Patent Application
20220069998
In a network architecture with one or more security modules services a plurality of general-purpose modules, each security module may need to securely communicate with each of the general-purpose modules. Where the network architecture does not have a fixed topology, security modules and general-purpose modules may not have defined physical or logical addresses. In those situations, the network system cannot establish secure channels between security modules and general-purpose modules.
State of the art cryptographic architecture is designed with fixed hardware paths and known quantities of waveforms and processors that interface with a cryptographic security module. Data from multiple originating sources will arrive at the same physical address and thus presents a problem for the cryptographic engine. Data entering the cryptographic engine needs to be routed to the correct cryptographic algorithm and needs to be returned to the proper network address without being exposed to other locations in the network.
In one aspect, embodiments of the inventive concepts disclosed herein are directed to a system having an arbitrary number of processors configured to interact with a single cryptographic engine or security module. Hardware strapping allows each card and processor to identify its location in a system. The static region of the field-programmable gate array contains the functionality to manage access to the backplane. Dynamic regions of the field-programmable gate array fabric are used to route the data correctly to and from the security module within a specific application. Software is deployed on any card with a generic load that is agnostic to its location and the hardware self-configures.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and should not restrict the scope of the claims. The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments of the inventive concepts disclosed herein and together with the general description, serve to explain the principles.
The numerous advantages of the embodiments of the inventive concepts disclosed herein may be better understood by those skilled in the art by reference to the accompanying figures in which:
Before explaining at least one embodiment of the inventive concepts disclosed herein in detail, it is to be understood that the inventive concepts are not limited in their application to the details of construction and the arrangement of the components or steps or methodologies set forth in the following description or illustrated in the drawings. In the following detailed description of embodiments of the instant inventive concepts, numerous specific details are set forth in order to provide a more thorough understanding of the inventive concepts. However, it will be apparent to one of ordinary skill in the art having the benefit of the instant disclosure that the inventive concepts disclosed herein may be practiced without these specific details. In other instances, well-known features may not be described in detail to avoid unnecessarily complicating the instant disclosure. The inventive concepts disclosed herein are capable of other embodiments or of being practiced or carried out in various ways. Also, it is to be understood that the phraseology and terminology employed herein is for the purpose of description and should not be regarded as limiting.
As used herein a letter following a reference numeral is intended to reference an embodiment of the feature or element that may be similar, but not necessarily identical, to a previously described element or feature bearing the same reference numeral (e.g., 1, 1a, 1b). Such shorthand notations are used for purposes of convenience only, and should not be construed to limit the inventive concepts disclosed herein in any way unless expressly stated to the contrary.
Further, unless expressly stated to the contrary, “or” refers to an inclusive or and not to an exclusive or. For example, a condition A or B is satisfied by anyone of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present).
In addition, use of the “a” or “an” are employed to describe elements and components of embodiments of the instant inventive concepts. This is done merely for convenience and to give a general sense of the inventive concepts, and “a” and “an” are intended to include one or at least one and the singular also includes the plural unless it is obvious that it is meant otherwise.
Finally, as used herein any reference to “one embodiment,” or “some embodiments” means that a particular element, feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the inventive concepts disclosed herein. The appearances of the phrase “in some embodiments” in various places in the specification are not necessarily all referring to the same embodiment, and embodiments of the inventive concepts disclosed may include one or more of the features expressly described or inherently present herein, or any combination of sub-combination of two or more such features, along with any other features which may not necessarily be expressly described or inherently present in the instant disclosure.
Broadly, embodiments of the inventive concepts disclosed herein are directed to a system having an arbitrary number of processors configured to interact with a single cryptographic engine or security module. Hardware strapping allows each card and processor to identify its location in a system. The static region of the field-programmable gate array contains the functionality to manage access to the backplane. Dynamic regions of the field-programmable gate array fabric are used to route the data correctly to and from the security module within a specific application. Software is deployed on any card with a generic load that is agnostic to its location and the hardware self-configures.
Referring to
Referring to
Referring to
These circuit card assemblies 300 may host waveforms or other capabilities, perform the function of a security module, provide an interface between the radio and a host platform or user, etc. The field programmable gate array 308 hosts a cryptographic engine. The cryptographic engine provides data management (including keys, certificates, and algorithms), authentication, confidentiality, and integrity. It may be appreciated that any of these functions may be hosted on any other circuit card assembly 300 in the radio in addition to being hosted in the security module. Different layers of security, enabled by the available functions, may be applied based on different kinds of applications (e.g. boot, communications, storage, etc.) The field programmable gate array 308 defines a static region 334, hardware strapped to a unique identification sequence, the static region 334 comprising a plurality of peripheral transport layer interfaces 318, 320, 322, 324, 326, 328, 330, 332. Each peripheral transport layer interface 318, 320, 322, 324, 326, 328, 330, 332 is in data communication with the processor 302 (specifically the interface ports 304 and cryptographic interface ports 306) via a dynamic region 314 defined by the field programmable gate array 308, the dynamic region 314 defining a plurality of direct memory access ports 310, 312 and switch banks 316. Hardware strapping allows traffic to and from that circuit card assembly 300 to be easily identifiable and the location of the circuit card assembly 300 to be easily identifiable. The cryptographic engine may simultaneously identify and dynamically establish communication channels based on discovering locations of modules in the network.
At startup, the field programmable gate array 308 instantiates a connection between each peripheral transport layer interface 318, 320, 322, 324, 326, 328, 330, 332 and an appropriate switch bank 316. Each switch bank 316 in the dynamic region 314 of the field programmable gate array 308 is configured based on configuration hardware strapping from a static register read at startup; each static register being unique to each slot a circuit card assembly 300 may be plugged into. Each switch bank 316 is configured to provide interfaces to a security module 312 direct memory access port, and to a gateway of the radio to the host interface such that security processing and control from a user are enabled regardless of the slot in which the circuit card assembly 300 is located. Such embodiment allows software to address other processors that are connected as Ethernet connections regardless of the location of the processor 302 and circuit card assembly 300 in the radio. Whenever the cryptographic engine is used it establishes a communication channel and excludes any traffic that doesn't correspond to those hardware strapped static register addresses.
In at least one embodiment, a common security module performs cryptographic functions for waveforms transiting the circuit card assembly 300, as well as crypto variable handling. The architecture that enables the common security module is independent of the location of the hardware and nature of the waveforms hosted in the radio relative to the location of the security module. Hardware may be scaled in complexity and number of cards while still maintaining secure connection to the common security module. The common security module provides cryptographic functionality for all capabilities inside the radio.
In at least one embodiment, the circuit card assembly 300 may be configured for mesh network communications, where each circuit card assembly 300 determines its location in the mesh network so that the correct peripherals are configured to enable point-to-point communication for each component in the radio. Full interfaces between all processors are not required, or indeed for security reasons, are not allowed.
Referring to
When a processing element is ready to create a cryptographic channel 418, 420, it sends a command to the security module to load and configure a cryptographic channel 418, 420. When the security module receives a command from a specific red interface 422, it loads the channel functionality, and also configures the data routers 414, 416 to only allow access to the cryptographic channel 418, 420 through the interface it was configured from (for example the red interface 422), plus its matching black interface, which is loaded from a configuration map stored in the security module. The configured security module (such as in
Between the configuration of the individual cards at startup and the auto configuring of the security module during cryptographic channel substantiation, an arbitrary number of processor cards and waveforms may interface securely with a single common security module. Hardware strapping and self-configuring of field programmable gate arrays in a data radio provides a novel method to enable scalability and reusability of the hardware inside the data radio.
It is believed that the inventive concepts disclosed herein and many of their attendant advantages will be understood by the foregoing description of embodiments of the inventive concepts disclosed, and it will be apparent that various changes may be made in the form, construction, and arrangement of the components thereof without departing from the broad scope of the inventive concepts disclosed herein or without sacrificing all of their material advantages; and individual features from various embodiments may be combined to arrive at other embodiments. The form herein before described being merely an explanatory embodiment thereof, it is the intention of the following claims to encompass and include such changes. Furthermore, any of the features disclosed in relation to any of the individual embodiments may be incorporated into any other embodiment.
