Cipher Alignment Using Encrypted Counters for Unaligned Packets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cryptographic systems face challenges with unaligned data blocks, leading to increased complexity, latency, and vulnerability to attacks due to predictable patterns, especially in high-performance applications like PCIe and CXL, where inserting bubble cycles is not feasible.
Innovation Solution
The proposed solution involves restructuring cryptographic transformation logic and universal hash calculation logic to accept unaligned incoming data blocks, eliminating the need to build blocks and over-provision cryptographic engines, by aligning generated encrypted counter values to natural block boundaries and processing partial blocks efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data is transmitted in a streaming fashion through cryptographic operations, then processing speed and throughput are improved, but data misalignment with hardware data bus occurs, resulting in additional complexity for reformatting and realigning
Solution Approach 1:
The cryptographic processing system is divided into separate functional units: a streaming cryptographic operation unit that processes data in streams, and a separate alignment/unit conversion system that handles data format transitions. This segmentation allows each unit to optimize for its specific function without compromising the other.
Solution Approach 2:
An intermediate data alignment buffer or conversion layer is introduced between the streaming cryptographic processor and the hardware data bus. This intermediary component absorbs the misalignment issues by providing a buffer zone where data can be temporarily stored and realigned without blocking the main processing flow.
2Manufacturing precision
If additional processing is performed to handle unaligned data blocks, then data alignment is achieved, but latency increases
Solution Approach 1:
The system performs preliminary alignment operations by maintaining alignment state information in advance within the cryptographic processing unit. This allows the unit to proactively prepare aligned data blocks before they are needed by downstream components, eliminating the need for time-consuming real-time alignment operations.
Solution Approach 2:
The cryptographic processing system maintains continuous operation by overlapping alignment operations with processing operations. While one data block is being aligned, another block can be processed, ensuring that the processing pipeline remains full and productive without idle waiting periods.
3Ease of operation
If block building operations are performed on unaligned incoming data streams, then cryptographic processing can proceed, but performance degradation occurs due to additional processing requirements
Solution Approach 1:
Instead of attempting to build complete blocks from unaligned data streams (the conventional approach), the system inverts the approach by processing data in the natural streaming order and handling partial blocks at the boundaries. This inversion eliminates the need for complex block-building logic that causes performance degradation.
Solution Approach 2:
The system accepts and processes partial blocks as they arrive in the data stream without requiring complete blocks. This partial action approach allows processing to continue with whatever data is available, rather than waiting for complete blocks, thereby maintaining high processing throughput.
4Manufacturing precision
If delay is inserted in text bytes and AAD bytes during block building stage, then block alignment can be achieved, but data accumulation exceeds hardware bus width, requiring additional memory and causing latency
Solution Approach 1:
The system changes the fundamental parameter of how alignment is achieved: instead of delaying data to force alignment with hardware bus width, it dynamically adjusts the cryptographic processing parameters (such as block size and processing granularity) to match the incoming data stream characteristics, eliminating the need for large accumulation buffers.
Data Source
AI summary
A cryptographic system includes a block transfer engine and a crypto map unit. The block transfer engine is configured to receive a plurality of encrypted counter values and a plurality of packet attributes. The block transfer engine is further configured to determine a subset of encrypted counter values from the plurality of counter values that is to be used to encrypt a subset of incoming packets from a plurality of incoming packets. Encrypted counter values other than the subset of encrypted counter values are stored for later encryption use.The crypto map unit is configured to receive the plurality of incoming packets and the subset of encrypted counter values from the block transfer engine. The crypto map unit is further configured to encrypt the subset of incoming packets from the received plurality of incoming packets with the subset of encrypted counter values.