Method and system for microprocessor data security

• US 20070172053A1
• Filed: 02/10/2006
• Published: 07/26/2007
• Est. Priority Date: 02/11/2005
• Status: Abandoned Application

• Current Assignee: Universal Data Protection Corporation
• Original Assignee: Universal Data Protection Corporation
• Inventors: Poirier, Jean-Francois
• Application Number:
  US11/350,839
• Publication Number:
  US 20070172053A1
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3

Abstract

Embodiments of the invention relate generally to methods and systems for microprocessor data security, involving data encryption and decryption of stored data in, or in communication with, a computer microprocessor. Such encryption and decryption can be performed on a per-byte basis. Such encryption and decryption involves performing a logic operation on the byte using a decryption key or encryption key to generate a respective decrypted byte or encrypted byte. The key can be fixed or variable or a combination of both. The key is encoded in a dedicated hard-wired key circuit within the microprocessor and accessible to encryption and decryption circuitry within the microprocessor.

Claims

1. A method of retrieving data, the method comprising:

reading at least one byte of stored data from a memory associated with a processor;

for each byte read, performing a logic operation on the byte using a decryption key to generate a decrypted byte, wherein the decryption key is encoded in a dedicated key circuit accessible to the processor; and

providing each decrypted byte to the processor for processing thereof.

2. The method of claim 1, wherein the stored data is encrypted computer program source code.

3. The method of claim 1, wherein the memory is a form of non-volatile memory.

4. The method of claim 3, wherein the non-volatile memory is a form of read-only memory (ROM).

5. The method of claim 1, wherein the stored data is encrypted microprocessor data.

6. The method of claim 1, wherein the decryption key is a first decryption key and the logic operation is a first logic operation and wherein the method further comprises, for each byte, performing a second logic operation on the decrypted byte using a second decryption key to generate a further decrypted byte.

7. The method of claim 6, wherein the first logic operation is an XOR operation and the data byte and the first decryption key are operands of the XOR operation.

8. The method of claim 6, wherein the first logic operation is a first hash function encoded with the first decryption key and wherein, by means of the first hash function, bits of the data byte are transposed to generate the decrypted byte based on the first decryption key.

9. The method of claim 7, wherein the second logic operation is an XOR operation and the decrypted byte and the second decryption key are operands of the XOR operation.

10. The method of claim 7, wherein the second logic operation is a second hash function encoded with the second decryption key and wherein, by means of the second hash function, bits of the decrypted byte are transposed to generate the further decrypted byte based on the second decryption key.

11. The method of claim 6, wherein the second decryption key is a variable decryption key and the first decryption key is a fixed decryption key.

12. The method of claim 6, wherein the first decryption key is a variable decryption key and the second decryption key is a fixed decryption key.

13. The method of claim 11, wherein the variable decryption key corresponds to respective memory locations of the at least one data byte.

14. The method of claim 11, wherein the variable decryption key is different for each byte.

15. The method if claim 1, wherein the stored data have been encrypted using an encryption key which is the same as the decryption key.

16. The method of claim 1, wherein the decryption key is based on a serial number of the processor or of a device housing the processor.

17. The method of claim 1, wherein the decryption key is permanently hard-coded into the key circuit.

18. The method of claim 11, wherein the variable decryption key is generated by a linear feedback shift register (LFSR) circuit according to a predetermined seed value.

19. The method of claim 18, wherein the LFSR circuit is an eight-stage LFSR circuit having predetermined tapping points.

20. The method of claim 1, wherein the key circuit is comprised in an arithmetic logic unit (ALU) of the processor.

21. A method of storing data, the method comprising:

receiving at least one byte of data to be stored in a memory associated with a processor;

for each byte received, performing a logic operation on the byte using an encryption key to generate an encrypted byte, wherein the encryption key is encoded in a dedicated key circuit accessible to the processor; and

storing each encrypted byte in the memory.

22. The method of claim 21, wherein the data to be stored is computer program source code.

23. The method of claim 21, wherein the memory is a form of non-volatile memory.

24. The method of claim 23, wherein the non-volatile memory is a form of read-only memory (ROM).

25. The method of claim 21, wherein the data to be stored is microprocessor data.

26. The method of claim 21, wherein the encryption key is a first encryption key and the logic operation is a first logic operation and wherein the method further comprises, for each byte, performing a second logic operation on the encrypted byte using a second encryption key to generate a further encrypted byte.

27. The method of claim 26, wherein the first logic operation is an XOR operation and the data byte and the first encryption key are operands of the XOR operation.

28. The method of claim 26, wherein the first logic operation is a first hash function encoded with the first encryption key and wherein, by means of the first hash function, bits of the data byte are transposed to generate the encrypted byte based on the first encryption key.

29. The method of claim 27, wherein the second logic operation is an XOR operation and the encrypted byte and the second encryption key are operands of the XOR operation.

30. The method of claim 27, wherein the second logic operation is a second hash function encoded with the second encryption key and wherein, by means of the second hash function, bits of the encrypted byte are transposed to generate the further encrypted byte based on the second encryption key.

31. The method of claim 26, wherein the second encryption key is a variable encryption key and the first encryption key is a fixed encryption key.

32. The method of claim 26, wherein the first encryption key is a variable decryption key and the second decryption key is a fixed encryption key.

33. The method of claim 31, wherein the variable encryption key corresponds to respective memory locations of the at least one data byte.

34. The method of claim 31, wherein the variable encryption key is different for each byte.

35. The method of claim 21, wherein the encryption key is based on a serial number of the processor or of a device housing the processor.

36. The method of claim 21, wherein the encryption key is permanently hard-coded into the key circuit.

37. The method of claim 31, wherein the variable encryption key is generated by a linear feedback shift register (LFSR) circuit according to a predetermined seed value.

38. The method of claim 37, wherein the LFSR circuit is an eight-stage LFSR circuit having predetermined tapping points.

39. The method of claim 21, wherein all data to be stored in the memory is encrypted.

40. Computing apparatus comprising:

a processor;

a non-volatile memory accessible to the processor for storing at least one byte of data;

encryption circuitry configured to receive data to be stored in the non-volatile memory, encrypt each received byte based on a key by using a first logic operation and pass each encrypted byte to the non-volatile memory for storage;

decryption circuitry configured to receive encrypted bytes of data from the non-volatile memory, decrypt each byte based on the key using a second logic operation that is an inverse of the first logic operation and pass each decrypted byte to the processor; and

a key circuit having the key formed therein and accessible to the encryption circuitry and the decryption circuitry.

41. The apparatus of claim 40, wherein the key is a fixed key and the key circuit is a fixed key circuit.

42. The apparatus of claim 41, wherein the fixed key circuit has the fixed key formed therein in a non-volatile manner according to permanent electrical connections formed between selected ones of a plurality of conductors in the fixed key circuit.

43. The apparatus of claim 41, wherein the fixed key is based on a serial number of the processor or of a device housing the processor.

44. The apparatus of claim 40, wherein the non-volatile memory stores encrypted computer program source code.

45. The apparatus of claim 41, further comprising a variable key circuit configured to provide a variable key to the encryption circuitry and the decryption circuitry, wherein the encryption circuitry is further configured to encrypt each byte based on the variable key using a third logic operation before passing the encrypted byte to the non-volatile memory and wherein the decryption circuitry is further configured to decrypt each byte based on the variable key using a fourth logic operation that is an inverse of the third logic operation before passing the decrypted byte to the processor.

46. The apparatus of claim 45, wherein the variable key is different for each byte.

47. The apparatus of claim 45, wherein one or more of the first, second, third and fourth logic operations are XOR operations.

48. The apparatus of claim 45, wherein one or more of the first, second, third and fourth logic operations are hashing operations.

49. The apparatus of claim 45, wherein the variable key is generated by a linear feedback shift register (LFSR) circuit according to a predetermined seed value.

50. The apparatus of claim 49, wherein the LFSR circuit is an eight-stage LFSR circuit having predetermined tapping points.

51. The apparatus of claim 45, wherein the variable key corresponds to respective memory locations of the encrypted bytes stored in the non-volatile memory.

52. The apparatus of claim 40, wherein the encryption circuitry encrypts all data to be stored in the non-volatile memory and the decryption circuitry decrypts all data received from the non-volatile memory.

53. The apparatus of claim 40, wherein the key circuit is comprised in an arithmetic logic unit (ALU) of the processor.

54. The apparatus of claim 40, wherein the key circuit is accessible only to the encryption circuitry and the decryption circuitry.

55. The apparatus of claim 40, wherein the key circuit is formed as part of the encryption circuitry and/or the decryption circuitry.

56. The apparatus of claim 40, wherein the key is a variable key and the key circuit is a variable key circuit.