Circuit and method for ensuring interconnect security with a multi-chip integrated circuit package

• US 6,209,098 B1
• Filed: 09/21/1998
• Issued: 03/27/2001
• Est. Priority Date: 10/25/1996
• Status: Expired due to Term

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Davis, Derek L.
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US09/158,344
• Time in Patent Office: 918 Days
• Field of Search: 380/49, 380/4
• US Class Current: 713/194
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2207/7219 Countermeasures against side channel or fault attacks
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Circuitry implemented within a multi-chip module comprising a first integrated circuit chip and a second integrated circuit chip coupled together through an interconnect. Both the first and second integrated circuit chips include a cryptographic engine coupled to the interconnect and a non-volatile memory element used to contain key information. These cryptographic engines are solely used to encrypt outgoing information being output across the interconnect or to decrypt incoming information received from the interconnect. This prevents fraudulent physical attack of information transmitted across the interconnect.

Claims

1. An apparatus comprising:

an interconnect;

a first integrated circuit coupled to the interconnect, the first integrated circuit including a first cryptographic engine;

a second integrated circuit coupled to the interconnect, the second integrated circuit including a second cryptographic engine; and

a package to contain the first integrated circuit, the second integrated circuit and the interconnect.

2. The apparatus of claim 1, wherein the first integrated circuit further includes a non-volatile memory element, the non-volatile memory element to contain key information to be used by the first cryptographic engine to encrypt outgoing digital information before transmission over the interconnect.

3. The apparatus of claim 1, wherein the first integrated circuit further includes a non-volatile memory element, the non-volatile memory element to control key information to be used by the first cryptographic engine to decrypt incoming digital information received over the interconnect.

4. The apparatus according to claim 1, wherein the second integrated circuit further includes a non-volatile memory element, the non-volatile memory element to contain key information to be used by the second cryptographic engine to encrypt outgoing digital information before transmission over the interconnect.

5. The apparatus of claim 1, wherein the non-volatile memory to contain key information to be used by the second integrated circuit to decrypt incoming digital information received over the interconnect.

6. The apparatus of claim 1, wherein the first integrated circuit to execute a stream cipher algorithm to encrypt the outgoing digital information and alternatively to decrypt the incoming digital information.

7. The apparatus of claim 1, wherein the first integrated circuit includes logic circuitry and an on-chip, non-volatile memory element, the on-chip, non-volatile memory element to contain key information to be used by the first cryptographic engine to establish a session key used to encrypt digital information before transmission over the interconnect and to decrypt incoming digital information received by the first cryptographic engine over the interconnect.

8. The apparatus of claim 7 further including a random number generator contained in the package.

9. The apparatus of claim 8, wherein the random number generator to generate information used to produce at least the key information.

10. The apparatus of claim 1, wherein the package includes a multi-chip semiconductor package.

11. The apparatus of claim 1, wherein the package includes a circuit board upon which both the first integrated circuit and the second integrated circuit are mounted.

12. The apparatus of claim 1, wherein the first integrated circuit includes a processor.

13. The apparatus of claim 12, wherein the second integrated circuit includes non-volatile memory.

14. A computer system comprising:

a memory element; and

a processing unit coupled to the memory element, the processing unit including

a first integrated circuit including a first cryptographic engine,

a second integrated circuit including a second cryptographic engine,

an interconnect coupled to both the first integrated circuit and the second integrated circuit, and

a package containing the first integrated circuit, the second integrated circuit and the interconnect.

15. The computer system of claim 14, wherein the first integrated circuit of the processing unit including a first internal memory element to contain key information used by the first cryptographic engine to encrypt outgoing digital information over the interconnect.

16. The computer system of claim 15, wherein the first cryptographic engine of the first integrated circuit to decrypt incoming digital information received by the processing unit.

17. The computer system according to claim 15, wherein the first integrated circuit of the processing unit to execute a stream cipher algorithm to encrypt the outgoing digital information and alternatively to decrypt incoming digital information.

18. The computer system according to claim 16, wherein the first integrated circuit of the processing unit includes a processor core, including the first cryptographic engine and the first internal memory element, to contain key information to be used by the first cryptographic engine to establish a session key used to encrypt the outgoing digital information and to decrypt the incoming digital information.

19. The computer system of claim 14, wherein the second integrated circuit of the processing unit includes a non-volatile memory element, the non-volatile memory element to contain key information used by the second cryptographic engine to encrypt the outgoing digital information.

20. The computer system of claim 14, wherein the second cryptographic engine of the second integrated circuit to decrypt incoming digital information received over the interconnect.

21. A method of transferring digital information between a first integrated circuit and a second integrated circuit implemented within a multi-chip module, the method comprising:

generating a session key by the first integrated circuit;

encrypting the session key with a symmetric key stored in a non-volatile memory element of the first integrated circuit to produce a message; and

outputting the message for decryption by the symmetric key stored in the second integrated circuit to retrieve the session key used for subsequent communications between the first integrated circuit and the second integrated circuit.

22. A method for initialization of a multi-chip module having at least two integrated circuit chips connected together by an interconnect, the method comprising:

implementing a static key into a first integrated circuit chip and a second integrated circuit chip;

packaging the first integrated circuit chip and the second integrated circuit chip into the multi-chip module;

powering the first integrated circuit to randomly generate a key is loaded into the first integrated circuit;

encrypting the key with the static key to produce a message; and

transferring the message to the second integrated circuit to recover the key, the key used to secure communications between the first integrated circuit and the second integrated circuit.