Multi-tile Encryption Key Selection via Tile Identifier Bits
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In systems where data is processed by an accelerator subsystem and stored externally, identifying the appropriate key for decryption is non-trivial, especially when multiple users with different encryption keys need to keep their data confidential from both malicious third parties and each other.
Innovation Solution
An integrated circuit with a processing unit and encryption unit, where processors are divided into sets associated with different keys, allowing identifier bits in read or write requests to determine the correct key for decryption or encryption operations, thereby enabling secure and separate processing of data sets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple different keys are used to encrypt data from different users, then data confidentiality among users is improved, but the complexity of identifying the correct decryption key increases
Solution Approach 1:
The system segments the processing unit into multiple sets of processors, where each set is associated with a specific encryption key. This segmentation allows the system to maintain multiple keys for different users while providing a clear organizational structure that simplifies key identification through the set association mechanism.
Solution Approach 2:
The patent introduces an intermediary mechanism (the association between processor sets and keys, mediated through identifier bits in read completions) that bridges the gap between multiple encrypted data streams and their corresponding decryption keys. This intermediary structure enables automatic key selection without requiring complex identification logic at the decryption point.
2Measurement precision
If identifier bits are added to read completions to indicate the correct key, then key identification accuracy is improved, but the data transfer overhead increases
Solution Approach 1:
Instead of transmitting full key information or complex identification data, the system uses partial information in the form of identifier bits that are sufficient to indicate the correct key association. This partial action approach minimizes the additional data overhead while maintaining accurate key identification.
Solution Approach 2:
The identifier bits are locally embedded within the read completion structure at the point where key identification is needed. This local quality approach allows the identification information to be available exactly where required without requiring global changes to the data transfer protocol or extensive additional communication overhead.
3Ease of operation
If processors are divided into sets associated with different keys, then key management is simplified, but the processing unit complexity increases
Solution Approach 1:
The processing unit is designed with universal structures that can handle multiple keys through the set-based organization. Each set of processors can be associated with different keys, allowing the same processing unit to universally handle encrypted data from multiple users without requiring separate dedicated hardware for each key, thus simplifying key management while controlling complexity.
Solution Approach 2:
The patent introduces an additional organizational dimension by grouping processors into sets and associating each set with a specific key. This dimensional organization (processors → sets → keys) provides a structured hierarchy that simplifies key management operations while the modular set structure helps control the overall complexity by creating clear boundaries and associations.
Data Source
AI summary
A system and method for encrypting and decrypting data exchanged between a multi-tile processing unit and a storage, where a plurality of keys are used for the encryption. Each of the plurality of keys is associated with a different one or more sets of the processors. Encryption hardware is configured to select a key to use for encryption/decryption operations in dependence upon the set of tiles associated with the data being exchanged. Each write request from a tile contains identifier bits associated with that tile's set of tiles, enabling the encryption hardware to select the key to use for encrypting the data in the write request. Each read completion for a tile contains identifier bits associated with that tile's set of tiles, enabling the encryption hardware to select the key to use for decrypting the data in the read completion.