Security device with programmable systolic-matrix cryptographic module and programmable input/output interface

• US 9,317,718 B1
• Filed: 02/11/2014
• Issued: 04/19/2016
• Est. Priority Date: 03/29/2013
• Status: Active Grant

• Current Assignee: Secturion Systems, Inc.
• Original Assignee: Secturion Systems, Inc.
• Inventors: Takahashi, Richard J.
• Primary Examiner(s): Pearson, David
• Application Number:
  US14/177,392
• Time in Patent Office: 798 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up

Abstract

A system includes programmable systolic cryptographic modules for security processing of packets from a data source. A first programmable input/output interface routes each incoming packet to one of the systolic cryptographic modules for encryption processing. A second programmable input/output interface routes the encrypted packets from the one systolic cryptographic module to a common data storage. In one embodiment, the first programmable input/output interface is coupled to an interchangeable physical interface that receives the incoming packets from the data source. In another embodiment, each cryptographic module includes a programmable systolic packet input engine, a programmable cryptographic engine, and a programmable systolic packet output engine, each configured as a systolic array (e.g., using FPGAs) for data processing.

Claims

1. A system, comprising:

a plurality of cryptographic computing devices, each cryptographic device comprising at least one processor and at least one memory, each cryptographic device configured to perform security processing, and each cryptographic device comprising a programmable systolic packet input engine, a programmable systolic cryptographic engine, and a programmable systolic packet output engine;

wherein the packet input engine, the cryptographic engine, and the packet output engine each are configured as a systolic-matrix array and include a respective field-programmable gate array (FPGA);

wherein the packet input engine comprises a systolic array configured for packet routing, and the cryptographic engine comprises a systolic array configured for cryptographic functions;

each cryptographic device further comprising a plurality of additional FPGAs configured as a top layer in a two-dimensional systolic array to support the security processing, wherein a first FPGA of the additional FPGAs is coupled to the packet input engine, a second FPGA of the additional FPGAs is coupled to the cryptographic engine, and a third FPGA of the additional FPGAs is coupled to the packet output engine;

an interchangeable physical interface configured to receive a plurality of incoming packets from a data source;

a first programmable input/output interface, comprising an FPGA, coupled to the interchangeable physical interface, configured to route each of the plurality of incoming packets to one of the cryptographic devices for encryption to provide a plurality of encrypted packets; and

a second programmable input/output interface, comprising an FPGA, configured to route the encrypted packets to a common data storage.

2. The system of claim 1, wherein each of the encrypted packets has a respective tag to identify an entry port, each of the encrypted packets is decrypted by one of the cryptographic devices to provide corresponding decrypted packets, and the first programmable input/output interface is further configured to use the respective tag to route each decrypted packet to the entry port of its corresponding encrypted packet.

3. The system of claim 1, wherein the second programmable input/output interface is the first programmable input/output interface.

4. The system of claim 1, wherein the first programmable input/output interface is programmable to support different interface protocols, and each of the plurality of cryptographic devices is programmable to support different encryption protocols.

5. The system of claim 1, wherein the interchangeable physical interface is configurable to support two different physical interfaces.

6. The system of claim 5, wherein the interchangeable physical interface comprises a replaceable physical input/output panel that can be replaced independently of the first programmable input/output interface and the plurality of cryptographic devices.

7. The system of claim 1, wherein the FPGA of the cryptographic engine is programmable to support different security protocols.

8. The system of claim 7, wherein the packet input engine, the cryptographic engine, and the packet output engine are each coupled to a respective dedicated program memory for the respective FPGA, and to a respective dedicated processor to control programming of the respective FPGA.

9. The system of claim 1, wherein the FPGA of the first programmable input/output interface is programmable to support different interface protocols.

10. The system of claim 1, wherein the first programmable input/output interface and the second programmable input/output interface each comprise a switching network and a router to route incoming packets to one of the cryptographic devices.

11. The system of claim 1, wherein each of the plurality of cryptographic devices comprises an internal key manager coupled via an application program interface (API) to an external key manager, and wherein keys received via the API are stored in a key cache for use by the cryptographic devices during encryption of incoming packets.

12. The system of claim 11, further comprising a control plane processor configured to control systolic data flow for the cryptographic devices, and to control loading of the keys from the API to the key cache.

13. The system of claim 11, wherein each of the incoming packets includes a key tag to identify at least one key associated with the packet, and further includes a source tag to identify a data source for the packet, and wherein the internal key manager is configured to retrieve the keys from the key cache using the key tag for a packet to be processed by the respective cryptographic device.

14. The system of claim 13, wherein the first programmable input/output interface is further configured to route an incoming packet to one of the plurality of cryptographic devices based on the source tag, and wherein each of the plurality of cryptographic devices is physically partitioned from the other of the cryptographic devices.

15. The system of claim 1, wherein the plurality of cryptographic devices is configured using at least two systolic layers for processing of packets.

16. A method, comprising:

receiving, by an interchangeable physical interface, a plurality of incoming packets from a data source;

routing, by a first programmable input/output interface coupled to the interchangeable physical interface, the plurality of incoming packets to a first device of a plurality of cryptographic computing devices, each cryptographic device comprising at least one processor and at least one memory, each cryptographic device configured to perform security processing, and each cryptographic device comprising a programmable systolic packet input engine, a programmable systolic cryptographic engine, and a programmable systolic packet output engine;

wherein the packet input engine, the cryptographic engine, and the packet output engine each are configured as a systolic-matrix array and include a respective field-programmable gate array (FPGA);

wherein the packet input engine comprises a systolic array configured for packet routing, and the cryptographic engine comprises a systolic array configured for cryptographic functions;

each cryptographic device further comprising a plurality of additional FPGAs configured as a top layer in a two-dimensional systolic array to support the security processing, wherein a first FPGA of the additional FPGAs is coupled to the packet input engine, a second FPGA of the additional FPGAs is coupled to the cryptographic engine, and a third FPGA of the additional FPGAs is coupled to the packet output engine;

encrypting the incoming packets using the first device to provide a plurality of encrypted packets; and

routing, by a second programmable input/output interface, the plurality of encrypted packets to a common data storage.

17. The method of claim 16, wherein:

the first programmable input/output interface comprises a fourth FPGA, the method further comprising programming the fourth FPGA to support a different interface protocol; and

the method further comprising programming the FPGA of the packet input engine, the FPGA of the cryptographic engine, and the FPGA of the packet output engine.

18. A system, comprising:

a plurality of cryptographic computing devices, each cryptographic device comprising at least one processor and at least one memory, each cryptographic device configured to perform security processing, and each cryptographic device comprising a programmable systolic packet input engine, a programmable systolic cryptographic engine, and a programmable systolic packet output engine;

wherein the packet input engine, the cryptographic engine, and the packet output engine each are configured as a systolic-matrix array and include a field-programmable gate array (FPGA);

wherein the packet input engine comprises a systolic array configured for packet routing, and the cryptographic engine comprises a systolic array configured for cryptographic functions;

each cryptographic device further comprising a plurality of additional FPGAs configured as a top layer in a two-dimensional systolic array to support the security processing, wherein a first FPGA of the additional FPGAs is coupled to the packet input engine, a second FPGA of the additional FPGAs is coupled to the cryptographic engine, and a third FPGA of the additional FPGAs is coupled to the packet output engine;

a first programmable input/output interface, comprising memory, configured to route each of a plurality of incoming packets to one of the cryptographic devices for encryption to provide a plurality of encrypted packets; and

a second programmable input/output interface, comprising memory, configured to route the encrypted packets to an internal or external common data storage.