Method of building a firewall for networked devices

Patent metadata

Field	Value
Publication number	US-10122686-B2
Application number	US-201715499406-A
Country	US
Kind code	B2
Filing date	Apr 27, 2017
Priority date	Oct 3, 2016
Publication date	Nov 6, 2018
Grant date	Nov 6, 2018

Abstract

A device is provided to perform secure operations in a network that includes multiple devices. The device comprises multiple processor cores; multiple physical ports to receive packets; a system interconnect and a network security engine. The network security engine is operative to: extract a key from a packet received from a physical port among the physical ports; in response to a first determination that the key does not match a stored key in the device, block the packet from entering the system interconnect through the physical port; and in response to the first determination that the key matches the stored key and in response to a second determination that one or more identifiers extracted from the packet do not match stored information in the device, block the packet from entering an identified processor core among the processor cores that is to be accessed by the packet.

First claim

What is claimed is:

1. A method for secure operations of a device in a network including a plurality of devices, comprising:
extracting a key from a packet received from a physical port of the device, wherein the device includes a plurality of processor cores which are connected to the physical port via a system interconnect;
in response to a first determination that the key does not match a stored key in the device, blocking the packet from entering the system interconnect through the physical port; and
in response to the first determination that the key matches the stored key and in response to a second determination that one or more identifiers extracted from the packet do not match stored information in the device, blocking the packet from entering an identified processor core among the processor cores, wherein the one or more identifiers identify a memory location in the device, and the stored information includes a memory address range allocated to a process executed by the identified processor core for processing the packet.

2. The method of claim 1 , wherein the one or more identifiers include a process ID identifying the process for processing the packet.

3. The method of claim 1 , wherein the one or more identifiers include an address identifier identifying the memory location in the device, and wherein the second determination includes determining whether the memory location is in the memory address range.

4. The method of claim 1 , wherein the one or more identifiers include a target object identifier identifying an object allocated with the memory location.

5. The method of claim 1 , wherein the packet includes a session ID identifying a network session established between the device and a source entity that sent the packet, the method further comprising:
blocking the packet by terminating the network session identified by the session ID.

6. The method of claim 1 , wherein blocking the packet further comprises:
opening a first physical switch between the physical port and the system interconnect; or
opening a second physical switch between the identified processor core and the system interconnect.

7. The method of claim 1 , wherein the key includes a group key, the method further comprising:
broadcasting a heartbeat message at a programmable time interval to other devices in the network that share a same group key.

8. The method of claim 7 , further comprising:
in response to receipt of the heartbeat message from another device in the network sharing the same group key, re-activating disabled connections to the system interconnect from all physical ports and all of the processor cores in the device.

9. The method of claim 1 , further comprising:
changing the key to an alternative key between the device and a source entity that sent the packet; and
blocking the packet in response to the source entity not having a valid response to the alternative key.

10. A device operative to perform secure operations in a network including a plurality of devices, comprising:
a plurality of processor cores;
a plurality of physical ports to receive packets;
a system interconnect coupled to the processor cores and the physical ports; and
a network security engine coupled to the processor cores and the physical ports, the network security engine operative to:
extract a key from a packet received from a physical port among the physical ports;
in response to a first determination that the key does not match a stored key in the device, block the packet from entering the system interconnect through the physical port; and
in response to the first determination that the key matches the stored key and in response to a second determination that one or more identifiers extracted from the packet do not match stored information in the device, block the packet from entering an identified processor core among the processor cores, wherein the one or more identifiers identify a memory location in the device, and the stored information includes a memory address range allocated to a process executed by the identified processor core for processing the packet.

11. The device of claim 10 , wherein the one or more identifiers include a process ID identifying the process for processing the packet.

12. The device of claim 10 , wherein the one or more identifiers include an address identifier identifying the memory location in the device, and wherein the second determination includes determining whether the memory location is in the memory address range.

13. The device of claim 10 , wherein the one or more identifiers include a target object identifier identifying an object allocated with the memory location.

14. The device of claim 10 , wherein the packet includes a session ID identifying a network session established between the device and a source entity that sent the packet, the network security engine is further operative to:
block the packet by terminating the network session identified by the session ID.

15. The device of claim 10 , wherein the network security engine is further operative to:
block the packet by opening a physical switch between the physical port and the system interconnect or between the identified processor core and the system interconnect.

16. The device of claim 10 , wherein the key includes a group key, the network security engine further operative to:
broadcast a heartbeat message at a programmable time interval to other devices in the network that share a same group key.

17. The device of claim 16 , wherein the network security engine is further operative to:
in response to receipt of the heartbeat message from another device in the network sharing the same group key, re-activate disabled connections to the system interconnect from all physical ports and all of the processor cores in the device.

18. The device of claim 10 , the network security engine is further operative to:
change the key to an alternative key between the device and a source entity that sent the packet; and
block the packet in response to the source entity not having a valid response to the alternative key.

19. A system operative to perform secure operations in a network, comprising:
a plurality of devices; and
a gateway coupled to the devices via the network to manage the devices;
at least one of the devices further comprising:
a plurality of processor cores;
a plurality of physical ports to receive packets;
a system interconnect coupled to the processor cores and the physical ports; and
a network security engine coupled to the processor cores and the physical ports, the network security engine operative to:
extract a key from a packet received from a physical port among the physical ports, wherein the key includes a group name identifying a group of the devices;
in response to a first determination that the key does not match a stored key in the device, block the packet from entering the system interconnect through the physical port; and
in response to the first determination that the key matches the stored key and in response to a second determination that one or more identifiers extracted from the packet do not match stored information in the device, block the packet from entering an identified processor core among the processor cores, wherein the one or more identifiers identify a memory location in the at least one device, and the stored information includes a memory address range allocated to a process executed by the identified processor core for processing the packet.

20. The system of cl

Assignees

• Mediatek Inc

Inventors

• Li Hungwen

Classifications

• H04L63/0245 Primary

  Filtering by information in the payload · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04W12/08

  Access security · CPC title

• H04W12/06

  Authentication · CPC title