Secure System-on-Chip Encryption Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current system-on-chip security solutions lack a comprehensive mechanism to ensure continuous data encryption and decryption within the chip, leaving data vulnerable during processing and storage, especially in scenarios where secure memory access and external data transmission are concerned.
Innovation Solution
A system-on-chip design incorporating an input encryption module and an output decryption module, with an encryption/decryption engine, ensures that all data entering and exiting the chip are encrypted, and processed in a secure manner, using a unique key for internal encryption and decryption operations, optionally employing asymmetric algorithms or signature verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data are decrypted and stored in clear memory for processing, then processing speed and accessibility are improved, but data security deteriorates as clear data become vulnerable to access
Solution Approach 1:
Data are encrypted before being stored in memory using an encryption engine with a secret key. This preliminary encryption action ensures that even if memory is compromised, the data remain protected. The encryption occurs before storage, preventing clear data from ever being at rest in memory.
Solution Approach 2:
The system changes the state of data from clear to encrypted using cryptographic transformation. By applying encryption algorithms with secret keys, the data parameters are fundamentally altered, making them unintelligible without the proper decryption key, thus maintaining security while allowing processing of encrypted data.
2Reliability
If encryption is applied only at input and output channels, then transmission security is improved, but internal data security deteriorates as processed data remain vulnerable
Solution Approach 1:
Encryption is applied continuously throughout the entire data lifecycle within the system - at input, during storage, during processing, and at output. This continuous encryption approach ensures that data are never in clear state internally, maintaining security throughout all operations rather than only at transmission points.
Solution Approach 2:
The encryption system is segmented into multiple components: an input encryption module, an internal encryption engine with secret key, and an output decryption module. Each segment performs encryption at its specific stage, creating layered security that protects data at all points in the processing pipeline.
3Reliability
If data are kept encrypted during processing, then data security is improved, but processing complexity increases due to continuous encryption/decryption operations
Solution Approach 1:
The encryption and decryption functions are merged into a single encryption engine that can operate in both modes. By combining these functions and using a secret key for both encryption and decryption operations, the system reduces the number of separate components needed while maintaining continuous encryption protection throughout the data processing pipeline.
Data Source
Figure 1~2B
Figure 3
AI summary
The aim of the present invention is to provide a secure system-on-chip for processing data, this system-on-chip comprising at least a central processing unit, an input and an output channel, an encryption/decryption engine and a memory, characterized in that, said input channel comprises an input encryption module to encrypt all incoming data, said output channel comprising an output decryption module to decrypt all outgoing data, said central processing unit receiving the encrypted data from the input encryption module and storing them in the memory, and while processing the stored data, said central processing unit reading the stored data from the memory, requesting decryption of same in the encryption/decryption engine, processing the data and requesting encryption of the result by the encryption/decryption engine and storing the encrypted result, outputting the result to the output decryption module for decryption purpose and exiting the decrypted result via the output channel.