Systems and methods for multiport to multiport cryptography

• US 10,489,610 B2
• Filed: 08/27/2018
• Issued: 11/26/2019
• Est. Priority Date: 08/19/2015
• Status: Active Grant

• Current Assignee: Altera Corporation (Intel Corporation)
• Original Assignee: Altera Corporation (Intel Corporation)
• Inventors: Groza, Robert
• Primary Examiner(s): Lipman, Jacob
• Application Number:
  US16/113,932
• Publication Number:
  US 20190057227A1
• Time in Patent Office: 456 Days
• Field of Search: 713189
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/122 Hardware reduction or efficient architectures
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]

Abstract

Systems and methods are discussed herein for reusing hardware for encryption and authentication, where the hardware has a fixed input bandwidth, and where the hardware has the same bandwidth for a different input bandwidth. In order to accomplish this mechanism, systems and methods are provided herein for processing invalid data that appears within streams of valid data. Systems and methods are also provided herein for authentication mechanisms that require more than one data cycle to complete.

Claims

1. A programmable integrated circuit device comprising:

a plurality of authentication cores;

a first shifter that is coupled to an output of each authentication core of the plurality of authentication cores; and

a plurality of feedback paths, wherein each feedback path of the plurality of feedback paths is coupled to the first shifter, wherein a respective feedback path of the plurality of feedback paths provides, to the first shifter, feedback that is multiplied by a value when data corresponding to the respective feedback path is determined to be invalid.

2. The programmable integrated circuit device of claim 1, wherein the plurality of authentication cores are communicatively coupled to a first-in-first-out (“

FIFO”

) queue.

3. The programmable integrated circuit device of claim 1, wherein the respective feedback path comprises a multiplier that defines the value as equal to 1 such that the feedback is multiplied by 1 when data is invalid.

4. The programmable integrated circuit device of claim 1, further comprising logic that is integrated with a second shifter coupled upstream from the plurality of authentication cores that is configured to:

determine that data passing through the programmable integrated circuit device is invalid;

determine an amount of delay caused by the data passing through the programmable integrated circuit device being invalid; and

delay new data passing through the programmable integrated circuit device by the amount of delay.

5. The programmable integrated circuit device of claim 4, wherein the amount of delay is equivalent to an amount of cycles used to match the feedback with an input port that received the data corresponding to the respective feedback path that is invalid.

6. The programmable integrated circuit device of claim 1, wherein the first shifter operates to shift the output of each authentication core in response to a determination that a plurality of input ports coupled upstream of the authentication cores comprise a first bandwidth equal to a second bandwidth of the plurality of authentication cores.

7. The programmable integrated circuit device of claim 6, wherein the determination comprises dividing an amount of input ports of the plurality of input ports by an amount of encryption cores, and wherein it is determined that the first bandwidth and the second bandwidth are not equal if a quotient resulting from the dividing includes a non-zero remainder.

8. A method of operating a programmable integrated circuit device comprising:

transmitting data received at an input port through encryption circuitry configured to provide one or more resultant keys and the data to a plurality of authentication cores;

transmitting the data from the plurality of authentication cores to a shifter that is coupled to an output of each authentication core of the plurality of authentication cores;

transmitting the data from the shifter to a feedback path of a plurality of feedback paths, wherein each feedback path of the plurality of feedback paths is coupled to the shifter; and

transmitting feedback from the feedback path to the authentication core by way of the shifter, wherein the feedback is modified by a multiplier when the data is invalid.

9. The method of claim 8, comprising:

transmitting the data from the input port to an encryption core of the encryption circuitry, wherein the encryption core transmits the data to a key generator of a plurality of key generators of the encryption circuitry and to an additional shifter of the encryption circuitry; and

transmitting the one or more resultant keys from the key generator of the plurality of key generators to the additional shifter, wherein each authentication core of the plurality of authentication cores is configured to receive the one or more resultant keys from the plurality key generators through the additional shifter.

10. The method of claim 8, wherein multiplier is configured to multiply the feedback by 1.

11. The method of claim 8, wherein the input port is coupled upstream of a first-in-first-out (“

FIFO”

) queue.

12. The method of claim 8, comprising

determining the data is invalid when an amount of input ports of a plurality of input ports comprising the input port exceeds an amount of encryption cores associated with the encryption circuitry;

and

setting the data to zero in response to determining the data is invalid.

13. The method of claim 8, further comprising:

determining that the data is invalid;

determining an amount of delay caused by the data being invalid; and

delaying new data passing through the programmable integrated device by the amount of delay.

14. The method of claim 13, wherein the amount of delay is equivalent to an amount of cycles required to match the feedback with the input port that received the data that is invalid.

15. A non-transitory machine-readable medium comprising instructions stored thereon for operating a programmable integrated circuit device, the instructions comprising:

instructions to transmit data received at an input port through encryption circuitry configured to provide one or more resultant keys and the data to a plurality of authentication cores;

instructions to transmit the data from the plurality of authentication cores to a shifter that is coupled to an output of each authentication core of the plurality of authentication cores;

instructions to transmit the data from the shifter to a feedback path of a plurality of feedback paths, wherein each feedback path of the plurality of feedback paths is coupled to the shifter; and

instructions to transmit feedback from the feedback path to an authentication core of the plurality of authentication cores by way of the shifter, wherein the feedback is modified by a multiplier when the data is invalid.

16. The non-transitory machine-readable medium of claim 15, comprising:

instructions to operate the authentication core to determine whether the data is a start associated with a data packet; and

instructions to determine whether the data is invalid, in response to determination that the data does not indicate of the start of the data packet.

17. The non-transitory machine-readable medium of claim 15, wherein the data is invalid when an amount of input ports exceeds an amount of encryption cores associated with the encryption circuitry.

18. The non-transitory machine-readable medium of claim 15, comprising:

instructions to operate the shifter to shift the data in response to a plurality of input ports comprising the input port not having a matching bandwidth to a plurality of authentication engines comprising the plurality of authentication cores; and

instructions to operate the shifter to not shift the data in response to the plurality of input ports having the matching bandwidth to the plurality of authentication engines.

19. The non-transitory machine-readable medium of claim 15, wherein the instructions further comprise:

instructions to determine that the data is invalid;

instructions to determine an amount of delay caused by the data being invalid; and

instructions to delay new data passing through the programmable integrated circuit device by the amount of delay.

20. The non-transitory machine-readable medium of claim 19, wherein the amount of delay is equivalent to an amount of cycles used to match the feedback with the input port that received the data that is invalid.