Secure data communication over a memory-mapped serial communications interface utilizing a distributed firewall

• US 6,212,633 B1
• Filed: 06/26/1998
• Issued: 04/03/2001
• Est. Priority Date: 06/26/1998
• Status: Expired due to Term

• Current Assignee: VLSI Technology LLC (SoftBank Group Corp.)
• Original Assignee: VLSI Technology, Inc. (Koninklijke Philips N.V.)
• Inventors: Cornelius, Steve, Levy, Paul S.
• Primary Examiner(s): Swann, Tod
• Assistant Examiner(s): Sulpizio, Jr., Ronald F.
• Application Number:
  US09/105,285
• Time in Patent Office: 1,012 Days
• Field of Search: 713/201, 713/189, 713/152, 713/153, 713/154, 713/151, 709/228, 709/229, 380/283
• US Class Current: 713/153
• CPC Class Codes: H04L 12/40104 Security; Encryption; Content protection cryptographic protocols H04L9/00; protocols for network security H04L63/00
• CPC Class Codes: H04L 12/40117 Interconnection of audio or video/imaging devices home automation networks H04L12/2803; bitstream network arrangements specially adapted for distribution of digital video signals H04N7/24
• CPC Class Codes: H04L 12/40123 Interconnection of computers and peripherals printer information exchange with computer G06F3/1293
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A distributed firewall is utilized in conjunction with a memory-mapped serial communications interface such as that defined by the IEEE 1394 specification to permit secure data transmission between selected nodes over the interface. The distributed firewall incorporates security managers in the selected nodes that are respectively configured to control access to their associated nodes, thereby restricting access to such nodes to only authorized entities. Furthermore, encrypted transmissions may be supported to restrict unauthorized viewing of data transmitted between the selected nodes over the interface. Implementation of the distributed firewall does not modify any critical specifications for the memory-mapped communications interface that would prevent the selected nodes from residing on the same interface as other nodes that adhere to such specifications but that do not support secure data transmission.

Claims

1. A data processing system, comprising:

(a) a plurality of nodes including at least first and second nodes;

(b) a memory-mapped serial communications interface coupled between the plurality of nodes and supporting peer-to-peer communication therebetween; and

(c) a distributed firewall including first and second security managers respectively disposed in the first and second nodes, the first and second security managers respectively configured to control access to the first and second nodes from the communications interface, and wherein the first security manager is configured to locally generate for the first node an authorization list of authorized nodes with which communication is authorized for the first node.

2. The data processing system of claim 1, wherein the first and second nodes are respectively disposed in first and second electronic devices, and wherein the first security manager is disposed in a first integrated circuit in the first electronic device.

3. The data processing system of claim 2, wherein the first integrated circuit device implements at least one of a physical layer and a link layer for the communications interface.

4. The data processing system of claim 3, wherein the first security manager is implemented in the physical layer for the communications interface.

5. The data processing system of claim 3, wherein the first security manager is implemented in the link layer for the communications interface.

6. The data processing system of claim 1, wherein each security manager includes an encryption engine configured to selectively encrypt packets of data transmitted from the node associated therewith, and to selectively decrypt packets of data received from the communications interface.

7. The data processing system of claim 6, wherein each security manager further includes:

(a) an authorization list of authorized nodes from the plurality of nodes for which communication therewith is authorized; and

(b) a key exchange engine configured to generate a session key for the node associated therewith.

8. The data processing system of claim 7, wherein the authorization list is dynamically generated, and wherein each security manager is configured to transmit the session key therefor to each authorized node.

9. The data processing system of claim 6, wherein the first node is assigned a segment of memory addresses for the communications interface, the segment of memory addresses including secure and unsecure portions thereof, and wherein the first security manager is configured to control access only to the secure portion of the segment of memory addresses for the first node.

10. The data processing system of claim 1, wherein the communications interface is an IEEE 1394-compatible interface.

11. The data processing system of claim 1, wherein the first node is a self-directed node, and wherein the first security manager is configured to dynamically generate the authorization list for the first node using a third party certification.

12. The data processing system of claim 1, wherein the first node is an interactive node, and wherein the first security manager is configured to generate the authorization list for the first node by requesting authorization for given nodes using an external resource.

13. The data processing system of claim 1, wherein the first node is a trusted node and the second node is a directed node, and wherein the second security manager is configured to generate an authorization list of authorized nodes with which communication is authorized for the second node by retrieving at least one authorized node from the trusted node.

14. A circuit arrangement for interfacing an electronic device to a memory-mapped serial communications interface of the type that supports peer-to-peer communications between a plurality of nodes, the circuit arrangement comprising:

(a) a communications port configured to couple a local node in the electronic device to the communications interface; and

(b) a security manager configured to control access to the local node through the communications port to restrict communication with the local node to only authorized nodes from the plurality of nodes, the first security manager further configured to locally generate for the local node an authorization list of authorized nodes with which communication is authorized for the local node.

15. The circuit arrangement of claim 14, wherein the circuit arrangement is disposed in an integrated circuit device.

16. The circuit arrangement of claim 15, wherein the integrated circuit device implements at least one of a physical layer and a link layer for the communications interface.

17. The circuit arrangement of claim 16, wherein the security manager is implemented in the physical layer for the communications interface.

18. The circuit arrangement of claim 16, wherein the security manager is implemented in the link layer for the communications interface.

19. The circuit arrangement of claim 14, wherein the security manager includes an encryption engine configured to selectively encrypt packets of data transmitted from the local node, and to selectively decrypt packets of data received from the communications interface.

20. The circuit arrangement of claim 19, wherein the security manager further includes a key exchange engine configured to generate a session key for the local node.

21. The circuit arrangement of claim 20, wherein the authorization list is dynamically generated, and wherein the security manager is configured to transmit the session key therefor to each authorized node.

22. The circuit arrangement of claim 19, wherein the local node is assigned a segment of memory addresses for the communications interface, the segment of memory addresses including secure and unsecure portions thereof, and wherein the security manager is configured to control access only to the secure portion of the segment of memory addresses for the local node.

23. The circuit arrangement of claim 14, wherein the communications interface is an IEEE 1394-compatible interface.

24. An electronic device including the circuit arrangement of claim 14.

25. A data processing system comprising the circuit arrangement of claim 14.

26. A program product, comprising:

(a) a hardware definition program that defines the circuit arrangement of claim 14; and

(b) a signal bearing media bearing the hardware definition program.

27. The program product of claim 26, wherein the signal bearing media is transmission type media.

28. The program product of claim 26, wherein the signal bearing media is recordable media.

29. A method of controlling access to first and second nodes from a plurality of nodes coupled to one another over a memory-mapped serial communications interface of the type supporting peer-to-peer communications between the plurality of nodes, the method comprising:

(a) controlling access to the first node using a first security manager disposed in the first node;

(b) controlling access to the second node using a second security manager disposed in the second node, wherein the first and second security managers define a distributed firewall for the communications interface;

(c) generating for the first node a first authorization list of authorized nodes from the plurality of nodes for which communication with the first node is authorized;

(d) generating for the second node a second authorization list of authorized nodes from the plurality of nodes for which communication with the second node is authorized; and

(e) updating the first and second authorization lists in response to at least one of adding a node to and removing a node from the communications interface.

30. The method of claim 29, wherein generating the first and second authorization lists is performed in response to a reset of the communications interface.

31. The method of claim 29, further comprising:

(a) generating a session key for the first node, the session key for use by an encryption engine at an authorized node from the first authorization list when encrypting data to be transmitted to the first node; and

(b) transmitting the session key to an authorized node in the first authorization list.

32. A method of controlling access to first and second nodes from a plurality of nodes coupled to one another over a memory-mapped serial communications interface of the type supporting peer-to-peer communications between the plurality of nodes, the method comprising:

(a) controlling access to the first node using a first security manager disposed in the first node;

(b) controlling access to the second node using a second security manager disposed in the second node, wherein the first and second security managers define a distributed firewall for the communications interface;

(c) generating for the first node a first authorization list of authorized nodes from the plurality of nodes for which communication with the first node is authorized;

(d) obtaining an isochronous channel for the first node;

(e) generating a isochronous session key in the first node; and

(f) transmitting the isochronous session key to the authorized nodes in the first authorization list that are configured to receive the isochronous channel.

33. The method of claim 32, wherein transmitting the isochronous session key is performed via an asynchronous data transmission.

34. A data processing system, comprising:

(a) a plurality of nodes including at least first and second nodes;

(b) a memory-mapped serial communications interface coupled between the plurality of nodes and supporting peer-to-peer communication therebetween; and

(c) a distributed firewall including first and second security managers respectively disposed in the first and second nodes, the first and second security managers respectively configured to control access to the first and second nodes from the communications interface, wherein the first node is assigned a segment of memory addresses for the communications interface, the segment of memory addresses including secure and unsecure portions thereof, and wherein the first security manager is configured to control access only to the secure portion of the segment of memory addresses for the first node.

35. A circuit arrangement for interfacing an electronic device to a memory-mapped serial communications interface of the type that supports peer-to-peer communications between a plurality of nodes, the circuit arrangement comprising:

(a) a communications port configured to couple a local node in the electronic device to the communications interface; and

(b) a security manager configured to control access to the local node through the communications port to restrict communication with the local node to only authorized nodes from the plurality of nodes, wherein the local node is assigned a segment of memory addresses for the communications interface, the segment of memory addresses including secure and unsecure portions thereof, and wherein the security manager is configured to control access only to the secure portion of the segment of memory addresses for the local node.

36. A method of controlling access to first and second nodes from a plurality of nodes coupled to one another over a memory-mapped serial communications interface of the type supporting peer-to-peer communications between the plurality of nodes, the method comprising:

(a) controlling access to the first node using a first security manager disposed in the first node, wherein the first node is assigned a segment of memory addresses for the communications interface, the segment of memory addresses including secure and unsecure portions thereof, and wherein the first security manager is configured to control access only to the secure portion of the segment of memory addresses for the first node; and

(b) controlling access to the second node using a second security manager disposed in the second node, wherein the first and second security managers define a distributed firewall for the communications interface.