[{"data":1,"prerenderedAt":39},["ShallowReactive",2],{"GET-live-training-course/slug/cxl-security-{}-{}":3},{"data":4},{"id":5,"name":6,"slug":7,"description":8,"about":9,"training_materials":10,"you_will_learn":11,"prerequisites":12,"is_active":13,"category_id":14,"duration":15,"modified_at":16,"course_outline":17,"supplied_materials":16,"thumbnail":18,"elearning_courses":19,"ebooks":20,"topics":21,"reviews":38,"meta_title":16,"meta_description":16,"meta_keywords":16},745,"CXL Security","cxl-security","\u003Cp>The need for security in computer systems has increased dramatically over the years. There are many factors behind this, including:\u003C/p>\r\n\u003Cul>\r\n\u003Cli>Downloadable firmware that is used to implement devices (known as soft devices) that used to be hard-coded.\u003C/li>\r\n\u003Cli>Counterfeit devices in the supply chain.\u003C/li>\r\n\u003Cli>Malicious actors building back doors into genuine devices.\u003C/li>\r\n\u003Cli>Virtualization, where we have multiple operating systems sharing the same platform.\u003C/li>\r\n\u003Cli>Greatly increasing complexity opening the door to design errors and implementation bugs.\u003C/li>\r\n\u003Cli>Sophisticated attackers with resources to search for the smallest hole.\u003C/li>\r\n\u003Cli>Increased rewards for a successful system attack, whether monetary (perhaps from the theft of crypto), or from destructive intent to a target (such as a power grid).\u003C/li>\r\n\u003Cli>Increasing connectivity of systems, such that a platform that was isolated and therefore secure, is now online and attackable from the other side of the world.\u003C/li>\r\n\u003Cli>Device portability, such that physical access to a system in a secure data center is not required, the target is a laptop or phone class of system.\u003C/li>\r\n\u003Cli>Growth of sensitive data on devices, such that the system attacker might be a “good guy” such as law enforcement trying to prevent a terrorist attack.\u003C/li>\r\n\u003Cli>An increasing complex world where the definition of “good guy” and “bad guy” are not clear.\u003C/li>\r\n\u003C/ul>\r\n\u003Cp>CXL, as an interconnect that carries memory and cache traffic, offers a high value target. Consider a system where memory encryption is implemented by the memory controller. In such a system, it may be easier to attack traffic on the interconnect before it reaches the memory controller and is encrypted.\u003C/p>\r\n\u003Cp>CXL 2.0 adds security capabilities, based on the PCIe and DMTF features. This CXL focused security course covers these security topics looking at how such high value traffic is protected.\u003C/p>\r\n\u003Cp>This course covers CXL 2.0, CXL 3.0 and CXL 3.1.\u003C/p>\r\n\u003Cp> \u003C/p>\r\n\u003Cp>\u003Cspan style=\"color: rgb(186, 55, 42);\">\u003Cstrong>All of MindShare's classroom and virtual classroom courses can be customized to fit the needs of your group.\u003C/strong>\u003C/span>\u003C/p>","\u003Cp>\u003Cspan style=\"font-size: 18pt;\">\u003Cstrong>Let MindShare Bring \"CXL Security\" to Life for You\u003C/strong>\u003C/span>\u003C/p>","\u003Cul>\r\n\u003Cli>PDF of course slides\u003C/li>\r\n\u003C/ul>","\u003Cul>\r\n\u003Cli>Threat models.\u003C/li>\r\n\u003Cli>STRIDE categories (spoofing, tampering, repudiation, information disclosure, repudiation, denial of service, elevation of privilege).\u003C/li>\r\n\u003Cli>CXL overview, highlighting the areas we will discuss with respect to attacks.\u003C/li>\r\n\u003Cli>Differences between CXL.io and CXL.mem / CXL.cache in terms of addressing and IOMMU, and the effects on security.\u003C/li>\r\n\u003Cli>Using the IOMMU to prevent DMA attacks, and the potential security holes with an IOMMU.\u003C/li>\r\n\u003Cli>Other DMA attack mitigations such as encrypted memory and enclaves.\u003C/li>\r\n\u003Cli>Interrupt attacks.\u003C/li>\r\n\u003Cli>Using Interrupt Remapping to prevent interrupt attacks, and the security holes with interrupt remapping.\u003C/li>\r\n\u003Cli>The idea of mutable versus immutable, and why everything needs to be treated as mutable.\u003C/li>\r\n\u003Cli>Error reporting attacks.\u003C/li>\r\n\u003Cli>Switch based attacks.\u003C/li>\r\n\u003Cli>Using the IOMMU to prevent DMA attacks, and the potential security holes with an IOMMU.\u003C/li>\r\n\u003Cli>The enhancements to the CXL fabric and to manageability (IDE – Integrity and Data Encryption plus SPDM, MCTP and CMA).\u003C/li>\r\n\u003Cli>The boundaries of the protection from the enhancements, and possible paths to attacking such a secured system.\u003C/li>\r\n\u003Cli>TSP (TEE (Trusted Execution Environment) Security Protocol)\u003C/li>\r\n\u003C/ul>","\u003Cp>The MindShare CXL 2.0 class or equivalent knowledge is recommended as a pre-requisite.\u003Cbr>Basic knowledge of processor (Intel/AMD/ARM) and computer architecture.\u003C/p>",true,11,"3 days",null,"\u003Cul>\r\n\u003Cli>Fabric based attacks (watching links, changing packets, injecting packets).\u003C/li>\r\n\u003Cli>Malicious hardware, counterfeit hardware.\u003C/li>\r\n\u003Cli>Impersonation (where a device pretends to be something else).\u003C/li>\r\n\u003Cli>The need for\r\n\u003Cul>\r\n\u003Cli>Establishing trust (host knowing the device, device knowing the host).\u003C/li>\r\n\u003Cli>Key exchange.\u003C/li>\r\n\u003Cli>Encrypted links.\u003C/li>\r\n\u003C/ul>\r\n\u003C/li>\r\n\u003Cli>Keys, certificates and encryption background\r\n\u003Cul>\r\n\u003Cli>symmetric encryption\u003C/li>\r\n\u003Cli>public and private keys\u003C/li>\r\n\u003Cli>TLS (Transport Layer Security) background\u003C/li>\r\n\u003Cli>encryption standards\u003C/li>\r\n\u003Cli>certificates\u003C/li>\r\n\u003Cli>X.509 trust model\u003C/li>\r\n\u003Cli>AES-GCM\u003C/li>\r\n\u003C/ul>\r\n\u003C/li>\r\n\u003Cli>TCG (Trusted Computing Group) background\r\n\u003Cul>\r\n\u003Cli>root of trust\u003C/li>\r\n\u003Cli>attestation\u003C/li>\r\n\u003Cli>system startup\u003C/li>\r\n\u003C/ul>\r\n\u003C/li>\r\n\u003Cli>CXL.io protection\r\n\u003Cul>\r\n\u003Cli>uses PCIe IDE\u003C/li>\r\n\u003Cli>link security threat model\u003C/li>\r\n\u003Cli>exposures not covered by the threat model\u003C/li>\r\n\u003Cli>stream establishment\u003C/li>\r\n\u003Cli>side channel attacks via unencrypted headers\u003C/li>\r\n\u003Cli>TLPs\u003C/li>\r\n\u003Cli>TLP Encryption\u003C/li>\r\n\u003Cli>TLP Aggregation\u003C/li>\r\n\u003Cli>IDE Extended Capability structure\u003C/li>\r\n\u003Cli>IDE Sub-Streams\u003C/li>\r\n\u003Cli>IDE_KM (Key Management)\u003C/li>\r\n\u003Cli>power management and resets\u003C/li>\r\n\u003Cli>error conditions and error reporting\u003C/li>\r\n\u003Cli>IDE may not be sufficient, what else may be needed\r\n\u003Cul>\r\n\u003Cli>key exchange\u003C/li>\r\n\u003Cli>trust\u003C/li>\r\n\u003C/ul>\r\n\u003C/li>\r\n\u003C/ul>\r\n\u003C/li>\r\n\u003Cli>CXL. memory and CXL.cache protection\r\n\u003Cul>\r\n\u003Cli>similar to PCIe IDE, but FLIT based\u003C/li>\r\n\u003Cli>link IDE only, the role of the switch\u003C/li>\r\n\u003Cli>FLITs\u003C/li>\r\n\u003Cli>FLIT Encryption\u003C/li>\r\n\u003Cli>FLIT Aggregation\u003C/li>\r\n\u003Cli>IDE control FLIT\u003C/li>\r\n\u003Cli>MAC handling, truncated MACs, MAC transmission\u003C/li>\r\n\u003Cli>containment mode and skid mode\u003C/li>\r\n\u003Cli>PCRC for crypto engine robustness\u003C/li>\r\n\u003Cli>CXL_IDE_KM, key management for CXL.cachemem\u003C/li>\r\n\u003Cli>Changes for the 256 byte flit\u003C/li>\r\n\u003C/ul>\r\n\u003C/li>\r\n\u003Cli>DMTF Specifications overview\u003C/li>\r\n\u003Cli>Security Protocol and Data Model (SPDM)\r\n\u003Cul>\r\n\u003Cli>multiple paths to devices (SMbus, I2C)\u003C/li>\r\n\u003Cli>threat model\u003C/li>\r\n\u003Cli>mutable and immutable objects\u003C/li>\r\n\u003Cli>authentication\u003C/li>\r\n\u003Cli>attestation\u003C/li>\r\n\u003Cli>recommended flow\u003C/li>\r\n\u003Cli>handling versions\u003C/li>\r\n\u003Cli>certificates and chains of certificates\u003C/li>\r\n\u003Cli>mutual authentication\u003C/li>\r\n\u003Cli>session key exchange\u003C/li>\r\n\u003Cli>Diffie-Hellman scheme background\u003C/li>\r\n\u003Cli>PSK (pre-shared key)\u003C/li>\r\n\u003Cli>secure session\u003C/li>\r\n\u003Cli>provisioning\u003C/li>\r\n\u003Cli>alias certificates (dynamic certificates)\u003C/li>\r\n\u003Cli>complications of having 2 certificate models\u003C/li>\r\n\u003Cli>open source libspdw, a sample implementation\u003C/li>\r\n\u003C/ul>\r\n\u003C/li>\r\n\u003Cli>CMA (Component Measurement and Authentication)\u003C/li>\r\n\u003Cli>MCTP (management Component Transport Protocol)\u003C/li>\r\n\u003Cli>DOE (Data Object Exchange)\r\n\u003Cul>\r\n\u003Cli>Mailboxes and their use\u003C/li>\r\n\u003Cli>DOE Extended Capability structure\u003C/li>\r\n\u003Cli>DOE Capabilities registers\u003C/li>\r\n\u003Cli>DOE Interrupts\u003C/li>\r\n\u003C/ul>\r\n\u003C/li>\r\n\u003Cli>TSP (TEE Security Protocol)\r\n\u003Cul>\r\n\u003Cli>PCIe TDISP background\u003C/li>\r\n\u003Cli>CXL implementation of TSP\u003C/li>\r\n\u003C/ul>\r\n\u003C/li>\r\n\u003Cli>Memory Encryption\u003C/li>\r\n\u003C/ul>\r\n\u003Cp>Optional content covered in a 3-day class and covered on 1st day\u003C/p>\r\n\u003Cul>\r\n\u003Cli>DMA attacks, copying or modifying memory.\u003C/li>\r\n\u003Cli>Use of an IOMMU to prevent DMA attacks.\u003C/li>\r\n\u003Cli>IOMMU issues at boot time versus runtime, setup and configuration of the IOMMU, and the ACPI DMAR tables.\u003C/li>\r\n\u003Cli>Error reporting from devices.\u003C/li>\r\n\u003Cli>Congestion based attacks.\u003C/li>\r\n\u003Cli>Interrupt based attacks, with the interrupt remapping as mitigation.\u003C/li>\r\n\u003C/ul>","https://mindshare-prod.s3.amazonaws.com/public/live_training_courses/thumbnails/live_training_course_745_thumbnail_1747666738.png",[],[],[22,29],{"id":23,"course_name":6,"classroom_info":24,"virtual_classroom_info":25,"file_url":26,"course_link":27,"link":16,"file_name":28},204,"2 or 3 days","4 or 6 half-days","https://mindshare-prod.s3.amazonaws.com/public/live_training_course_topics_pdfs/MindShare_CXL_Security_Outline.pdf","/live-training-course/cxl-security","MindShare_CXL_Security_Outline.pdf",{"id":30,"course_name":31,"classroom_info":32,"virtual_classroom_info":33,"file_url":34,"course_link":35,"link":36,"file_name":37},201,"CXL 3.1 w/ Switch Architecture","5 days","10 half-days","https://mindshare-prod.s3.amazonaws.com/public/live_training_course_topics_pdfs/MindShare_CXL3_w_Switches_Outline.pdf","/live-training-course/cxl-compute-express-link","/elearning-course/cxl-31-update-elearning-course","MindShare_CXL3_w_Switches_Outline.pdf",[16],1793108628678]