Abstract:
A system for monitoring a clock input signal including a reference clock to be monitored, a flip-flop, a plurality of delay logic blocks, a sampling unit, and a comparison unit. The reference clock may have an expected maximum frequency. The flip-flop may be configured to generate a corresponding clock signal at a reduced frequency compared to the reference clock. The plurality of delay logic blocks may be configured to receive the reduced frequency clock signal and delay the signal for various amounts of time, each less than an expected period of the reference clock. The sampling unit may be configured to sample the signals output from the plurality of delay logic blocks. The comparison unit may be configured to receive the outputs of the flip-flop and the sampling unit and use these outputs to determine if the reference clock is running at an acceptable frequency compared to the expected frequency.
Abstract:
A method and system are described for reducing latency in a peripheral component interconnect express (PCIe) link between a host and an endpoint. In the described embodiments, an interrupt is issued from the endpoint to the host using the PCIe link. Then, while the interrupt is pending at the host, the PCIe link is prevented from entering a power-saving mode with an exit latency greater than a predetermined time period.
Abstract:
In an embodiment, a peripheral interface controller may include an inline cryptographic engine which may encrypt data being sent over a peripheral interface and decrypt data received from the peripheral interface. The encryption may be transparent to the device connected to the peripheral interface that is receiving/supplying the data. In an embodiment, the peripheral interface controller is included in a system on a chip (SOC) that also includes a memory controller configured to couple to a memory. The memory may be mounted on the SOC in a chip-on-chip or package-on-package configuration. The unencrypted data may be stored in the memory for use by other parts of the SOC (e.g. processors, on-chip peripherals, etc.). The keys used for the encryption/decryption of data may remain within the SOC.
Abstract:
In an embodiment, a system is provided in which the private key is managed in hardware and is not visible to software. The system may provide hardware support for public key generation, digital signature generation, encryption/decryption, and large random prime number generation without revealing the private key to software. The private key may thus be more secure than software-based versions. In an embodiment, the private key and the hardware that has access to the private key may be integrated onto the same semiconductor substrate as an integrated circuit (e.g. a system on a chip (SOC)). The private key may not be available outside of the integrated circuit, and thus a nefarious third party faces high hurdles in attempting to obtain the private key.
Abstract:
Embodiments of an apparatus and method are disclosed that may allow for managing power of a computing system. The apparatus may include a clock generation circuit, a bus interface unit, and a control circuit. The clock generation circuit may be configured to generate multiple clock signals. Each clock signal may provide a timing reference to different functional blocks within a device coupled to the communication bus. The bus interface unit may be configured to receive messages from the device via the communication bus. The messages may include a latency value and a request to activate a low power mode. The control circuit may be configured to deactivate one or more of the multiple clock signals dependent upon the latency value and multiple threshold values.
Abstract:
A method and apparatus for protecting boot variables is disclosed. A computer system includes a main processor and an auxiliary processor. The auxiliary processor includes a non-volatile memory that stores variables associated with boot code that is also stored thereon. The main processor may send a request to the auxiliary processor to alter one of the variables stored in the non-volatile memory. Responsive to receiving the request, the auxiliary processor may execute a security policy to determine if the main processor meets the criteria for altering the variable. If the auxiliary processor determines that the main processor meets the criteria, it may grant permission to alter the variable.
Abstract:
A system and method for detecting replay attacks on secure data are disclosed. A system on a chip (SOC) includes a security processor. Blocks of data corresponding to sensitive information are stored in off-chip memory. The security processor uses an integrity data structure, such as an integrity tree, for the blocks. The intermediate nodes of the integrity tree use nonces which have been generated independent of any value within a corresponding block. By using only the nonces to generate tags in the root at the top layer stored in on-chip memory and the nodes of the intermediate layers stored in off-chip memory, an amount of storage used is reduced for supporting the integrity tree. When the security processor detects events which create access requests for one or more blocks, the security processor uses the integrity tree to verify a replay attack has not occurred and corrupted data.
Abstract:
An apparatus, a method, and a system are presented in which the apparatus includes an interface control circuit that may be configured to receive a message including a cryptographic keyword and a policy value. The policy value may include one or more data bits indicative of one or more policies that define allowable usage of the cryptographic keyword. The apparatus also includes a security circuit that may be configured to extract the cryptographic keyword and the policy value from the message, and to apply at least one policy of the one or more policies to usage of the cryptographic keyword in response to a determination that an authentication of the message succeeded.
Abstract:
An apparatus, a method, and a system are presented in which the apparatus includes an interface control circuit that may be configured to receive a message including a cryptographic keyword and a policy value. The policy value may include one or more data bits indicative of one or more policies that define allowable usage of the cryptographic keyword. The apparatus also includes a security circuit that may be configured to extract the cryptographic keyword and the policy value from the message, and to apply at least one policy of the one or more policies to usage of the cryptographic keyword in response to a determination that an authentication of the message succeeded.
Abstract:
An apparatus, a method, and a system are presented in which the apparatus includes an interface control circuit that may be configured to receive a message including a cryptographic keyword and a policy value. The policy value may include one or more data bits indicative of one or more policies that define allowable usage of the cryptographic keyword. The apparatus also includes a security circuit that may be configured to extract the cryptographic keyword and the policy value from the message, and to apply at least one policy of the one or more policies to usage of the cryptographic keyword in response to a determination that an authentication of the message succeeded.