# US 10,503,663 B2 · Method and device for secure processing of encrypted data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,663 B2 - Document ID: US10503663B2 - Status: Granted - Kind: B2 - Application number: 15/989,922 - Filed: 2018-05-25 - Published: 2018-10-11 - Granted: 2019-12-10 - Earliest claimed: 2014-12-19 - Assignees: STMicroelectronics (Grenoble 2) SAS - Applicants: STMicroelectronics (Grenoble 2) SAS - Inventors: Jean-Philippe Fassino; Roland Bohrer; Laurent Gerard - Web page: https://patentgrep.com/patent/US10503663B2 ## CPC - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories - G06F 21/84: output devices, e.g. displays or monitors - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04N 21/42623: {involving specific decryption arrangements} - G06F 2212/1052: Security improvement - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION ## Abstract A method for secure processing of encrypted data within a receiver includes receiving a packet of encrypted compressed data and allocating a region of memory for storing a decrypted version of the packet of encrypted compressed data. The allocation is in response to, and after, reception of the encrypted compressed data. A size of the region of the memory allocated is equal to a size of the packet of encrypted compressed data that is received. The method further includes modifying a configuration of an access authorization filter for defining access rights to the allocated region, decrypting the packet of encrypted compressed data, and storing, in the allocated region, the decrypted compressed data of the packet. The aforementioned allocation, modification, decryption, and storage steps are repeated in response to each new reception of a packet of encrypted compressed data so as to dynamically modify the configuration of the access authorization filter. ## Claims ### Claim 1 A method, comprising: receiving a data packet comprising encrypted compressed data; allocating a region of a memory for storing a decrypted version of the encrypted compressed data, wherein allocating the region of the memory is performed in response to, and after, reception of the data packet; first defining access rights to the region of the memory by modifying a parameter of a configurable access authorization filter coupled to the memory; decrypting the encrypted compressed data of the data packet to form the decrypted version of the encrypted compressed data; storing the decrypted version of the encrypted compressed data in the region of the memory; and repeating the allocating, the first defining, the decrypting, and the storing at least once in response to each new reception of subsequent data packets comprising further encrypted compressed data so as to dynamically modify the parameter of the configurable access authorization filter with each new reception of the subsequent data packets. ### Claim 2 (depends on 1) The method of claim 1, wherein the decrypted version of the encrypted compressed data comprises decrypted and compressed data. ### Claim 3 (depends on 1) The method of claim 1, wherein a size of the region of the memory allocated for storing the decrypted version of the encrypted compressed data is equal to a size of the encrypted compressed data that is received. ### Claim 4 (depends on 1) The method of claim 1, wherein first defining access rights to the region of the memory by modifying the parameter of the configurable access authorization filter comprises modifying at least one parameter of a graph modelling memory storage regions of the memory. ### Claim 5 (depends on 1) The method of claim 1, further comprising disabling an allocation of any region of the memory to store the decrypted version of the encrypted compressed data at a power-up of an electronic device comprising the memory. ### Claim 6 A method comprising: receiving a data packet comprising encrypted compressed data; allocating a region of a memory for storing a decrypted version of the encrypted compressed data, wherein allocating the region of the memory is performed in response to, and after, reception of the data packet; first defining access rights to the region of the memory by modifying a parameter of a configurable access authorization filter coupled to the memory; decrypting the encrypted compressed data of the data packet to form the decrypted version of the encrypted compressed data; storing the decrypted version of the encrypted compressed data in the region of the memory; and repeating the allocating, the first defining, the decrypting, and the storing at least once in response to each new reception of subsequent data packets comprising further encrypted compressed data so as to dynamically modify the parameter of the configurable access authorization filter with each new reception of the subsequent data packets, wherein first defining access rights to the region of the memory by modifying the parameter of the configurable access authorization filter comprises identifying one or more first electronic circuits authorized to access the region of the memory storing the decrypted version of the encrypted compressed data. ### Claim 7 (depends on 6) The method of claim 6, further comprising second defining access rights of one or more second electronic circuits in communication with the one or more first electronic circuits authorized to access the region of the memory storing the decrypted version of the encrypted compressed data. ### Claim 8 (depends on 7) The method of claim 7, further comprising repeating the second defining with the allocating, the first defining, the decrypting, and the storing at least once in response to each new reception of the subsequent data packets. ### Claim 9 (depends on 7) The method of claim 7, wherein second defining access rights of one or more second electronic circuits in communication with the one or more first electronic circuits comprises identifying the one or more second electronic circuits authorized to communicate with the one or more first electronic circuits. ### Claim 10 (depends on 7) The method of claim 7, wherein identifying the one or more first electronic circuits authorized to access the region of the memory storing the decrypted version of the encrypted compressed data comprises identifying the one or more first electronic circuits authorized to read from or write to the region of the memory storing the decrypted version of the encrypted compressed data. ### Claim 11 A device, comprising: an input terminal configured to receive a data packet comprising encrypted compressed data; a decryption circuit configured to decrypt the encrypted compressed data of the data packet to form a decrypted version of the encrypted compressed data; a memory comprising a region for storing the decrypted version of the encrypted compressed data; and a processor coupled to the memory and configured to: allocate the region of a memory for storing the decrypted version of the encrypted compressed data, wherein allocating the region of the memory is performed in response to, and after, reception of the data packet at the input terminal; first define access rights to the region of the memory by modifying a configurable access authorization filter parameter; store the decrypted version of the encrypted compressed data in the region of the memory; and repeat the allocating, the first defining, the decrypting, and the storing at least once in response to each new reception of subsequent data packets comprising further encrypted compressed data so as to dynamically modify the configurable access authorization filter parameter with each new reception of the subsequent data packets. ### Claim 12 (depends on 11) The device of claim 11, wherein the decrypted version of the encrypted compressed data comprises decrypted and compressed data. ### Claim 13 (depends on 11) The device of claim 11, wherein a size of the region of the memory allocated for storing the decrypted version of the encrypted compressed data is equal to a size of the encrypted compressed data that is received. ### Claim 14 (depends on 11) The device of claim 11, wherein the processor is further configured to disable an allocation of any region of the memory to store the decrypted version of the encrypted compressed data at a power-up of the device. ### Claim 15 (depends on 11) The device of claim 11, wherein the processor is configured to first define access rights to the region of the memory by modifying the configurable access authorization filter parameter by modifying at least one parameter of a graph modelling memory storage regions of the memory. ### Claim 16 (depends on 11) The device of claim 11, wherein the processor is configured to first define access rights to the region of the memory by modifying the configurable access authorization filter parameter by identifying one or more first electronic circuits authorized to access the region of the memory storing the decrypted version of the encrypted compressed data. ### Claim 17 (depends on 16) The device of claim 16, wherein the processor is further configured to second define access rights of one or more second electronic circuits in communication with the one or more first electronic circuits authorized to access the region of the memory storing the decrypted version of the encrypted compressed data. ### Claim 18 (depends on 17) The device of claim 17, wherein the processor is further configured to repeat the second defining with the allocating, the first defining, the decrypting, and the storing at least once in response to each new reception of the subsequent data packets. ### Claim 19 (depends on 17) The device of claim 17, wherein the processor is configured to second define access rights of one or more second electronic circuits in communication with the one or more first electronic circuits by identifying the one or more second electronic circuits authorized to communicate with the one or more first electronic circuits. ### Claim 20 (depends on 17) The device of claim 17, wherein identifying the one or more first electronic circuits authorized to access the region of the memory storing the decrypted version of the encrypted compressed data comprises identifying the one or more first electronic circuits authorized to read from or write to the region of the memory storing the decrypted version of the encrypted compressed data.