Microprocessor that fetches and decrypts encrypted instructions in same time as plain text instructions

• US 8,671,285 B2
• Filed: 04/21/2011
• Issued: 03/11/2014
• Est. Priority Date: 05/25/2010
• Status: Active Grant

• Current Assignee: VIA Technologies Incorporated (VIA Technologies)
• Original Assignee: VIA Technologies Incorporated (VIA Technologies)
• Inventors: Henry, G. Glenn, Parks, Terry, Bean, Brent, Crispin, Thomas A.
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US13/091,487
• Publication Number:
  US 20120096282A1
• Time in Patent Office: 1,055 Days
• Field of Search: 713/190, 713/192
• US Class Current: 713/190
• CPC Class Codes: G06F 12/0875 with dedicated cache, e.g. instruction or stack
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: G06F 2212/452 Instruction code
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 9/30003 Arrangements for executing specific machine instructions
• CPC Class Codes: G06F 9/30058 Conditional branch instructions
• CPC Class Codes: G06F 9/30079 Pipeline control instructions, e.g. multicycle NOP
• CPC Class Codes: G06F 9/30178 of compressed or encrypted instructions
• CPC Class Codes: G06F 9/30189 according to execution mode, e.g. mode flag
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/20 Manipulating the length of blocks of bits, e.g. padding or block truncation
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A fetch unit (a) fetches a block of instruction data from an instruction cache of the microprocessor; (b) performs an XOR on the block with a data entity to generate plain text instruction data; and (c) provides the plain text instruction data to an instruction decode unit. In a first instance the block comprises encrypted instruction data and the data entity is a decryption key. In a second instance the block comprises unencrypted instruction data and the data entity is Boolean zeroes. The time required to perform (a), (b), and (c) is the same in the first and second instances regardless of whether the block is encrypted or unencrypted. A decryption key generator selects first and second keys from a plurality of keys, rotates the first key, and adds/subtracts the rotated first key to/from the second key, all based on portions of the fetch address, to generate the decryption key.

Claims

1. A microprocessor, comprising:

an instruction cache;

an instruction decode unit; and

a fetch unit, configured to;

(a) fetch a block of instruction data from the instruction cache;

(b) perform a Boolean exclusive-OR (XOR) operation on the block with a data entity to generate plain text instruction data; and

(c) provide the plain text instruction data to the instruction decode unit;

wherein in a first instance the block comprises encrypted instruction data and the data entity is a decryption key;

wherein in a second instance the block comprises unencrypted instruction data and the data entity is Boolean zeroes;

wherein the microprocessor is configured to use equal amounts of time to perform feats (a), (b), and (c) in the first and second instances regardless of whether the block of instruction data is encrypted or unencrypted;

wherein the plain text instruction data decrypted from the encrypted instruction data is unobservable outside the microprocessor; and

wherein the time to perform said feats (a), (b), and (c) is the same independent of whether a branch instruction is present or absent within the fetched block of instruction data.

2. The microprocessor of claim 1, wherein the decryption key is a function only of a portion of a fetch address and a plurality of key values.

3. The microprocessor of claim 1, wherein to generate the decryption key as a function of a fetch address and a plurality of key values, the fetch unit is configured to:

select a first key value and a second key value of the plurality of key values based on a first portion of the fetch address;

rotate the first key value based on a second portion of the fetch address;

add or subtract the rotated selected key value to or from the second key value based on a third portion of the fetch address to generate the decryption key.

4. The microprocessor of claim 1, wherein a plurality of key values is K, wherein a width of the decryption key and each of the plurality of key values is W bytes, wherein the fetch unit is configured to generate a sequence of decryption keys for a sequence of blocks of instruction data fetched from the instruction cache to yield approximately W²* (K!/(2*(K−

2)!)) different combination of bytes of the plurality of key values with which to decrypt the sequence of fetched blocks.

5. A microprocessor, comprising:

an instruction cache;

an instruction decode unit; and

a fetch unit, configured to;

(a) fetch a block of instruction data from the instruction cache;

(b) perform a Boolean exclusive-OR (XOR) operation on the block with a data entity to generate plain text instruction data; and

(c) provide the plain text instruction data to the instruction decode unit;

wherein in a first instance the block comprises encrypted instruction data and the data entity is a decryption key;

wherein in a second instance the block comprises unencrypted instruction data and the data entity is Boolean zeroes;

wherein the microprocessor is configured to use equal amounts of time to perform feats (a), (b), and (c) in the first and second instances regardless of whether the block of instruction data is encrypted or unencrypted;

wherein to fetch the block of instruction data from the instruction cache the fetch unit is configured to apply a fetch address to the instruction cache, wherein the fetch unit if further configured to generate the decryption key as a function of a portion of the fetch address and a plurality of key values within a time required to fetch the block of instruction data from the instruction cache.

6. The microprocessor of claim 5, wherein the decryption key is a function only of the portion of the fetch address and the plurality of key values.

7. The microprocessor of claim 5, wherein to generate the decryption key as a function of the fetch address and the plurality of key values, the fetch unit is configured to:

select a first key value and a second key value of the plurality of key values based on a first portion of the fetch address;

rotate the first key value based on a second portion of the fetch address;

add or subtract the rotated selected key value to or from the second key value based on a third portion of the fetch address to generate the decryption key.

8. The microprocessor of claim 5, wherein the plurality of key values is K, wherein a width of the decryption key and each of the plurality of key values is W bytes, wherein the fetch unit is configured to generate a sequence of decryption keys for a sequence of blocks of instruction data fetched from the instruction cache to yield approximately W²*(K!/(2*(K−

2)!)) different combination of bytes of the plurality of key values with which to decrypt the sequence of fetched blocks.

9. A microprocessor, comprising:

an instruction cache;

an instruction decode unit; and

a fetch unit, configured to;

(a) fetch a block of instruction data from the instruction cache;

(b) perform a Boolean exclusive-OR (XOR) operation on the block with a data entity to generate plain text instruction data; and

(c) provide the plain text instruction data to the instruction decode unit;

wherein in a first instance the block comprises encrypted instruction data and the data entity is a decryption key;

wherein in a second instance the block comprises unencrypted instruction data and the data entity is Boolean zeroes;

wherein the microprocessor is configured to use equal amounts of time to perform feats (a), (b), and (c) in the first and second instances regardless of whether the block of instruction data is encrypted or unencrypted;

wherein the fetch unit comprises;

a control bit, configured to store an indication of whether the fetch unit is in a decryption mode or a plain text mode;

a multiplexer, comprising;

an output;

a first data input configured to receive the decryption key;

a second data input, configured to receive the Boolean zeroes; and

a selection control input, configured to receive the value of the control bit and to cause the decryption key to be provided on the output when the value of the control bit indicates the decryption mode in the first instance and to cause the Boolean zeroes to be provided on the output when the value of the control bit indicates the plain text mode in the second instance; and

an XOR gate, comprising;

a first data input, configured to the output of the multiplexer;

a second data input, configured to receive the fetched block of instruction data; and

an output, coupled to the instruction decode unit for providing the plain text instruction data which is the Boolean XOR of the first and second data inputs.

10. The microprocessor of claim 9, wherein the decryption key is a function only of a portion of a fetch address and a plurality of key values.

11. The microprocessor of claim 9, wherein to generate the decryption key as a function of a fetch address and a plurality of key values, the fetch unit is configured to:

select a first key value and a second key value of the plurality of key values based on a first portion of the fetch address;

rotate the first key value based on a second portion of the fetch address;

add or subtract the rotated selected key value to or from the second key value based on a third portion of the fetch address to generate the decryption key.

12. The microprocessor of claim 9, wherein a plurality of key values is K, wherein a width of the decryption key and each of the plurality of key values is W bytes, wherein the fetch unit is configured to generate a sequence of decryption keys for a sequence of blocks of instruction data fetched from the instruction cache to yield approximately W²*(K!/(2*(K−

2)!)) different combination of bytes of the plurality of key values with which to decrypt the sequence of fetched blocks.

13. A method for operating a microprocessor having an instruction cache, the method comprising the following computer-implemented steps:

(a) fetching a block of instruction data from the instruction cache;

(b) performing a Boolean exclusive-OR (XOR) operation on the block with a data entity for generating plain text instruction data; and

(c) providing the plain text instruction data to an instruction decode unit;

wherein in a first instance the block comprises encrypted instruction data and the data entity is a decryption key;

wherein in a second instance the block comprises unencrypted instruction data and the data entity is Boolean zeroes;

wherein the microprocessor is configured to use equal amounts of time to perform said feats (a), (b), and (c) in the first and second instances regardless of whether the block of instruction data is encrypted or unencrypted;

wherein the plain text instruction data decrypted from the encrypted instruction data is unobservable outside the microprocessor; and

wherein the time to perform said feats (a), (b), and (c) is the same independent of whether a branch instruction is present or absent within the fetched block of instruction data.

14. The method of claim 13, wherein the decryption key is a function only of a portion of a fetch address and a plurality of key values.

15. The method of claim 13, wherein the decryption key is generated as a function of a fetch address and a plurality of key values by:

selecting a first key value and a second key value of the plurality of key values based on a first portion of the fetch address;

rotating the first key value based on a second portion of the fetch address; and

adding or subtracting the rotated selected key value to or from the second key value based on a third portion of the fetch address to generate the decryption key.

16. The method of claim 15, wherein the plurality of key values is K, wherein a width of the decryption key and each of the plurality of key values is W bytes, wherein said selecting, rotating, and adding or subtracting yields approximately W²*(K!/(2*(K−

2)!)) different combination of bytes of the plurality of key values over a sequence of fetch addresses used to fetch a sequence of blocks of instruction data from the instruction cache.

17. The method of claim 13, wherein said generating the decryption key as a function of a fetch address and a plurality of key values for a plurality of sequential blocks of instruction data yields an effective decryption key length of approximately W²*(K!/(2*(K−

2)!)) bytes, wherein width of the decryption key and each of the plurality of key values is W bytes, wherein the plurality of key values is K.

18. A method for operating a microprocessor having an instruction cache, the method comprising the following computer-implemented steps:

(a) fetching a block of instruction data from the instruction cache by applying a fetch address to the instruction cache;

(b) performing a Boolean exclusive-OR (XOR) operation on the block with a data entity for generating plain text instruction data; and

(c) providing the plain text instruction data to an instruction decode unit;

wherein in a first instance the block comprises encrypted instruction data and the data entity is a decryption key, which is generated as a function of a portion of the fetch address and a plurality of key values;

wherein in a second instance the block comprises unencrypted instruction data and the data entity is Boolean zeroes;

wherein the microprocessor is configured to use equal amounts of time to perform said feats (a), (b), and (c) in the first and second instances regardless of whether the block of instruction data is encrypted or unencrypted;

wherein said generating the decryption key is performed within a time required to perform said fetching the block of instruction data from the instruction cache.

19. The method of claim 18, wherein the decryption key is a function only of the portion of the fetch address and the plurality of key values.

20. The method of claim 18, wherein the decryption key is generated as a function of the fetch address and the plurality of key values by:

selecting a first key value and a second key value of the plurality of key values based on a first portion of the fetch address;

rotating the first key value based on a second portion of the fetch address; and

adding or subtracting the rotated selected key value to or from the second key value based on a third portion of the fetch address to generate the decryption key.

21. The method of claim 20, wherein the plurality of key values is K, wherein a width of the decryption key and each of the plurality of key values is W bytes, wherein said selecting, rotating, and adding or subtracting yields approximately W²*(K!/(2*(K−

2)!)) different combination of bytes of the plurality of key values over a sequence of fetch addresses used to fetch a sequence of blocks of instruction data from the instruction cache.

22. The method of claim 18, wherein said generating the decryption key as a function of the fetch address and the plurality of key values for a plurality of sequential blocks of instruction data yields an effective decryption key length of approximately W²*(K!/(2*(K−

2)!)) bytes, wherein a width of the decryption key and each of the plurality of key values is W bytes, wherein the plurality of key values is K.