Secure data communication over a memory-mapped serial communications interface utilizing a distributed firewall

A method of controlling access to first and second nodes from a plurality of nodes coupled to one another over a memory-mapped serial communications interface of the type supporting peer-to-peer communications between the plurality of nodes, the method comprising:

• (a) controlling access to the first node using a first security manager disposed in the first node;
• (b) controlling access to the second node using a second security manager disposed in the second node, wherein the first and second security managers define a distributed firewall for the communications interface;
• (c) generating for the first node a first authorization list of authorized nodes from the plurality of nodes for which communication with the first node is authorized;
• (d) generating for the second node a second authorization list of authorized nodes from the plurality of nodes for which communication with the second node is authorized;
• and
• (e) updating the first and second authorization lists in response to at least one of adding a node to and removing a node from the communications interface.

A method of controlling access to first and second nodes from a plurality of nodes coupled to one another over a memory-mapped serial communications interface of the type supporting peer-to-peer communications between the plurality of nodes, the method comprising:

• (a) controlling access to the first node using a first security manager disposed in the first node;
• (b) controlling access to the second node using a second security manager disposed in the second node, wherein the first and second security managers define a distributed firewall for the communications interface;
• (c) generating for the first node a first authorization list of authorized nodes from the plurality of nodes for which communication with the first node is authorized;
• (d) obtaining an isochronous channel for the first node;
• (e) generating a isochronous session key in the first node;
• and
• (f) transmitting the isochronous session key to the authorized nodes in the first authorization list that are configured to receive the isochronous channel.

A data processing system, comprising:

• (a) a plurality of nodes including at least first and second nodes;
• (b) a memory-mapped serial communications interface coupled between the plurality of nodes and supporting peer-to-peer communication therebetween;
• and
• (c) a distributed firewall including first and second security managers respectively disposed in the first and second nodes, the first and second security managers respectively configured to control access to the first and second nodes from the communications interface, wherein the first node is assigned a segment of memory addresses for the communications interface, the segment of memory addresses including secure and unsecure portions thereof, and wherein the first security manager is configured to control access only to the secure portion of the segment of memory addresses for the first node.