# US 10,372,656 B2 · System, apparatus and method for providing trusted input/output communications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,372,656 B2
- Document ID: US10372656B2
- Status: Granted
- Kind: B2
- Application number: 15/356,720
- Filed: 2016-11-21
- Published: 2018-05-24
- Granted: 2019-08-06
- Earliest claimed: 2016-11-21
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: Srikanth Varadarajan; Reshma Lal; Steven B. McGowan; Hakan Magnus Eriksson; Travis W. Peters
- Web page: https://patentgrep.com/patent/US10372656B2

## CPC

- G06F 13/4068: {Electrical coupling}
- G06F 13/28: using burst mode transfer, e.g. direct memory access {DMA}, cycle steal (G06F13/32 takes precedence)
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices
- H04L 9/065: {Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3}
- H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it}
- H04L 69/22: Parsing or analysis of headers
- H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
- H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
- H04L 2209/127: Trusted platform modules [TPM]
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

In one embodiment, an apparatus includes a wireless controller, which may include a byte stream parser to receive a stream of data from one or more wireless devices and parse the stream of data to identify a first data packet associated with a first channel identifier associated with a trusted application, and a cryptographic engine coupled to the byte stream parser to encrypt a payload portion of the first data packet in response to the identification of the first data packet associated with the first channel identifier. Other embodiments are described and claimed.

## Claims

### Claim 1

An apparatus comprising:
a wireless hardware controller to communicate wirelessly with one or more wireless devices, the wireless hardware controller comprising:
a byte stream parser to receive a stream of data from the one or more wireless devices and parse the stream of data to identify a first data packet associated with a first channel identifier, the first channel identifier associated with a trusted application that previously registered with a trusted input/output (IO) logic; and
a cryptographic engine coupled to the byte stream parser to encrypt a payload portion of the first data packet with a first encryption key programmed in the cryptographic engine by the trusted IO logic in response to the identification of the first data packet associated with the first channel identifier, wherein the cryptographic engine is to:
first decrypt the payload portion of the first data packet via a first decryption key, the payload portion of the first data packet encrypted by the one or more wireless devices; and
thereafter, in response to the identification of the first data packet, re-encrypt the payload portion of the first data packet via the first encryption key, the first encryption key associated with the first channel identifier and not associated with the first decryption key; and
a direct memory access (DMA) hardware circuit coupled to the wireless hardware controller to receive and store in a first buffer the first data packet having the encrypted payload portion, based on a request from a first trusted agent.

### Claim 2 (depends on 1)

The apparatus of claim 1, further comprising:
a first trusted execution environment (TEE) in which the first trusted agent is to execute; and
a second TEE in which a device driver for the trusted application is to execute.

### Claim 3 (depends on 2)

The apparatus of claim 2, wherein the apparatus comprises a system on chip, the system on chip including the wireless hardware controller and further including one or more computing cores, wherein at least one of the first TEE and the second TEE is to execute on at least one of the one or more computing cores, the first TEE and the second TEE isolated from the wireless hardware controller and an operating system.

### Claim 4 (depends on 2)

The apparatus of claim 2, wherein the trusted IO logic is to receive a request from the trusted application for trusted input from a first wireless device of the one or more wireless devices and responsive to the request to identify the first channel identifier associated with the first wireless device.

### Claim 5 (depends on 4)

The apparatus of claim 4, wherein the trusted IO logic is further to program the cryptographic engine with:
a trusted profile identifier associated with the first channel identifier.

### Claim 6 (depends on 5)

The apparatus of claim 5, wherein the cryptographic engine is further to generate an authentication tag associated with the first data packet, the authentication tag comprising a hash value of the encrypted payload portion of the first data packet and an unencrypted header portion of the first data packet.

### Claim 7 (depends on 6)

The apparatus of claim 6, wherein the DMA hardware circuit is to store the authentication tag with the first data packet in the first buffer.

### Claim 8 (depends on 5)

The apparatus of claim 5, wherein the wireless hardware controller is to replace a profile identifier of the first data packet with the trusted profile identifier, to enable a host logic to forward the first data packet to the device driver.

### Claim 9

At least one non-transitory computer readable storage medium comprising instructions that when executed enable a system to:
receive an incoming data packet in a wireless controller of the system from a wireless input device;
decrypt a payload portion of the incoming data packet with a first decryption key;
parse the incoming data packet in a byte stream parser to determine whether the incoming data packet is associated with a first channel identifier associated with a trusted agent that previously registered with a trusted input/output (IO) logic; and
responsive to a determination that the incoming data packet is associated with the first channel identifier, re-encrypt the payload portion of the incoming data packet with a first encryption key associated with the first channel identifier and programmed by the trusted IO logic, the first encryption key not associated with the first decryption key, to enable communication of the encrypted payload portion of the incoming data packet to the trusted agent in a secure manner.

### Claim 10 (depends on 9)

The non-transitory computer readable storage medium of claim 9, further comprising instructions that when executed enable the system to communicate the incoming data packet including the encrypted payload portion to a device driver within a trusted execution environment (TEE) associated with the trusted agent.

### Claim 11 (depends on 10)

The non-transitory computer readable storage medium of claim 10, further comprising instructions that when executed enable the system, responsive to receipt of the encrypted payload portion in the device driver within the TEE, to enable the device driver within the TEE to decrypt the encrypted payload portion.

### Claim 12 (depends on 11)

The non-transitory computer readable storage medium of claim 11, further comprising instructions that when executed enable the system to associate an authentication tag with the encrypted payload portion and communicate the authentication tag to the device driver with the encrypted payload portion.

### Claim 13 (depends on 9)

The non-transitory computer readable storage medium of claim 9, further comprising instructions that when executed enable the system to replace a profile identifier of the incoming data packet with a trusted profile identifier associated with the trusted agent.

### Claim 14 (depends on 9)

The non-transitory computer readable storage medium of claim 9, further comprising instructions that when executed enable the system to communicate the incoming data packet including the encrypted payload portion via a shared direct memory access channel, the shared direct memory access channel shared with one or more untrusted agents.

### Claim 15

A system comprising:
a system on chip (SoC) comprising at least one core, a security hardware coprocessor, a wireless hardware controller, a byte stream parser and a cryptographic engine, wherein:
the byte stream parser is to receive a stream of data from at least one wireless device and parse the stream of data to identify a first data packet associated with a first channel identifier, the first channel identifier associated with a trusted application that previously registered with a trusted input/output (IO) logic; and
the cryptographic engine is to encrypt a payload portion of the first data packet with a first encryption key programmed in the cryptographic engine by the trusted IO logic in response to the identification of the first data packet associated with the first channel identifier, wherein the wireless hardware controller is to cause the first data packet having the encrypted payload portion to be directed to the trusted application to execute on the security hardware coprocessor and to cause a second data packet having an unencrypted payload portion to be directed to an untrusted application to execute on the at least one core, wherein the cryptographic engine is to decrypt the first data packet and the second data packet after receipt from the at least one wireless device with a first decryption key, and responsive to the first channel identifier, to re-encrypt the payload portion of the first data packet with the first encryption key, the first encryption key not associated with the first decryption key; and
the at least one wireless device to couple to the SoC.

### Claim 16 (depends on 15)

The system of claim 15, wherein the at least one core is to execute a wireless software stack, the wireless software stack to receive the first data packet and direct the first data packet to the trusted application based at least in part on a trusted profile ID, wherein the wireless hardware controller is to associate the trusted profile ID with the first data packet.

### Claim 17 (depends on 15)

The system of claim 15, wherein the cryptographic engine is further to generate an authentication tag associated with the first data packet, the authentication tag comprising a hash value of the encrypted payload portion of the first data packet and an unencrypted header portion of the first data packet.

### Claim 18 (depends on 15)

The system of claim 15, wherein the cryptographic engine is to receive a third data packet from the trusted application, the third data packet having an encrypted payload portion, decrypt the encrypted payload portion of the third data packet with a second decryption key, re-encrypt the third data packet with another encryption key and send the re-encrypted third data packet to the at least one wireless device.