Shared Encryption Pipeline for Multiple Security Modes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current hardware security solutions for computing devices face challenges in efficiently sharing hardware encryption pipelines across multiple encryption modes, leading to increased processing overhead, memory usage, and bandwidth consumption, which can result in performance degradation and higher costs due to the need for customized devices to accommodate various security levels.
Innovation Solution
Implementing a shared encryption/decryption pipeline that can perform both AES-CTR and AES-XTS encryption modes, with pre- and post-computation blocks handling initial and final encryption stages, respectively, to minimize on-die space and optimize performance and memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If separate encryption pipelines are implemented for different encryption modes, then each security solution can be provided, but the on-die area increases significantly
Solution Approach 1:
The patent combines multiple encryption pipelines (AES-CTR and AES-XTS) into a single shared pipeline by merging common functional blocks such as the AES core, substitution boxes, and permutation layers. This allows both encryption modes to operate using shared hardware resources, significantly reducing the total on-die area while maintaining support for multiple encryption modes through configuration control.
Solution Approach 2:
The shared encryption pipeline is designed to perform multiple encryption modes (AES-CTR and AES-XTS) using the same hardware infrastructure. The pipeline includes configurable components that can be dynamically adjusted to support different encryption algorithms and modes, making the hardware universal and adaptable to various security requirements without requiring separate dedicated pipelines for each mode.
2Adaptability or versatility
If multiple security solutions are implemented in the same device, then comprehensive security coverage is achieved, but the device complexity and manufacturing cost increase
Solution Approach 1:
The encryption pipeline is segmented into distinct functional blocks including pre-computation units, the core AES encryption engine, and post-computation units. Each segment can be independently configured and controlled to support different encryption modes. This modular segmentation allows the same hardware to provide multiple security solutions while managing complexity through structured organization and independent control of each segment.
3Reliability
If hardware encryption pipelines are added for security protection, then data security is improved, but processing overhead increases and performance decreases
Solution Approach 1:
The encryption pipeline incorporates pre-computation blocks that perform preliminary processing of encryption data before it enters the main AES encryption core. These pre-computation units prepare the input data in advance, optimizing it for the encryption operation and reducing the processing burden on the main pipeline, thereby minimizing performance impact while maintaining strong security protection.
Data Source
AI summary
A processing or memory device may include a first encryption pipeline to encrypt and decrypt data with a first encryption mode and a second encryption pipeline to encrypt and decrypt data with a second encryption mode, wherein the first encryption pipeline and the second encryption pipeline share a single, shared pipeline for a majority of encryption and decryption operations performed by the first encryption pipeline and by the second encryption pipeline. A controller (and/or other logic) may direct selection of encrypted (or decrypted) data from the first and second encryption pipelines responsive to a region of memory to which a physical address of a memory request is directed. The result of the selection may result in bypassing encryption/decryption or encrypting/decrypting the data according to the first encryption mode or the second encryption mode. More than two encryption modes are envisioned.