Network on chip (noc) memory addressable encryption and authentication

Patent metadata

Field	Value
Publication number	US-2025007724-A1
Application number	US-202318215140-A
Country	US
Kind code	A1
Filing date	Jun 27, 2023
Priority date	Jun 27, 2023
Publication date	Jan 2, 2025
Grant date	—

Abstract

Techniques for network-on-chip (NoC) memory addressable encryption and authentication. In an embodiment, NoC circuitry includes NoC routing circuitry, memory circuitry that stores a security parameter, and security circuitry that secures (e.g., encrypts and/or authenticates) a payload based on the security parameter. The security circuitry may secure the payload before the payload is packetized for transmission through the NoC, after the payload is de-packetized for output to an endpoint, or as the payload transits the NoC. The security circuitry may be centralized or distributed amongst access points of the NoC. Distributed security circuitry may exchange a security parameter over a secure link of the NoC circuitry. The security circuitry may include decryption circuitry that decrypts a response from a first endpoint before the response is packetized for transmission through the NoC, after the response is de-packetized for output to a second endpoint, or as the response transits the NoC.

First claim

What is claimed is:

1 . An integrated circuit (IC) device, comprising:
network-on-chip (NoC) circuitry configured to provide a packet-switched NoC, wherein the NoC circuitry comprises,
NoC routing circuitry,
security circuitry configured to secure a first payload based on a security parameter, and
a first input/output (IO) circuit configured to interface between the NoC routing circuitry and a first endpoint of the packet-switched NoC, including to output the secured first payload to the first endpoint.

2 . The IC device of claim 1 , wherein
the security circuitry is further configured to secure the first payload before the first payload is packetized for transmission through the packet-switched NoC, after the first payload is de-packetized by the first IO circuit, or as the first payload transits the packet-switched NoC.

3 . The IC device of claim 1 , wherein the security parameter comprises a one or more of a cryptographic parameter and an authentication parameter, and wherein the security circuitry comprises one or more of:
encryption circuitry configured to secure the first payload by encrypting the first payload based on the cryptographic parameter; and authentication circuitry configured to secure the first payload by computing a signature of the first payload and authenticating the signature based on the authentication parameter.

4 . The IC device of claim 1 , wherein:
the NoC circuitry further comprises memory configured to store the security parameter; and the security circuitry is further configured to retrieve the security parameter from the memory to secure the first payload.

5 . The IC device of claim 1 , wherein:
the first IO circuit is further configured to receive an encrypted second payload from the first endpoint; the NoC circuitry further comprises a second IO circuit configured to interface between the NoC routing circuitry and a second endpoint of the packet-switched NoC; and the security circuitry is further configured to decrypt the encrypted second payload before the encrypted second payload is packetized for transmission through the packet-switched NoC by the first IO circuit, after the encrypted second payload is de-packetized by the second IO circuit, or as the encrypted second payload transits the packet-switched NoC.

6 . The IC device of claim 1 , wherein
the first IO circuit is further configured to receive a packet containing the first payload from the NoC routing circuitry and de-packetize the first payload; and the security circuitry is further configured to secure the de-packetized first payload.

7 . The IC device of claim 1 , wherein
the NoC circuitry further comprises a second IO circuit configured to interface between the NoC routing circuitry and a second endpoint of the packet-switched NoC, including to receive the first payload from the second endpoint; the security circuitry is further configured to secure the first payload received by the second IO circuit; the second IO circuit is further configured to packetize the secured first payload and provide the packetized secured first payload to the NoC routing circuitry; and the first IO circuit is further configured to receive the packetized secured first payload from the NoC routing circuitry, de-packetize the secured first payload, and output the de-packetized secured first payload to the first endpoint.

8 . The IC device of claim 1 , wherein
the NoC circuitry further comprises a second IO circuit configured to interface between the NoC routing circuitry and the security circuitry, including to receive a packet containing the first payload from the NoC routing circuitry, de-packetize the first payload, provide the de-packetized first payload to the security circuitry, receive the secured first payload from the security circuitry, packetize the secured first payload, and provide the packetized secured first payload to the NoC routing circuitry; and the first IO circuit is further configured to receive the packetized secured first payload from the NoC routing circuitry, de-packetize the secured first payload, and output the de-packetized secured first payload to the first endpoint.

9 . The IC device of claim 1 , wherein:
the security circuitry is distributed amongst IO circuits of the NoC circuitry; and the IC device further comprises a secure communication link amongst the distributed security circuitry configured to share the security parameter amongst the distributed security circuitry.

10 . The IC device of claim 1 , wherein:
the NoC routing circuitry is configured to route all payloads to the security circuitry.

11 . The IC device of claim 1 , wherein:
the NoC routing circuitry is configured to selectively route payloads to the security circuitry based on features of the respective payloads.

12 . The IC device of claim 1 , wherein:
the security circuitry is configurable with respect to one or more of a security policy and a security protocol.

13 . An integrated circuit (IC) device, comprising:
network-on-chip (NoC) circuitry configured to provide a packet-switched NoC, wherein the NoC circuitry comprises,
NoC routing circuitry,
security circuitry configured to secure a payload of a memory access request based on a security parameter, and
a first input/output (IO) circuit configured to interface between the NoC routing circuitry and a first endpoint of the packet-switched NoC, including to output the memory access request with the secured payload to the first endpoint;
wherein the security circuitry is further configured to secure the payload of the memory access request before the memory access request is packetized for transmission through the packet-switched NoC, after the memory access request is de-packetized by the first IO circuit, or as the memory access request transits the packet-switched NoC.

14 . The IC device of claim 13 , wherein the security parameter comprises one or more of a cryptographic parameter and an authentication parameter, and wherein the security circuitry comprises one or more of:
cryptographic circuitry configured to secure the payload of the memory access request by encrypting the payload based on the cryptographic parameter, and authentication circuitry configured to secure the payload of the memory access request by computing a signature of the payload and authenticating the signature based on the authentication parameter.

15 . The IC device of claim 13 , wherein the NoC circuitry further comprises:
memory configured to store the security parameter.

16 . The IC device of claim 13 , wherein:
the first IO circuit is further configured to receive a response to the memory access request from the first endpoint; the NoC circuitry further comprises a second IO circuit configured to interface between the NoC routing circuitry and a second endpoint of the packet-switched NoC; and the security circuitry comprises one or more of,
decryption circuitry configured to decrypt a payload of the response before the response is packetized for transmission through the packet-switched NoC by the first IO circuit, after the response is de-packetized by the second IO circuit, or as the response transits the packet-switched NoC, and
authentication circuitry configured to secure the payload of the response by computing a signature of the payload of the response and authenticating the signature based on the security parameter.

17 . A method, comprising:
providing a packet-switched network-on-chip (NoC) with NoC circuitry, wherein the NoC circuitry comprises NoC routing circuitry an

Assignees

• Xilinx Inc

Inventors

• Anderson James
• Gupta Aman
• Wesselkamper James D

Classifications

• H04L9/3247 Primary

  involving digital signatures · CPC title