Cryptographic Module Monitoring Cache Unit for SoC Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cryptographic modules in integrated circuits, such as System-on-Chip devices, face challenges in reducing power usage and computing time during encryption and decryption processes, while also being vulnerable to side channel attacks like Power Analysis and Differential Power Analysis due to repetitive operations and limited memory capacity.
Innovation Solution
A monitoring cache unit is introduced to supervise the cryptographic module, checking for repeated input data and commands, allowing for cached results to be reused instead of recalculating, and employing obfuscation and AI analysis to detect operational patterns and enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the cryptographic module performs encryption and decryption operations repeatedly on the same data, then the security against side channel attacks is improved by detecting patterns, but the power consumption and computing time increase due to redundant calculations
Solution Approach 1:
The monitoring cache unit stores previously processed input data and their corresponding encryption/decryption results in advance. When the same input data is received again, the system retrieves the pre-stored results from the cache instead of performing redundant cryptographic calculations, thereby reducing power consumption while maintaining security through pattern detection
Solution Approach 2:
The system creates a copy of previously processed data and results in the monitoring cache unit. Instead of recalculating encryption/decryption on identical input data, the system uses the cached copy of results, reducing computational energy expenditure while the monitoring unit detects repeated patterns to maintain security
2Reliability
If the cryptographic module processes all input data through full encryption/decryption operations, then the computing accuracy and security are maintained, but the processing time increases for repeated operations on the same data
Solution Approach 1:
The monitoring cache unit performs preliminary storage of input data and their corresponding cryptographic results. When identical input data is detected, the system immediately retrieves the pre-computed results from cache, avoiding redundant processing time while the monitoring unit continues to detect patterns for security purposes
Solution Approach 2:
The monitoring cache unit serves itself by storing and retrieving cryptographic results without requiring repeated full processing. The system automatically identifies repeated input data and serves the cached results directly, reducing processing time while maintaining security through continuous pattern monitoring
3Device complexity
If the memory capacity is limited in the integrated circuit, then the device complexity is reduced, but the ability to cache and reuse encryption/decryption results is constrained
Solution Approach 1:
The monitoring system is segmented into a separate monitoring cache unit that operates independently from the main cryptographic processing. This segmentation allows the cache to store frequently accessed data and results without requiring large overall memory capacity, improving performance through selective caching while maintaining manageable device complexity
Solution Approach 2:
The monitoring cache unit provides localized caching capability specifically for cryptographic operations that benefit from result reuse. Instead of requiring large universal memory capacity, the system applies caching selectively where it provides the most performance benefit, balancing memory constraints with productivity improvements
Data Source
Figure 1
Figure 2
AI summary
The invention relates to a method and a system for performance improvement of a cryptographic module (CRY), which is part of an integrated circuit, especially of a so-called System-on-Chip device or SoC device. Input data (D_in) to be encrypted or decrypted are received by the cryptographic module (CRY) and by a monitoring cache unit (CC, 101), which supervises the cryptographic module (CRY). Additionally, a corresponding command (Com) to encrypt or to decrypt the input data (D_in) is received (101). Then the monitoring cache unit (CC) checks (102), if the input data (D_in) to be encrypted or decrypted and the corresponding command (Com) were received previously, for example by checking if the input data (D_in) and the corresponding command (Com) are already stored in a memory unit (MEM) associated with the monitoring cache unit (CC). If the input data (D_in) and the corresponding command (Com) were received previously, e.g. found in the memory unit (MEM), corresponding encrypted or decrypted data (D_out_M) based on the input data (D_in) are read out from the memory unit (MEM, 103) and provided as output data (D_out, 106). If the input data (D_in) and the corresponding command (Com) were not received before, e.g. they are not found in the memory unit (MEM), the monitoring cache unit (CC) triggers the cryptographic module (CRY) to encrypt or decrypt the input data (104). The cryptographic module (CRY) then provides calculated encrypted or decrypted data (D_out_C, 105) as output data (D_out, 106) which are also saved together with the input data (D_in) and the corresponding command (Com) in the memory unit (MEM) associated with the monitoring cache unit (CC, 105).