transaction type is one of a plurality of transaction types including a posted transaction type, a non-posted transaction type, and a completion transaction type, wherein to secure the first TLP in the first stream is to include:
encrypting a first data portion of the first TLP based at least in part on a first encryption key assigned to the first stream;
computing a first message authentication code over at least the encrypted first data portion and a first header in the first TLP; and
adding the first message authentication code to the first TLP; and
secure a second TLP in a second stream of the plurality of streams based, at least in part, on a second transaction type that is different from the first transaction type, wherein the second stream is to include one or more other transaction layer packets (TLPs) of the second transaction type, wherein to secure the second TLP in the second stream is to include:
encrypting a second data portion of the second TLP based at least in part on a second encryption key that is different than the first encryption key and is assigned to the second stream.
22. The one or more non-transitory computer-readable media of claim 21 , wherein the first message authentication code is to be computed, in part, over a trusted bit indicating whether the first TLP originated from a trusted domain.
23. The one or more non-transitory computer-readable media of claim 21 , wherein the first data portion of the first TLP is to be encrypted based, in part, on a first counter assigned to the first stream.
24. An apparatus comprising:
first interface circuitry to:
secure a first transaction layer packet (TLP) in a first stream of a plurality of streams based, at least in part, on the first TLP being a first transaction type, wherein to secure the first TLP in the first stream is to include:
encrypting a first data portion of the first TLP based in part on a first counter assigned to the first stream;
computing a first message authentication code over at least the encrypted first data portion and a first header in the first TLP; and
adding the first message authentication code to the first TLP;
incrementing a second counter based on the first TLP being a posted transaction type;
send the first TLP to second interface circuitry;
secure a second TLP in a second stream of the plurality of streams based, at least in part, on the second TLP being a non-posted transaction type;
insert, in the second TLP, a value of the second counter; and
set the second counter to zero based on the second TLP being the non-posted transaction type.
25. The apparatus of claim 24 , wherein the first message authentication code is to be computed, in part, over a prefix in the first TLP, the prefix including a trusted bit.
26. The apparatus of claim 24 , wherein the first data portion of the first TLP is to be encrypted based, in part, on a first key assigned to the first stream.
27. The apparatus of claim 24 , wherein to secure the second TLP in the second stream is to include:
encrypting a second data portion of the second TLP based, in part, on a third counter assigned to the second stream;
computing a second message authentication code over at least the encrypted second data portion and a second header in the second TLP; and
adding the second message authentication code to the second TLP.
28. The apparatus of claim 24 , wherein the first data portion in the first TLP of the first stream is to be encrypted based, in part, on a first encryption key assigned to the first stream, wherein a second data portion in the second TLP of the second stream is to be encrypted based on a second encryption key and a third counter assigned to the second stream, wherein the first interface circuitry is further to:
send the second TLP to the second interface circuitry.
29. The apparatus of claim 7 , wherein the first counter is a 96-bit counter.