Slice aggregation cryptographic system and method

Abstract

A system includes one or more slice aggregated crypto slices, each slice aggregated crypto slice being configured to perform a plurality of operations on an incoming data transfer at a first processing rate by aggregating one or more individual crypto slices, each individual crypto slice being configured to perform a plurality of operations on a portion of the incoming data transfer at a second processing rate. Each individual crypto slice of the individual crypto slices includes a serially connected ingress block, a crypto engine, and an egress block, the ingress block being configured to acquire a portion of the incoming data transfer at the second processing rate, the crypto engine being configured to perform operations on the portion of the incoming data transfer, and the egress block being configured to process a signature of the portion and output the portion of the incoming data transfer once the operations have been completed. The first processing rate of each slice aggregated crypto slice is equal to the aggregated second processing rate of the individual crypto slices in the slice aggregated crypto slice.

Description

Technical Field

[0001] The present disclosure generally relates to a cryptographic system for protection of data transmission over a communication network and systems and circuits implementing the proposed slice aggregation cryptographic system. Background Art

[0002] In the current era of big data, terabytes of data are created from edge devices and uploaded to storage and / or servers in the cloud every day. Edge devices that provide entry points into the core network of an enterprise or service provider may include (as non-limiting examples) routers, switches, multiplexers, and a variety of network access devices. For data protection, cryptography is often used for networking and storage of such data to ensure that data is transmitted from edge devices and securely stored in the cloud. Different edge devices may require different processing rates.

[0003] As a non-limiting example, a 400G (or gbps) cryptographic engine is configured to encrypt and decrypt data transfers at processing rates of 100gbps (i.e., billions of bits per second), 200gbps, and 400gbps. Then, an exemplary cryptographic system including four 100G cryptographic engines, two 200G cryptographic engines, and one 400G engine selects one or more of the cryptographic engines based on the processing rate required for each data transfer. As a non-limiting example:

[0004] 4 100G crypto engines for four times 100Gbps data transfer, or

[0005] 2 x 200G crypto engines for two 200gbps data transfers, or

[0006] 1 400G crypto engine for a 400gbps data transfer, or

[0007] One 200G crypto engine and two 100G crypto engines are used for one 200Gbps data transfer and two 100Gbps data transfers.

[0008] However, because the cryptographic system includes redundant cryptographic engines, this cryptographic system is very expensive.

[0009] Another traditional approach is to use time division multiplexing (TDM) on a single (e.g., 400G) crypto engine, where each data transfer has an ingress buffer and an egress buffer. Configurability is achieved by rearranging these additional ingress and egress buffers using some overhead mechanisms to switch data transfers between buffers based on the required processing rate. However, this approach has cost penalties and latency penalties due to the additional ingress and egress buffers, lack of physical isolation, and power gating due to sharing a crypto engine. Summary of the invention

[0010] Therefore, a high-speed and configurable cryptographic system is needed. A new cryptographic system is proposed, in which the cryptographic system includes multiple low-processing rate (e.g., 100G) slices. Each slice can be configured to perform cryptographic operations on data transfer at a specific processing rate. For the integrity and / or confidentiality of data encryption / decryption, the cryptographic system allows various aggregations / configurations in multiple low-rate processing slices to form various processing units with higher processing rates. This slice aggregation cryptographic system achieves cost efficiency by adopting reusable and configurable components / slices, power efficiency by turning on only the slices required for the current data transfer task, and a secure design that achieves data integrity because the slices used for data transfer are physically isolated.

[0011] A system includes one or more slice aggregated crypto slices, wherein each slice can be configured to perform multiple operations on an incoming data transmission at a first processing rate by aggregating one or more individual crypto slices, wherein each slice can be configured to perform multiple operations on a portion of the incoming data transmission at a second processing rate. Each individual crypto slice of the individual crypto slices includes a serially connected ingress block, a crypto engine, an egress block, the ingress block configured to obtain a portion of the incoming data transmission at the second processing rate, the crypto engine configured to perform an operation on the portion of the incoming data transmission, and the egress block configured to insert or remove a signature of the portion of the incoming data transmission and output the portion of the incoming data transmission once the operation has been completed. The first processing rate of each slice aggregated crypto slice is equal to the aggregated second processing rate of the individual crypto slices in the slice aggregated crypto slice.

[0012] It should be appreciated that the plurality of operations is one or more of: generating or checking a signature of a data transfer for integrity, and encrypting or decrypting a data transfer for confidentiality. Portions of an incoming data transfer processed on one slice aggregation crypto slice are physically isolated from portions of an incoming data transfer processed on other slice aggregation crypto slices. In some embodiments, the system further comprises one or more cross-slice channels in a slice aggregation crypto slice, wherein each of the one or more cross-slice channels is configured to propagate information generated from one slice aggregation crypto slice to another slice aggregation crypto slice to achieve slice aggregation. In some embodiments, each of the one or more cross-slice channels is further configured to broadcast common information to all individual crypto slices within a slice aggregation crypto slice, so that per-slice resources are cascaded, shared, and operated together between individual crypto slices based on the configuration of the slice aggregation crypto slice.

[0013] These and other aspects may be understood with reference to the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to be able to understand in detail the manner in which the features set forth above are described, a more specific description briefly summarized above may be made by reference to example implementations, some of which are shown in the accompanying drawings. However, it should be noted that the accompanying drawings illustrate only typical example implementations and therefore should not be considered as limiting the scope thereof.

[0015] Figure 1 Depicted are examples of an architecture for a slice-aggregated cryptographic system including multiple individual cryptographic slices according to some examples.

[0016] Figure 2 Depicted is an example of an architecture of a slice aggregate cryptographic system according to some examples, the slice aggregate cryptographic system comprising two slice aggregate cryptographic slices, each slice aggregate cryptographic slice having two single 100G cryptographic slices respectively.

[0017] Figure 3 Depicted are examples of an architecture of a slice aggregate cryptographic system according to some examples, the slice aggregate cryptographic system comprising a slice aggregate cryptographic slice having four single 100G crypto slices.

[0018] Figure 4 Depicted are examples of an architecture of a hybrid slice aggregate crypto system according to some instances, the hybrid slice aggregate crypto system comprising a single 100G crypto slice, a 2-slice aggregate crypto slice comprising two single 100G crypto slices, and a closed single 100G crypto slice.

[0019] Figure 5 is a sequence diagram illustrating examples of operations for sharing metadata between cryptographic slices according to some examples.

[0020] Figure 6 is a block diagram depicting a programmable integrated circuit (IC) according to some examples.

[0021] Figure 7 is a field programmable gate array (FPGA) implementation of a programmable IC according to some examples.

[0022] To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures. It is contemplated that elements of one example may be beneficially incorporated in other examples. DETAILED DESCRIPTION

[0023] The examples described herein relate to an efficient and configurable slice aggregation cryptographic system. Various features are described below with reference to the accompanying drawings. It should be noted that the drawings may be drawn to scale or not to scale, and elements of similar structure or function are represented by the same reference numerals throughout the drawings. It should be noted that these figures are intended only to facilitate the description of the features. They are not intended to be an exhaustive description of the claimed invention or a limitation on the scope of the claimed invention. For example, various methods according to some examples may include more or fewer operations, and the order of operations in the various methods according to the examples may be different from the order of operations described herein. In addition, the illustrated examples do not need to have all the aspects or advantages shown. Even if not so stated or not so clearly described, the aspects or advantages described in conjunction with a specific example are not necessarily limited to that example and may be practiced in any other example.

[0024] The slice aggregation cryptographic system described below uses a non-limiting example of four 100G cryptographic engines (also referred to as slices) to illustrate the proposed approach to aggregating each slice based on the required processing rate. As a non-limiting example, the system is configured to aggregate two 100G cryptographic slices into one aggregated 200G cryptographic slice or to aggregate four 100G cryptographic slices into one aggregated 400G cryptographic slice. The system has no redundant slices to improve cost efficiency and provides per-slice controllability for power efficiency. For data security, the system also implements physical isolation for each aggregated slice. Although a four-slice cryptographic system is used as a non-limiting example to illustrate the proposed approach, the same approach may also be applied to cryptographic systems with different numbers of cryptographic engines with different data processing rates.

[0025] Now, refer to Figures 1 to 4 , Figures 1 to 4 is a block diagram depicting an example of a configurable sliced ​​aggregate cryptographic system for performing cryptographic operations on data transfers at various processing rates.

[0026] Figure 1 An example of the architecture of a slice aggregate cryptographic system 100 is depicted. The slice aggregate cryptographic system 100 includes a plurality of individual cryptographic slices 102_1, ..., 102_4, e.g. Figure 1 Slices #1 to #4 are shown. It should be appreciated that each individual crypto slice 102 can be configured to handle incoming data transmission at 100G or 100 gbps. Figure 1As shown, each crypto slice 102 includes at least the following components in a chain: an entry block 104, which is connected in series with a cryptographic engine 106, which is connected in series with an egress block 108. The entry block 104 is configured to transmit incoming data at a certain processing rate (e.g., 100G), notify the cryptographic engine 106 of the processing required for the data transmission (e.g., cryptographic operations), and feed the data into the cryptographic engine 106 for such processing accordingly. Upon receiving the data from the entry block 104, the cryptographic engine 106 is configured to perform one or more cryptographic processing and / or operations on the data. Cryptographic operations include, but are not limited to, generating or checking a signature of the data transmission for integrity and / or encrypting or decrypting data for confidentiality. Once the cryptographic engine 106 completes the cryptographic operation, the egress block 108 is configured to insert or remove the signature of the data transmission and transmit the encrypted or decrypted data for further processing or transmission.

[0027] In some embodiments, the slice aggregation cryptographic system is configured to aggregate multiple individual cryptographic slices 102 into one slice aggregation cryptographic slice to meet the processing rate required for incoming data transmission. Figure 2 An example of the architecture of a slice aggregated cipher system 200 is depicted. The slice aggregated cipher system 200 includes two slice aggregated cipher slices 202_1 and 202_2, each of which includes two individual 100G cipher slices 102_1 / 102_2 and 102_3, 102_4, respectively. As a result, each 2-slice aggregated cipher slice 202 is configured to process incoming data transfers at 200G or 200gbps (i.e., the aggregate processing rate of the two individual cipher slices 102 in the slice aggregated cipher slice 202). When a 200G data transfer is received by the slice aggregated cipher slice 202, the incoming data transfer is split between and fed into the ingress blocks 104 of the two individual cipher slices 102 of the slice aggregated cipher slice 202, and processed in parallel by components in each of the individual cipher slices 102, as discussed above. Once both individual cipher slices 102 have completed processing their respective data for the transmitted portion, the slice aggregation cipher slice 202 is configured to merge the outputs of the egress blocks 108 from its two individual cipher slices 102 into one data output for further transmission and / or processing.

[0028] Figure 3An example of the architecture of a slice aggregated cipher system 400 is depicted. The slice aggregated cipher system 400 includes a slice aggregated cipher slice 302 that includes four individual 100G cipher slices 102_1, ..., 102_4. As a result, the 4-slice aggregated cipher slice 302 is configured to process incoming data transmissions at 400G or 400 gbps (i.e., the aggregate processing rate of the four individual cipher slices 102 in the slice aggregated cipher slice 302). When a 400G data transmission is received by the slice aggregated cipher slice 302, the incoming data is split between and fed to the ingress blocks 104 of the four individual cipher slices 102 of the slice aggregated cipher slice 302, and processed in parallel by components in each of the individual cipher slices 102, as discussed above. Once all four individual cipher slices 102 have completed processing their respective data, the slice aggregation cipher slice 302 is configured to merge the outputs from the egress blocks 108 of its four individual cipher slices 102 into one data output for further transmission and / or processing.

[0029] In some embodiments, the slice aggregate cryptographic system is configured to include a mix of both one or more individual cryptographic slices 102 and one or more slice aggregate cryptographic slices to accommodate multiple data transfers at different processing rates. Figure 4 An example of an architecture of a hybrid slice aggregate cryptographic system 600 is depicted. The hybrid slice aggregate cryptographic system 600 includes two individual 100G crypto slices 102_1 and 102_4 and a 2-slice aggregate cryptographic slice 402, which includes two individual 100G crypto slices 102_2 and 102_3. In this configuration, the hybrid slice aggregate cryptographic system 600 is configured to process multiple incoming data transfers at different required processing rates simultaneously, for example, a first data transfer of 100G via the individual 100G crypto slice 102_1 and a second data transfer of 200G via the 2-slice aggregate cryptographic slice 402 including the two individual 100G crypto slices 102_2 and 102_3. It should be noted that no 200G crypto slices are used. Figure 4 The individual cryptographic slice 102_4 in the example of FIG. 102 and the individual cryptographic slice 102_4 may be turned off (made inactive) to improve power efficiency, as described below. Figure 5 as discussed in step 512 of .

[0030] In some embodiments, each of the slice aggregation cryptographic systems discussed above further includes one or more cross-slice channels 110 between individual cryptographic slices and / or slice aggregation cryptographic slices. It should be appreciated that each cross-slice channel 110 is configured to propagate the generated metadata from one cryptographic slice to another cryptographic slice to achieve slice aggregation. In some embodiments, each cross-slice channel 110 may also be configured to broadcast common metadata to all individual cryptographic slices within the slice aggregation cryptographic slice, so that each slice resource can be cascaded, shared, and operated together between individual cryptographic slices based on the configuration of the slice aggregation cryptographic slice. As described above, because other cryptographic slices can reuse the resources of the low processing rate cryptographic slice, resource sharing within the slice aggregation cryptographic slice is cost-effective. In addition, since the slice aggregation cryptographic system does not rely on a time division multiplexing method, as discussed above, whether the cryptographic slice is a single cryptographic slice or aggregated with other cryptographic slices into one slice aggregation cryptographic slice, the data portion processed on each cryptographic slice or slice aggregation cryptographic slice is physically isolated from the data portion processed on other cryptographic slices, so this slice aggregation cryptographic system provides better data security.

[0031] In some embodiments, aggregating a plurality of individual crypto slices into a slice aggregated crypto slice includes: sharing / propagating information / metadata between the components of the individual crypto slices 102. In some embodiments, where the entry block 104 of the individual crypto slices 102 is based on a finite state machine, during the aggregation of the individual crypto slices 102, relevant information of the entry block 104, including but not limited to the next state, internal flags, saved data, and statistical counters of the entry block 104 based on the finite state machine, is propagated from one individual crypto slice 102 to the next individual crypto slice 102. In some embodiments, where the crypto engine 106 is based on mathematical logic, during the aggregation of the individual crypto slices, the operation results of the crypto engine 106, including but not limited to XOR results, multiplier results, and other cryptographic algorithm specific results of the crypto engine 106 based on mathematical logic, are propagated from one individual crypto slice to the next individual crypto slice. In some embodiments, where the exit block 108 of the individual crypto slice is also based on a finite state machine, relevant information of the exit block 108 is propagated from one individual crypto slice to the next individual crypto slice in a similar manner as the entry block 104. In some embodiments, the current data framing information and the final result are broadcast to all individual crypto slices 102 for resource sharing. In some embodiments, only a portion (e.g., one or more components) of the individual crypto slices 102 are aggregated by one of the slice-aggregated crypto slices, e.g., only the crypto engine 106 is aggregated across the individual crypto slices 102.

[0032] In some embodiments, each slice aggregation crypto slice is configured to process information / metadata based on the configuration of the slice aggregation crypto slice. Figure 5 is a sequence diagram illustrating an example of an operation for sharing metadata between crypto slices. Although the diagram depicts functional steps in a particular order for illustrative purposes, the process is not limited to any particular order or arrangement of steps. Those skilled in the relevant art will appreciate that the various steps depicted in the diagram may be omitted, rearranged, combined, and / or modified in various ways.

[0033] like Figure 5 As shown in the example of, first, at step 502, it is determined whether the individual crypto slice has been designated as a primary slice. If the individual crypto slice is a primary slice, the primary slice is configured to generate current data framing information of the crypto slice at step 504. Then, at step 506, it is determined whether the primary slice is the only crypto slice or part of a slice aggregate crypto slice (e.g., Figure 2 The cryptographic slice 102_1 in the cryptographic slice 202_1 of the slice aggregation Figure 3 The crypto slices 102_1 and 102_2 in the crypto slice 302 of the slice aggregation Figure 4 The primary slice is a crypto slice 102_2 in the slice aggregate crypto slice 402). If the primary slice is the only crypto slice, it ignores any incoming information / metadata and does not necessarily generate any metadata on its own. Otherwise, if the primary slice is determined to be part of a slice aggregate crypto slice with more than one individual crypto slice, even if it is not the primary slice (step 508), it obtains metadata from the previous individual crypto slice in the slice aggregate crypto slice and generates its own metadata accordingly at step 510. A non-primary crypto slice that is not part of a slice aggregate crypto slice is an invalid configuration, which means that the individual crypto slice and is used can be turned off at step 512 to improve power efficiency.

[0034] Figure 6 is a block diagram depicting a programmable integrated circuit (IC) 900 according to an example. The programmable IC 900 may be implemented in whole or in part. Figures 1 to 5 The programmable IC 900 includes a processing system 902, a programmable logic 904, a configuration logic 906, and a configuration memory 908. The programmable IC 900 may be coupled to external circuits such as a nonvolatile memory 910, a RAM 912, and other circuits 914.

[0035] The processing system 902 may include (multiple) microprocessors, memory, support circuits, IO circuits, etc. The programmable logic 904 includes a logic unit 916, a support circuit 918, and a programmable interconnect 920. The logic unit 916 includes a circuit that can be configured to implement a general logic function of multiple inputs. The support circuit 918 includes a dedicated circuit such as a transceiver, an input / output block, a digital signal processor, a memory, etc. The logic unit and the support circuit 918 can be interconnected using the programmable interconnect 920. Information for programming the logic unit 916, for setting parameters of the support circuit 918, and for programming the programmable interconnect 920 is stored in the configuration memory 908 by the configuration logic 906. The configuration logic 906 can obtain configuration data from the non-volatile memory 910 or any other source (e.g., RAM 912 or from other circuits 914).

[0036] Figure 7 The FPGA implementation of a programmable IC 900 is illustrated, which includes a number of different programmable blocks, including configurable logic blocks ("CLBs") 930, random access memory blocks ("BRAMs") 932, signal processing blocks ("DSPs") 934, input / output blocks ("IOBs") 936, configuration and clock logic ("CONFIG / CLOCKS") 938, digital transceivers 940, dedicated input / output blocks ("I / O") 942 (e.g., configuration ports and clock ports), and other programmable logic 944, such as digital clock managers, system monitoring logic, etc. The FPGA may also include a PCIe interface 946, an analog-to-digital converter (ADC) 948, etc.

[0037] In some FPGAs, each programmable block may include at least one programmable interconnect element ("INT") 950 having connections to input terminals and output terminals 952 of programmable logic elements within the same block, such as Figure 7 As shown in the examples included in . Each programmable interconnect element 950 may also include a connection to an interconnect segment 954 of one or more adjacent programmable interconnect elements in the same block or other blocks. Each programmable interconnect element 950 may also include a connection to an interconnect segment 956 of a general routing resource between logic blocks (not shown). General routing resources may include routing channels between logic blocks (not shown), which include tracks of interconnect segments (e.g., interconnect segments 956) and switch blocks (not shown) for connecting interconnect segments. The interconnect segments of general routing resources (e.g., interconnect segments 956) may span one or more logic blocks. The programmable interconnect elements 950, together with the general routing resources, implement a programmable interconnect structure ("programmable interconnect") for the illustrated FPGA.

[0038] In an example implementation, the CLB 930 may include a configurable logic element ("CLE") 960, which may be programmed to implement user logic; and a single programmable interconnect element ("INT") 950. The BRAM 932 may include a BRAM logic element ("BRL") 962 and one or more programmable interconnect elements. Typically, the number of interconnect elements included in a block depends on the height of the block. In the depicted example, a BRAM block has the same height as five CLBs, but other numbers (e.g., four) may also be used. In addition to an appropriate number of programmable interconnect elements, the signal processing block 934 may also include a DSP logic element ("DSPL") 964. In addition to one instance of the programmable interconnect element 950, the IOB 936 may also include, for example, two instances of an input / output logic element ("IOL") 966. It should be clear to those skilled in the art that, for example, the actual I / O pads connected to the input / output logic element 966 are generally not limited to the area of ​​the input / output logic element 966.

[0039] In the depicted example, a horizontal area near the center of the die is used for configuration logic, clock logic, and other control logic. Vertical columns 968 extending from this horizontal area or column are used to distribute clock and configuration signals across the width of the FPGA.

[0040] use Figure 7 Some FPGAs of the illustrated architecture include additional logic blocks that disrupt the regular columnar structure that makes up the majority of the FPGA. The additional logic blocks may be programmable blocks and / or dedicated logic.

[0041] Notice, Figure 7 The present invention is intended to illustrate an exemplary FPGA architecture. For example, the number of logic blocks in a row, the relative width of the rows, the number and order of the rows, the types of logic blocks included in the rows, the relative sizes of the logic blocks, and the Figure 7 The interconnect / logic implementation included at the top of is purely exemplary. For example, in a real FPGA, more than one adjacent CLB row is typically included wherever a CLB appears to facilitate efficient implementation of user logic, but the number of adjacent CLB rows varies with the overall size of the FPGA.

[0042] While the foregoing is directed to particular examples, other and further examples may be devised without departing from the basic scope thereof, and the scope of the same is determined by the claims that follow.

Claims

1. A system comprising: One or more slice-aggregated crypto slices, each slice-aggregated crypto slice being configured to perform a plurality of operations on an incoming data transmission at a first processing rate by aggregating one or more individual crypto slices, each crypto slice being configured to perform the plurality of operations on a portion of the incoming data transmission at a second processing rate, wherein each of the one or more individual crypto slices comprises at least the following components connected in series: an entry block configured to obtain the portion of the incoming data transfer at the second processing rate, notify a cryptographic engine of the required operation, and feed the portion of the incoming data transfer to the cryptographic engine; the cryptographic engine configured to perform the operation on the portion of the incoming data transmission; as well as an egress block configured to insert or remove a signature for the portion of the incoming data transfer and output the portion of the incoming data transfer once the operation has been completed; wherein the first processing rate of each slice aggregated crypto slice of the one or more slice aggregated crypto slices is equal to an aggregated second processing rate of the one or more individual crypto slices of the slice aggregated crypto slices, and At least one of the one or more slice aggregated crypto slices includes only one single crypto slice, and the one or more slice aggregated crypto slices are configured to perform the multiple operations on different parts of the incoming data transmission at different processing rates simultaneously.

2. The system of claim 1, wherein the plurality of operations is one or more of: generating or checking the signature of the data transmission for integrity, and encrypting or decrypting the data transmission for confidentiality.

3. The system of claim 1 , wherein each slice of the one or more slice aggregation crypto slices is configured to: Once the individual crypto slices have completed processing their respective portions of the data transfer, the outputs of the egress blocks from the one or more individual crypto slices are merged into one data output for further transmission and / or processing, wherein the portion of the incoming data transfer processed on one slice aggregate crypto slice is physically isolated from the portion of the incoming data transfer processed on other slice aggregate crypto slices.

4. The system according to claim 1, wherein at least one slice aggregated cipher slice of the one or more slice aggregated cipher slices includes more than one individual cipher slice, and wherein the first processing rate of the at least one slice aggregated cipher slice of the one or more slice aggregated cipher slices is higher than the second processing rate of the one individual cipher slice.

5. The system according to claim 1, further comprising: One or more cross-slice channels in the slice aggregation crypto slice, wherein each of the one or more cross-slice channels is configured to propagate information generated from one slice aggregation crypto slice to another slice aggregation crypto slice to achieve slice aggregation, wherein each of the one or more cross-slice channels is further configured to broadcast common information to all individual crypto slices within the slice aggregation crypto slice, wherein per-slice resources are cascaded, shared and operated together between the individual crypto slices based on the configuration of the slice aggregation crypto slice.

6. The system of claim 1, wherein one of the one or more slice-aggregation crypto slices is configured to aggregate only a portion of the one or more individual crypto slices.

7. The system of claim 1, wherein aggregating the one or more individual crypto slices into a slice aggregated crypto slice comprises: Information is shared between the components of the separate crypto slices.

8. The system of claim 7, wherein during aggregation of the individual crypto slices, relevant information of the entry blocks is propagated from one individual crypto slice to the next crypto slice, wherein the entry blocks of the individual crypto slices are based on a finite state machine.

9. The system of claim 7, wherein during aggregation of the individual cryptographic slices, operation results of the cryptographic engine are propagated from one individual cryptographic slice to the next individual cryptographic slice, wherein the cryptographic engine is based on mathematical logic.

10. The system of claim 7, wherein relevant information of the egress block is propagated from one individual crypto slice to the next individual crypto slice, wherein the egress blocks of the individual crypto slices are based on a finite state machine.

11. The system of claim 7, wherein current data framing information and final results are broadcast to all individual crypto slices for resource sharing.

12. The system of claim 7, wherein each slice of the one or more slice aggregation crypto slices is configured to process and share the information based on a configuration of the slice aggregation crypto slice.

13. A method for protecting data transmission, comprising: Aggregating one or more individual crypto slices into a slice aggregated crypto slice, wherein each slice is configured to perform a plurality of operations on an incoming data transfer at a first processing rate, wherein each individual crypto slice of the one or more individual crypto slices comprises at least the following components connected in series: an entry block configured to obtain a portion of the incoming data transfer at a second processing rate, notify a cryptographic engine of the required operation, and feed the portion of the incoming data transfer to the cryptographic engine; the cryptographic engine configured to perform the operation on the portion of the incoming data transfer; as well as an egress block configured to, once the operation is completed, insert or remove a signature for the portion of the incoming data transfer and output the portion of the incoming data transfer; splitting portions of the incoming data transfer and feeding them into the ingress blocks of the one or more individual crypto slices in the slice aggregate crypto slice, wherein each of the one or more individual crypto slices is configured to perform the plurality of operations on a portion of the incoming data transfer at the second processing rate, wherein the first processing rate of the slice aggregate crypto slice is equal to an aggregated second processing rate of the one or more individual crypto slices in the slice aggregate crypto slice; as well as Once the individual crypto slices have completed processing their respective portions of the data transfer, the outputs of the egress blocks from the one or more individual crypto slices in the slice aggregate crypto slice are merged into one data output for further transmission and / or processing.

14. The method according to claim 13, further comprising: The portion of the incoming data transfer processed on one slice aggregation crypto slice is physically isolated from the portion of the incoming data transfer processed on other slice aggregation crypto slices.

15. The method according to claim 14, further comprising: Propagate information generated from one individual crypto slice to another individual crypto slice to achieve slice aggregation; as well as broadcasting common information to all individual crypto slices within the slice aggregate crypto slice, wherein per-slice resources are cascaded, shared and operated together between the individual crypto slices based on the configuration of the slice aggregate crypto slice, At least one of the slice-aggregated crypto slices comprises only one single crypto slice, wherein the slice-aggregated crypto slice is configured to perform the plurality of operations on different portions of the incoming data transfer simultaneously at different processing rates.

Images