Crypto Parameters in Camera Configurations#
Crypto hardware resources are described in PCT and device-tree files on a platform level, distributing resources among different NVIDIA DRIVE®OS applications. The process, however, does not allow specification of how crypto hardware resources are distributed within each application (such as the SIPL camera application, which is just one user of crypto services). That specification of resources requires a camera platform configuration file.
The description of how each camera must map to a specific crypto channel requires specification of a list of key-channel pairs. Every sensor model uses its own proprietary implementation of authentication features, and the purpose of each key is driver specific.
"cryptoKeys": [ {
"keyPurpose": <specify purpose of the key>, // a string; purpose is driver specific
"keyName": <key name string>, // name is global within a single process; threads can share the key by specifying the same name
"cryptoChanID": <channel ID from DT> // Crypto channel ID from device tree, compatible = "nvvseivccfg,channel-db"
}]
Specifying keyName and cryptoChanID in different combinations offers flexibility in how crypto resources are assigned between cameras for that specific platform configuration:
Every
cryptoChanIDis associated with a specific SE AES or HASH engine, as specified in the device tree, and serviced only by that engine.By specifying
cryptoChanIDassociated with the same engine, cameras share the hardware engine.Assigning dedicated crypto channels to each camera provides better performance.
Every IVC ID is associated with a dedicated PKCS11 session.
By specifying the same
cryptoChanID, multiple cameras can share a single PKCS11 session.
namespecifies a unique and global key name for the process.The same key name is visible by all threads within the process and can be used through any PKCS11 session within the same process.
By specifying the same
name, multiple cameras can use the same key.The same key used with different PKCS11 sessions, associated with crypto channels, consumes a separate keyslot for each session even though key value is the same.
Using the same key through the same crypto channel (PKCS11 session) allows cameras to share a keyslot as well.
Specifying a unique key name, but the same
cryptoChanIDallows cameras to use a single keyslot for multiple keys, and keys are swapped in a single keyslot for each following user.Specifying a unique key name and unique
cryptoChanIDconsumes one keyslot for one unique key object
Note
Each camera sensor that uses image authentication (IMG_GMAC or IMG_HMAC) requires a unique cryptoChanID for its image authentication key. The number of cameras that can run with authentication enabled simultaneously is limited by the number of available IVC crypto channels on the platform.
Crypto Configuration Example#
Following is an example of a crypto configuration for a 13-camera setup on the NVIDIA DRIVE AGX™ Thor reference platform, supporting 6x IMX728, 4x IMX623, 2x OX05B OMS, and 1x OX05B DMS with authentication enabled.
"deviceBlocks": [
{
...
"cryptoConfigs": [
{
"linkID": 0,
"cryptoKeys": [
{
"keyPurpose": "IMG_GMAC",
"keyName": "IMX623_GMAC_0",
"cryptoChanID": 325
},
{
"keyPurpose": "IMG_ECB",
"keyName": "SONY_ECB_SHARED",
"cryptoChanID": 301
},
{
"keyPurpose": "I2C_CMAC",
"keyName": "IMX623_I2C_CMAC_0",
"cryptoChanID": 302
}
]
},
{
"linkID": 1,
"cryptoKeys": [
{
"keyPurpose": "IMG_GMAC",
"keyName": "IMX623_GMAC_1",
"cryptoChanID": 326
},
{
"keyPurpose": "IMG_ECB",
"keyName": "SONY_ECB_SHARED",
"cryptoChanID": 301
},
{
"keyPurpose": "I2C_CMAC",
"keyName": "IMX623_I2C_CMAC_1",
"cryptoChanID": 302
}
]
},
{
"linkID": 2,
"cryptoKeys": [
{
"keyPurpose": "IMG_GMAC",
"keyName": "IMX623_GMAC_2",
"cryptoChanID": 327
},
{
"keyPurpose": "IMG_ECB",
"keyName": "SONY_ECB_SHARED",
"cryptoChanID": 301
},
{
"keyPurpose": "I2C_CMAC",
"keyName": "IMX623_I2C_CMAC_2",
"cryptoChanID": 302
}
]
},
{
"linkID": 3,
"cryptoKeys": [
{
"keyPurpose": "IMG_GMAC",
"keyName": "IMX623_GMAC_3",
"cryptoChanID": 328
},
{
"keyPurpose": "IMG_ECB",
"keyName": "SONY_ECB_SHARED",
"cryptoChanID": 301
},
{
"keyPurpose": "I2C_CMAC",
"keyName": "IMX623_I2C_CMAC_3",
"cryptoChanID": 302
}
]
},
{
"linkID": 4,
"cryptoKeys": [
{
"keyPurpose": "IMG_GMAC",
"keyName": "IMX728_GMAC_4",
"cryptoChanID": 322
},
{
"keyPurpose": "IMG_ECB",
"keyName": "SONY_ECB_SHARED",
"cryptoChanID": 301
},
{
"keyPurpose": "I2C_CMAC",
"keyName": "IMX728_I2C_CMAC_4",
"cryptoChanID": 302
}
]
},
{
"linkID": 5,
"cryptoKeys": [
{
"keyPurpose": "IMG_GMAC",
"keyName": "IMX728_GMAC_5",
"cryptoChanID": 323
},
{
"keyPurpose": "IMG_ECB",
"keyName": "SONY_ECB_SHARED",
"cryptoChanID": 301
},
{
"keyPurpose": "I2C_CMAC",
"keyName": "IMX728_I2C_CMAC_5",
"cryptoChanID": 302
}
]
},
{
"linkID": 6,
"cryptoKeys": [
{
"keyPurpose": "IMG_HMAC",
"keyName": "OX05B_OMS_HMAC_6",
"cryptoChanID": 315
},
{
"keyPurpose": "IMG_SHA",
"keyName": "OX05B_OMS_SHA_6",
"cryptoChanID": 313
}
]
},
{
"linkID": 7,
"cryptoKeys": [
{
"keyPurpose": "IMG_HMAC",
"keyName": "OX05B_OMS_HMAC_7",
"cryptoChanID": 316
},
{
"keyPurpose": "IMG_SHA",
"keyName": "OX05B_OMS_SHA_7",
"cryptoChanID": 314
}
]
},
{
"linkID": 8,
"cryptoKeys": [
{
"keyPurpose": "IMG_HMAC",
"keyName": "OX05B_DMS_HMAC_8",
"cryptoChanID": 318
},
{
"keyPurpose": "IMG_SHA",
"keyName": "OX05B_DMS_SHA_8",
"cryptoChanID": 317
}
]
},
{
"linkID": 9,
"cryptoKeys": [
{
"keyPurpose": "IMG_GMAC",
"keyName": "IMX728_GMAC_9",
"cryptoChanID": 319
},
{
"keyPurpose": "IMG_ECB",
"keyName": "SONY_ECB_SHARED",
"cryptoChanID": 301
},
{
"keyPurpose": "I2C_CMAC",
"keyName": "IMX728_I2C_CMAC_9",
"cryptoChanID": 302
}
]
},
{
"linkID": 10,
"cryptoKeys": [
{
"keyPurpose": "IMG_GMAC",
"keyName": "IMX728_GMAC_10",
"cryptoChanID": 320
},
{
"keyPurpose": "IMG_ECB",
"keyName": "SONY_ECB_SHARED",
"cryptoChanID": 301
},
{
"keyPurpose": "I2C_CMAC",
"keyName": "IMX728_I2C_CMAC_10",
"cryptoChanID": 302
}
]
},
{
"linkID": 11,
"cryptoKeys": [
{
"keyPurpose": "IMG_GMAC",
"keyName": "IMX728_GMAC_11",
"cryptoChanID": 321
},
{
"keyPurpose": "IMG_ECB",
"keyName": "SONY_ECB_SHARED",
"cryptoChanID": 301
},
{
"keyPurpose": "I2C_CMAC",
"keyName": "IMX728_I2C_CMAC_11",
"cryptoChanID": 302
}
]
},
{
"linkID": 12,
"cryptoKeys": [
{
"keyPurpose": "IMG_GMAC",
"keyName": "IMX728_GMAC_12",
"cryptoChanID": 324
},
{
"keyPurpose": "IMG_ECB",
"keyName": "SONY_ECB_SHARED",
"cryptoChanID": 301
},
{
"keyPurpose": "I2C_CMAC",
"keyName": "IMX728_I2C_CMAC_12",
"cryptoChanID": 302
}
]
}
]
}
]