NETWORK ON CHIP (NOC) MEMORY ADDRESSABLE ENCRYPTION AND AUTHENTICATION

Techniques for network-on-chip (NoC) memory addressable encryption and authentication. In an embodiment, NoC circuitry includes NoC routing circuitry, memory circuitry that stores a security parameter, and security circuitry that secures (e.g., encrypts and/or authenticates) a payload based on the security parameter. The security circuitry may secure the payload before the payload is packetized for transmission through the NoC, after the payload is de-packetized for output to an endpoint, or as the payload transits the NoC. The security circuitry may be centralized or distributed amongst access points of the NoC. Distributed security circuitry may exchange a security parameter over a secure link of the NoC circuitry. The security circuitry may include decryption circuitry that decrypts a response from a first endpoint before the response is packetized for transmission through the NoC, after the response is de-packetized for output to a second endpoint, or as the response transits the NoC.

TECHNICAL FIELD

Examples of the present disclosure generally relate to network-on-chip (NoC) memory addressable encryption and authentication.

BACKGROUND

An integrated circuit (IC) device may include a packet-switched network-on-chip (NoC) that permits endpoints of the NoC (e.g., circuit blocks, processors, and/or memory) to communicate with one another. A communication link between the NoC and an endpoint may be vulnerable, such as when the endpoint is an external endpoint. Examples include external double data rate (DDR) memory and network interface controllers (NICs), and external endpoints linked to the NoC via a peripheral component interconnect express (PCIe) link.

SUMMARY

Techniques for network-on-chip (NoC) memory addressable encryption and authentication are described. One example is an integrated circuit (IC) device that includes network-on-chip (NoC) circuitry that provides a packet-switched NoC. The NoC circuitry includes NoC routing circuitry, security circuitry that secures a payload based on a security parameter, and an input/output (IO) circuit that interfaces between the NoC routing circuitry and a an endpoint of the packet-switched NoC to output the secured payload to the endpoint. The security parameter may include a cryptographic parameter, an authentication parameter, and/or other security parameter(s).

Another example described herein is an IC device that includes NoC circuitry configured to provide a packet-switched NoC. The NoC circuitry includes routing circuitry, security circuitry that secures a payload of a memory access request based on a security parameter, and an IO circuit that interfaces between the NoC routing circuitry and an endpoint of the packet-switched NoC to output the memory access request with the secured payload request to the endpoint. The security parameter may include a cryptographic parameter, an authentication parameter, and/or other security parameter(s). The security circuitry may secure the payload of the memory access request before the memory access request is packetized for transmission through the packet-switched NoC, after the memory access request is de-packetized by the IO circuit, or as the memory access request transits the packet-switched NoC.

Another example described herein is method that includes providing a packet-switched network-on-chip (NoC) with NoC circuitry, where the NoC circuitry include NoC routing circuitry and security circuitry. The method further includes securing a payload with the security circuitry based on a security parameter, before the payload is packetized for transmission through the packet-switched NoC, after the payload is de-packetized for output to a first endpoint of the packet-switched NoC, or as the payload transits the packet-switched NoC. The security parameter may include a cryptographic parameter, an authentication parameter, and/or other security parameter(s).

DETAILED DESCRIPTION

Embodiments herein describe techniques for network-on-chip (NoC) memory addressable encryption and authentication.

Embodiments herein include solutions to encrypt and/or authenticate data as the data enters a NoC, as the data exits the NoC, and as the data transits the NoC. Embodiments herein may be useful to secure (e.g., encrypt and/or authenticate) data communicated through the NoC, at any access point of the NoC. The data may be secured while in transit, while in storage, and external to an IC device on which the NoC is implemented, and including response data provided back to the NoC, all while flexibly using the NoC topology to move data efficiently and with performance.

Embodiments herein may be useful to permit various cryptographic and authentication algorithms (i.e., parameters, protocols, and/or policies) including, post quantum crypto algorithms.

Embodiments herein may utilize a dedicated silicon area of NoC circuitry, may permit access for encryption and/or and authentication without impacting an external physical (PHY) interface, which may be useful to permit a user/developer to close timing on a network interface completely within the NoC circuitry, while providing flexible/configurable encryption and authentication polices and protocols.

FIG.1Ais a block diagram of an integrated circuit (IC) device100that includes network-on-chip (NoC) circuitry102that secures (e.g., encrypts and/or authenticates) payloads (e.g., data) within a packet-switched NoC103, according to an embodiment. NoC circuitry102may be designed as a stand-alone block of circuitry that can be incorporated into various IC devices by an electronic design automation tool (i.e., a pre-designed/tested circuit block to provide a secure packet-switched NoC).

Endpoints106-1through106-n (collectively, endpoints106), communicate with one another over packet-switched NoC103. Endpoints106may include functional circuitry, subsystems, and/or devices. An endpoint106may include, for example, fixed-function circuitry, configurable/programmable circuitry, an embedded processor, and/or memory (e.g., dynamic random access memory, or DRAM). In the example ofFIG.1A, endpoint106-4is illustrated as an external or off-device endpoint (e.g., a memory device or host system), and remaining ones of endpoints106are illustrated as internal or on-device endpoints. IC device100is not limited to the foregoing examples.

IC device100may represent an IC die, and endpoints106, or a subset thereof, may represent respective blocks of circuitry of the die. Alternatively, IC device100may represent a multi-die package and endpoints106, or a subset thereof, may represent respective dies/chiplets of the multi-die package.

NoC circuitry102includes NoC routing circuitry104that routes packetized communications (e.g., payloads and associated routing information/headers) amongst endpoints106-1through106-n (collectively, endpoints106).FIG.2is a block diagram of IC device100in which NoC routing circuitry104includes NoC packet switches (NPSs)202-1through202-k (collectively, NPSs202) and interconnections204, according to an embodiment.

InFIG.1A, NoC circuitry102further includes input/output (IO) circuits108-1through108-n (collectively, IO circuits108) that interface between NoC routing circuitry104and respective endpoints106. IO circuits108serve as access points to packet-switched NoC103. IO circuits108may packetize and/or de-packetize communications between packet-switched NoC103and respective endpoints106. In the example ofFIG.1A. IO circuits108are illustrated as bi-directional IO circuits. Alternatively, one or more of IO circuits108may be a unidirectional IO circuit that provides communications to or from packet-switched NoC103. IO circuits108may convert between a NoC packet protocol (NPP) of packet-switched NoC103, and a protocol(s) of endpoints106. Example embodiments of IO circuits108are provided further below with reference toFIGS.3and4.

NoC circuitry102further security circuitry114that secures (e.g., encrypts and/or authenticates) payloads based on a security parameter(s)112, before the payload is provided to an endpoint106. Security circuitry114may secure the payload as the payload enters packet-switched NoC103through an IO circuit108, as the payload exits packet-switched NoC103through an IO circuit108, and/or as the payload transits packet-switched NoC103. Security parameter(s)112may include, without limitation, cryptographic and/or authentication parameters, protocols, and/or policies, such as cryptographic keys, authentication signatures, tags.

In an embodiment, security circuitry114receives security parameter(s)112via a communication path116(e.g., from external memory or from a management system). In an embodiment, security circuitry114receives security parameter(s)112over communication path116as needed (i.e., without storing security parameter(s)112for later/subsequent use). Alternatively, NoC circuitry102includes memory110, and security parameter(s)112are stored in memory110of NoC circuitry102. Memory110may be specifically allocated to security circuitry114. Memory110may, for example, include access-controls to limit access to parameter(s)112(e.g., to preclude access via packet-switched NoC103). The access controls may permit security circuitry to114write security parameter(s)112to, and read security parameter(s)112from memory110. Alternatively, the access controls may permit a management system to write security parameter(s)112to memory110, and permit security circuitry to114to read security parameter(s)112from memory110.

Security circuitry114may secure (e.g., encrypt and/or authenticate) all payloads transmitted through packet-switched NoC103, or may secure selected payloads based on properties or information associated with the payloads. For example, and without limitation, NoC routing circuitry104may route all payloads to security circuitry114, or may selectively route payloads to security circuitry114based on an originating address of the payload, a destination address of the payload, and/or other properties of the payload.

FIG.1Bis a block diagram of security circuitry114, according to an embodiment. In the example ofFIG.1B, security circuitry114includes cryptographic circuitry140-1and authentication circuitry140-4. Cryptographic circuitry140-1may include encryption circuitry140-2and/or decryption circuitry140-3. In other embodiments, encryption circuitry140-2, decryption circuitry140-3, and/or authentication circuitry140-4are omitted. Security circuitry114may include one or more other types of circuitry, such as error detection and/or error correction circuitry.

Encryption circuitry140-2encrypts a payload based on a cryptographic parameter112-1(e.g., a tag, a key, and/or a hash value/index), before the payload is transmitted to a destination endpoint106. The payload is thus encrypted as it travels from packet-switched NoC to the destination endpoint106. Encryption prior to transmission may be useful where a link between packet-switched NoC103and the destination endpoint is potentially vulnerable or untrusted, such as where the destination endpoint is off-chip or off-device. Encryption circuitry114-2may encrypt a payload as the payload enters packet-switched NoC103through an IO circuit108, as the payload exits packet-switched NoC103through an IO circuit108, and/or as the payload transits packet-switched NoC103.

Decryption circuitry140-3decrypts an encrypted payload based on cryptographic parameter112-1, before the payload is transmitted to a destination endpoint106. For example, where endpoint106-1issues a read request to endpoint106-3, endpoint106-3may return encrypted read data. In this situation, decryption circuitry114-3decrypts the read data prior to transmission of the read data to a destination endpoint106(e.g., endpoint106-1and/or other endpoint106). Decryption prior to transmission to a destination endpoint106may be useful where a link between packet-switched NoC103and the destination endpoint106is a trusted link. Decryption prior to transmission may also be useful to avoid sharing cryptographic parameter112-1with the destination endpoint106. Decryption prior to transmission may also be useful where the destination endpoint106lacks decryption circuitry and/or to avoid adding decryption circuitry to all endpoints, even endpoints connected via trusted links.

Decryption circuitry114-3may decrypt a payload as the payload enters packet-switched NoC103through an IO circuit108, as the payload exits packet-switched NoC103through an IO circuit108, and/or as the payload transits packet-switched NoC103. Decryption circuitry114-3may decrypt a payload at a location at which encryption circuitry114-2encrypts payloads and/or at another location(s). Where decryption circuitry114-3decrypts a payload at a location(s) other than a location at which encryption circuitry114-2encrypts payloads, encryption circuitry114-2may share cryptographic parameter112-1with decryption circuitry114-3over secure a secure link, such as described below with reference toFIG.1C.

NoC routing circuitry104may route an encrypted payload to decryption circuitry114-3based on properties or information associated with the payload. For example, and without limitation, NoC routing circuitry104may selectively route a payload to decryption circuitry114-3based on an originating address of the payload, a destination address of the payload, and/or other properties of the payload.

Authentication circuitry140-4authenticates or verifies a payload based on an authentication parameter112-2(e.g., an authentication signature or hash value/index). Authentication circuitry140-4may compute a signature (e.g., a hash) of a payload, and may verify the signature based on authentication parameter112-2. Authentication circuitry140-4may compute the signature of an encrypted payload and/or an unencrypted payload. Authentication circuitry140-4may be utilized alone and/or in combination with cryptographic circuitry114-1. Authentication circuitry140-4may authenticate a payload at a location at which encryption circuitry114-1encrypts payloads and/or at another location(s).

In an embodiment, security circuitry114is configurable based on configuration parameters (e.g., protocols and/or policies), which may be received from a management system over communication path116. The configuration parameters (e.g., protocols and/or policies) may include cryptographic and/or authentication methods/algorithms to be employed by security circuitry114. The configuration parameters may include security parameter(s)112.

In an embodiment, security circuitry114(and memory110, when included) is centralized, as illustrated inFIG.1A. Alternatively or additionally, security circuitry114and/or memory110are distributed amongst multiple IO circuits108, such as described below with reference toFIG.1C.FIG.1Cis a block diagram of IC device100in which IO circuits108, or a subset thereof, include respective instances of security circuitry114(and memory110, when included), according to an embodiment. In the example ofFIG.1C, communication path116is linked to the multiple instances of security circuitry114to provide security parameter(s)112to the respective instances of security circuitry114. Alternatively, or additionally, NoC circuitry102includes one/or more secondary communication channels amongst the multiple instances of security circuitry114, or a subset thereof, to permit the respective instances of security circuitry114to share or exchange security parameter(s)112with one another. The one or more secondary communication channels may be inaccessible via packet-switched NoC103(e.g., separate hardware/tracks and/or hardware-based protections).

Example embodiments of IO circuits108are provided below. In an embodiment, IO circuits108communicate with respective endpoints106using a standardized point-to-point protocol. The point-to-point protocol may include multiple channels, which may include, without limitation, a write address channel (AW), a write data channel (W), a read address channel (AR), and a read data channel (R). Where the channels are unidirectional, the channels may further include a write response channel (B) to pass write responses back to a requestor. Read responses may be returned to a requestor over the read data channel (R). Separate and independent read and write channels may be useful to support concurrent read and write operations and maximize a bandwidth of the interface. Separate address and data channels for read and write transfers may further improve bandwidth.

IO circuits108may include master and/or slave interface circuitry, which may conform to a standardized point-to-point protocol such as, without limitation, an Advanced eXtensible interface (AXI) on-chip communication bus protocol developed by ARM of Cambridge, England. For example, IO circuit108-1may include master interface circuitry that permits endpoint106-1(e.g., a processor) to initiate communications (e.g., a memory access request) with endpoint106-3(e.g., memory). and IO circuit108-3may include slave interface circuitry that services requests directed to endpoint106-3. IO circuit108-1may further include slave interface circuitry that permits endpoint106-1to service requests from other endpoints106. IO circuit108-3may further include master interface circuitry that permits endpoint106-3to initiate communications with other endpoints106. Example master and slave interface circuitry are provided below with reference toFIGS.3and4, respectively. IO circuits108are not, however, limited to master and/or slave circuitry.

FIG.3is a block diagram of IO circuit108-1including a NoC master unit (NMU)300, according to an embodiment. An outgoing path, from endpoint106-1to NPS202-1, includes master interface circuitry302that interfaces with endpoint106-1. Master interface circuitry302may include an AXI master interface. The outgoing path further includes packetizing circuitry304, an address map306, a read re-tagging buffer308, quality-of-service (QoS) order control circuitry310, VC mapping circuitry312, and rate matching and asynchronous data boundary crossing circuitry314. A response path, from NPS202-1to endpoint106-1, includes rate matching and asynchronous data boundary crossing circuitry314, re-ordering circuitry316, de-packetizing circuitry318, address map306, and master interface circuitry302. IO circuit108-1may further include a NoC slave unit (NSU), such as described below with reference toFIG.4.

FIG.4is a block diagram of IO circuit108-3including a NoC slave unit (NSU)400, according to an embodiment. An incoming path, from NPS202-6to endpoint106-3, includes de-packetizing circuitry402, rate matching and asynchronous data boundary crossing circuitry404, and slave interface circuitry406that interfaces with endpoint106-3. Slave interface circuitry406may include an AXI slave interface. An outgoing path, from endpoint106-3to NPS202-6, includes slave interface circuitry406, rate matching and asynchronous data boundary crossing circuitry404, packetizing circuitry408, and QoS circuitry410. IO circuit108-3may further include a NMU.

Operation of NMU300and NSU400are described below for read and write operations initiated by endpoint106-1and directed to endpoint106-3, for illustrative purposes.

Upon receipt of a read request from endpoint106-1, NMU300packetizes the read request and forwards packetized read request to destination NSU400via NPS120-1. NMU300may perform one or more of the following functions. NMU300may perform asynchronous crossing and rate-matching (e.g., from an AXI master clock domain to a clock domain of the packet-switched NoC), destination lookup of destination NSU400, address remapping (in cases of virtualization), AXI conversion of the read request (AxAddr, AxSize, AxLen, AxBurst, AxCache) from an AxSizeMaster protocol to a AxSizeNoC protocol, read chopping, read tagging and read-reorder buffer entry insertion to keep track of out-of-order read data returns, packetizing the read request into the NPP, rate limiting and error correction code (ECC) generation, VC-mapping, VC-arbitration, and/or data bus inversion (DBI) generation.

In the example ofFIG.2, the packetized read request passes through NPSs120-1through120-6. NPS120-1may perform destination table lookup for a target output port of NPS120-1. NPS120-1may also perform least recently used (LRU) arbitration at the output port.

Upon receipt of the packetized read request, NSU400de-packetizes the read request packets and provides the de-packetized read request to endpoint106-3. NSU400may perform one or more of the following functions. NSU400may perform ECC checking and correction, AXI-ID compression and AXI exclusive access monitoring, read chopping for downsizing, read tracker entry insertion to keep track of read data interleaving, AXI conversion of the request from the NPP to a protocol of NSU400(e.g., from the AxSizeNoC protocol to a AxSizeSlave protocol), asynchronous crossing and rate-matching from the clock domain of the packet-switched NoC to an AXI slave clock domain, and conversion of the read request to a protocol for delivery to endpoint106-3.

Upon receipt of a read response from endpoint106-3, NSU400packetizes the response and forwards the packetized response to endpoint106-1via NPS120-6. NSU400may perform one or more of the following functions. NSU400may perform asynchronous crossing and rate-matching from the AXI slave clock domain to the clock domain of the packet-switched NoC, AXI conversion of the read response from the AxSizeSlave to the AxSizeNoC, re-assembly of the read data in a read tracker to match the AxSizeNoC, packetizing of the read response into the NPP of the packet-switched NoC, ECC generation, and VC-mapping and VC-arbitration.

Upon receipt of the read response packet(s), NMU300de-packetizes the read response packets and provides the de-packetized read response to endpoint106-1based on the point-to-point protocol. NMU300may perform one or more of the following functions. NMU300may perform data DBI and ECC checking. ECC correction and de-packetizing of the read response packets, re-assembly and reordering of the read data into the request order and AxSizeMaster boundary, AXI conversion of the read response data from the AxSizeNoC to the AxSizeMaster, asynchronous crossing and rate-matching from the clock domain of the packet-switched NoC to a clock domain of NMU300.

When NMU300receives a write request from endpoint106-1, NMU300packetizes the write request and forwards the packetized write request to destination NSU400via NPS120-1. NMU300may perform one or more of the following functions. NMU300may perform asynchronous crossing and rate-matching from a clock domain of NMU300to the clock domain of the packet-switched NoC, destination lookup of destination NSU400, address remapping (in cases of virtualization), AXI conversion of the write request (AxAddr, AxSize, AxLen, AxBurst, AxCache, writestrobe, and writedata) from the AxSizeMaster protocol to the AxSizeNoC protocol, write chopping. single-slave-per-id (SSID) check for outstanding write transactions with the same AXI-ID but with a different NoC destination ID (DST), write tracker entry insertion, packetizing of the write request into the NPP, rate limiting, ECC generation, VC-mapping, VC-arbitration, and DBI generation.

Upon receipt of the NPP-formatted write request packets, NSU400de-packetizes the write request packets and provides the de-packetized write request to endpoint106-3based on the point-to-point protocol. NSU400may perform one or more of the following functions. NSU400may perform de-packetizing of the write request packets, ECC checking and correction, write chopping for downsizing, write tracker entry insertion, AXI conversion of the request from the AxSizeNoC protocol to the AxSizeSlave protocol, and asynchronous crossing and rate-matching from the clock domain of the packet-switched NoC to the clock domain of NSU400.

Upon receipt of a write response (e.g., confirmation) from endpoint106-3, NSU400packetizes the write confirmation and forwards the write packets to NMU300via NPS120-6. NSU400may perform one or more of the following functions. NSU400may perform asynchronous crossing and rate-matching from the clock domain of NSU400to the clock domain of the packet-switched NoC, merge the write responses in write tracker (in cases of write chopping), packetize the write response in accordance with the NPP, generate ECC, and perform VC-mapping and VC-arbitration.

Upon receipt of the NPP-formatted write response packets, NMU300de-packetizes the write response packets and provides the de-packetized write response to endpoint106-1based on the point-to-point protocol. NMU300may perform one or more of the following functions. NMU300may perform DBI and ECC checking, ECC correction and de-packetizing, merge write responses (in cases where write chopping is performed during write requests), and asynchronous crossing and rate-matching from the clock domain of the packet-switched NoC to the clock domain of NMU300.

Example embodiments and operation of security circuitry114are provided below with reference toFIGS.5through9.FIG.5is a flowchart of a high-level method500of securing a payload of a packet-switched NoC, according to an embodiment.FIGS.6through9are directed to example applications/implementations of method500. Method500is described below with reference to IC device100, for a situation in which endpoint106-1issues a write request to endpoint106-3, and in which security circuitry114includes encryption circuitry114-2. Method500is not, however, limited to the example of IC device100, or the example situation.

At502, security circuitry114secures a payload (i.e., data to be written) of the write request based on security parameter112. Where NoC circuitry102includes memory110, security circuitry114may store the security parameter112in memory110prior to504.

Security circuitry114may encrypt and/or authenticate the payload and/or perform other security operations on the payload. Security circuitry114may encrypt and/or authenticate the payload at any point prior to endpoint106-3, examples of which are provided further below. The payload is thus secured (i.e., encrypted and/or authenticated) before the payload is output to endpoint106-3.

At504, IO circuit108-3outputs the write request containing the secured payload to endpoint106-3. Where security circuitry114encrypts the payload at502. endpoint106-3may decrypt the payload and execute the write request with respect to the decrypted payload. Endpoint106-3may be provided with cryptographic parameter112-1(e.g., from a management system). Endpoint106-3may issue a response to the write request through packet-switched NoC103, such as described further above. The response may be encrypted or unencrypted.

FIG.6is a flowchart of a method600in which security circuitry114secures the payload at or within IO circuit108-1, according to an embodiment. Method600is described below for the situation described above, in which endpoint106-1issues a write request to endpoint106-3. Method600is not, however, limited to the example situation.

At602, IO circuit108-1receives the write request from endpoint106-1.

At604, security circuitry114secures (e.g., encrypts and/or authenticates) the payload of the write request based on security parameter112, at or within IO circuit108-1. InFIG.3, security circuitry114may secure the payload prior to packetizing circuitry304(i.e., at inputs to master interface circuitry302or between master interface circuitry302and packetizing circuitry304). IO circuit108-1may include an instance security circuitry114(and memory110, when included). Alternatively, the payload may be routed from an input of master interface circuitry302or an input of packetizing circuitry304to security circuitry114, and the secured payload may be routed from security circuitry114back to IO circuit108-1.

At606, packetizing circuitry304of IO circuit108-1packetizes the write request with the secured payload and forwards the packetized write request containing the secured payload to NPS202-1.

At608, IO circuit108-3receives the packetized write request containing the secured payload from NPS202-6.

At610, de-packetizing circuitry402of IO circuit108-3de-packetizes the write request containing the secured payload, and outputs the de-packetized write request containing the secured payload to endpoint106-3.

FIG.7is a flowchart of a method700in which security circuitry114secures a payload at or within IO circuit108-3, according to an embodiment. Method700is described below for the situation described above, in which endpoint106-1issues a write request to endpoint106-3. Method700is not, however, limited to the example situation.

At702, IO circuit108-1receives the write request from endpoint106-1.

At704, packetizing circuitry304of IO circuit108-1packetizes the write request and forwards the packetized write request to NPS202-1.

At706, IO circuit108-3receives the packetized write request from NPS202-6.

At710, security circuitry114secures (e.g., encrypts and/or authenticates) the payload of the de-packetized write request based on security parameter112, at or within IO circuit108-1. InFIG.4, security circuitry114may secure the payload at the output of packetizing circuitry304, at the output of rate matching and asynchronous data boundary crossing circuitry404, or at the output of slave interface circuitry406. In this example, IO circuit108-3may include security circuitry114and memory110, or portions thereof. Alternatively, the payload may be routed from the output of packetizing circuitry304, the output of rate matching and asynchronous data boundary crossing circuitry404, or the output of slave interface circuitry406to security circuitry114, and the secured payload may be routed security circuitry114back to IO circuit108-3.

At712, IO circuit108-3provides the write request containing the secured payload to endpoint106-3.

In an embodiment, security circuitry114encrypts a payload prior to IO circuit108-3, and authenticates the payload at or within IO circuit108-3. In this embodiment, security circuitry114may authenticate the encrypted payload, or may decrypt the payload, authenticate the decrypted payload, and re-encrypt the payload for transmission to endpoint106-3.

FIG.8is a block diagram of IC device100in which security circuitry114secures a payload as the payload transits packet-sswitched NoC103via an IO circuit108-5, according to an embodiment. In the example ofFIG.8, NoC circuitry102includes memory110. Alternatively, memory110may be omitted.FIG.8is described below with reference toFIG.9.

FIG.9is a flowchart of a method900of securing a payload as the payload transits a packet-switched NoC, according to an embodiment. Method900is described below for the situation described above, in which endpoint106-1issues a write request to endpoint106-3. Method900is not, however, limited to the example situation.

At902, IO circuit108-1receives the write request from endpoint106-1.

At904, packetizing circuitry304of IO circuit108-1packetizes the write request and forwards the packetized write request to NPS202-1.

At906, IO circuit108-5receives the packetized write request from NPS202-5of NoC routing circuitry104.

At908, de-packetizing circuitry of IO circuit108-5de-packetizes the write request, such as described in one or more examples above, and outputs the payload of the de-packetized write request to security circuitry114.

At910, security circuitry114secures (e.g., encrypts and/or authenticates) the payload of the de-packetized write request based on security parameter112, and provides the secured payload to IO circuit108-5.

In an embodiment, NoC routing circuitry104forwards all packets to security circuitry114(e.g., via NPS202-5). Alternatively, NoC routing circuitry104may forward selected packets to security circuitry114, such as described further above.

At912, IO circuit108-5re-packetizes the write request to include the secured payload in place of the original/unsecured payload, such as described in one or more examples above, and forwards the packetized write request containing the secured payload to NPS202-5.

At914, IO circuit108-3receives the packetized write request containing the secured payload from NPS202-6.

At916, de-packetizing circuitry402of IO circuit108-3de-packetizes the write request containing the secured payload, and outputs the de-packetized write request containing the secured payload to endpoint106-3.

IC device100or a portion thereof may include one or more of a variety of types of configurable circuit blocks, such as described below with reference toFIG.10.FIG.10is a block diagram of configurable circuitry1000, including an array of configurable or programmable circuit blocks or tiles, according to an embodiment. The example ofFIG.10may represent a field programmable gate array (FPGA) and/or other IC device(s) that utilizes configurable interconnect structures for selectively coupling circuitry/logic elements, such as complex programmable logic devices (CPLDs).

In the example ofFIG.10, the tiles include multi-gigabit transceivers (MGTs)1001, configurable logic blocks (CLBs)1002, block random access memory (BRAM)1003, input/output blocks (IOBs)1004, configuration and clocking logic (Config/Clocks)1005, digital signal processing (DSP) blocks1006, specialized input/output blocks (I/O)1007(e.g., configuration ports and clock ports), and other programmable logic1008, which may include, without limitation, digital clock managers, analog-to-digital converters, and/or system monitoring logic. The tiles further includes a dedicated processor1010.

One or more tiles may include a programmable interconnect element (INT)1011having connections to input and output terminals1020of a programmable logic element within the same tile and/or to one or more other tiles. A programmable INT1011may include connections to interconnect segments1022of another programmable INT1011in the same tile and/or another tile(s). A programmable INT1011may include connections to interconnect segments1024of general routing resources between logic blocks (not shown). The general routing resources may include routing channels between logic blocks (not shown) including tracks of interconnect segments (e.g., interconnect segments1024) and switch blocks (not shown) for connecting interconnect segments. Interconnect segments of general routing resources (e.g., interconnect segments1024) may span one or more logic blocks. Programmable INTs1011, in combination with general routing resources, may represent a programmable interconnect structure.

A CLB1002may include a configurable logic element (CLE)1012that can be programmed to implement user logic. A CLB1002may also include a programmable INT1011.

A BRAM1003may include a BRAM logic element (BRL)1013and one or more programmable INTs1011. A number of interconnect elements included in a tile may depends on a height of the tile. A BRAM1003may, for example, have a height of five CLBs1002. Other numbers (e.g., four) may also be used.

A DSP block1006may include a DSP logic element (DSPL)1014in addition to one or more programmable INTs1011. An IOB1004may include, for example, two instances of an input/output logic element (IOL)1015in addition to one or more instances of a programmable INT1011. An I/O pad connected to, for example, an I/O logic element1015, is not necessarily confined to an area of the I/O logic element1015.

In the example ofFIG.10, config/clocks1005may be used for configuration, clock, and/or other control logic. Vertical columns1009may be used to distribute clocks and/or configuration signals.

A logic block (e.g., programmable of fixed-function) may disrupt a columnar structure of configurable circuitry1000. For example, processor1010spans several columns of CLBs1002and BRAMs1003. Processor1010may include one or more of a variety of components such as, without limitation, a single microprocessor to a complete programmable processing system of microprocessor(s), memory controllers. and/or peripherals.

InFIG.10, configurable circuitry1000further includes analog circuits1050, which may include, without limitation, one or more analog switches, multiplexers, and/or de-multiplexers. Analog switches may be useful to reduce leakage current.

FIG.10is provided for illustrative purposes. Configurable circuitry1000is not limited to numbers of logic blocks in a row, relative widths of the rows, numbers and orderings of rows, types of logic blocks included in the rows, relative sizes of the logic blocks, illustrated interconnect/logic implementations, or other example features ofFIG.10.