LOW-LATENCY DATA DECRYPTION INTERFACE

• US 20080288780A1
• Filed: 06/19/2008
• Published: 11/20/2008
• Est. Priority Date: 09/02/2004
• Status: Active Grant

• Current Assignee: Bruce L. Beukema, Gilad Pivonia, Jamie R. Kuesel, Robert A. Drehmel, Robert A. Shearer, William E. Hall
• Original Assignee: Bruce L. Beukema, Gilad Pivonia, Jamie R. Kuesel, Robert A. Drehmel, Robert A. Shearer, William E. Hall
• Inventors: Kuesel, Jamie R., Hall, William E., Shearer, Robert A., Pivonia, Gilad, Drehmel, Robert A., BEUKEMA, BRUCE L.
• Granted Patent: US 8,069,353 B2
• Time in Patent Office: Days
• US Class Current: 713/181
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators

Abstract

Methods and apparatus for reducing the impact of latency associated with decrypting encrypted data are provided. Rather than wait until an entire packet of encrypted data is validated (e.g., by checking for data transfer errors), the encrypted data may be pipelined to a decryption engine as it is received, thus allowing decryption to begin prior to validation. In some cases, the decryption engine may be notified of data transfer errors detected during the validation process, in order to prevent reporting false security violations.

Claims

1. A system for decrypting packets of encrypted data, comprising:

a buffer device;

a packet validation component;

a decryption engine; and

a packet decoder configured to receive portions of a data packet, buffer received portions of the data packets in the buffer device, and, if the data packet contains encrypted data, pipeline the received portions of the data packets to the decryption engine to begin decryption of the encrypted data prior to receiving remaining portions of a data packet, wherein the packet validation component is configured to check a complete data packet for data transfer errors, and, if the data packet contains encrypted data, notify the decryption engine in response to detecting data transfer errors, and wherein the decryption engine is configured to check decrypted data for security violations, and, in response to receiving notification of detected data transfer errors from the data validation component, disregard any detected security violations.

2. A system on a chip (SOC), comprising:

one or more processor cores;

a cache for holding data accessed by the one or more processor cores, including a received portion of a first data packet containing at least a portion of a block of encrypted data;

a decryption engine; and

a packet decoder configured pipeline the received portion of the first data packet to the decryption engine to begin decryption of the encrypted data prior to receiving the complete first data packet and checking the complete first data packet for data transfer errors; and

further configured, after receiving remaining portions of the first data packet, to;

check the first data packet for data transfer errors using buffered portions of the encrypted data;

check for security violations with the decryption engine after decryption of the block of encrypted data; and

disregard any detected security violations in response to detecting data transfer errors.

3. The SOC of claim 2, wherein the packet decoder is configured to:

notify the decryption engine in response to detecting data transfer errors.

4. The SOC of claim 2, wherein the packet decoder is further configured to buffer received portions of a second data packet containing non-encrypted data prior to completion of decryption of the encrypted data contained in the first data packet.

5. The SOC of claim 4, wherein the packet decoder is further configured to pass the non-encrypted data to the cache prior to completion of decryption of the encrypted data contained in the first data packet.

6. The SOC of claim 5, further comprising circuitry for merging decrypted data from the decryption engine to be passed to the cache with the non-encrypted data.