Encryption and decryption for a multi-tile processing unit

A device comprising:

• a processing unit comprising a plurality of sets of processors, wherein each of the processors is operable to issue write requests to write data to storage external to the processing unit;
• and
• an encryption unit comprising a memory operable to store a plurality of sets of state information, wherein each of the sets of state information is associated with at least one of the sets of processors, wherein the encryption unit comprises processing circuitry configured to:
• receive a first write request issued by a processor of a first one of the sets of processors, wherein the first write request comprises a plaintext;
• process the first write request, including performing encryption operations for generating a ciphertext from the plaintext;
• store as state information associated with the first one of the sets of processors, data generated from the processing of the first write request;
• receive a subsequent write request issued by the processor of the first one of the sets of processors, wherein the subsequent write request comprises a further plaintext;
• and
• using the state information associated with the first one of the sets of processors, process the subsequent write request, including performing at least one of encryption or authentication operations using the further plaintext.

A method for decrypting data read from a storage external to a processing unit comprising a plurality of sets of processors, the method comprising:

• storing a plurality of sets of state information, wherein each of the sets of state information is associated with at least one of the sets of processors;
• receiving a first read completion for delivery to a processor of a first one of the sets of processors, wherein the first read completion comprises a ciphertext;
• processing the first read completion, said processing including decryption operations for generating a plaintext from the ciphertext;
• updating the set of state information associated with the first one of the sets of processors with results of the processing of the first read completion;
• receiving a subsequent read completion for delivery to the processor of the first one of the sets of processors, wherein the subsequent read completion comprises a further ciphertext;
• and
• using the state information associated with the first one of the sets of processors, processing the subsequent read completion, including performing at least one of decryption or authentication operations using the further ciphertext.

A method for encrypting data to be written to a storage external to a processing unit comprising a plurality of sets of processors, the method comprising:

• storing a plurality of sets of state information, wherein each of the sets of state information is associated with at least one of the sets of processors;
• receiving a first write request issued by a processor of a first one of the sets of processors, wherein the first write request comprises a plaintext;
• processing the first write request, said processing of the first write request including performing encryption operations for generating a ciphertext from the plaintext;
• updating the set of state information associated with the first one of the sets of processors with results of the processing of the first write request;
• receiving a subsequent write request issued by the processor of the first one of the sets of processors, wherein the subsequent write request comprises a further plaintext;
• and
• using the state information associated with the first one of the sets of processors, processing the subsequent write request, including performing at least one of encryption or authentication operations using the further plaintext.

A non-transitory computer readable medium storing computer readable instructions, which when executed by at least one processor of at least one encryption unit, cause a method for decrypting data read from a storage external to a processing unit to be carried out, the processing unit comprising a plurality of sets of processors, the method comprising:

• storing a plurality of sets of state information, wherein each of the sets of state information is associated with at least one of the sets of processors;
• receiving a first read completion for delivery to a processor of a first one of the sets of processors, wherein the first read completion comprises a ciphertext;
• processing the first read completion, said processing including decryption operations for generating a plaintext from the ciphertext;
• updating the set of state information associated with the first one of the sets of processors with results of the processing of the first read completion;
• receiving a subsequent read completion for delivery to the processor of the first one of the sets of processors, wherein the subsequent read completion comprises a further ciphertext;
• and
• using the state information associated with the first one of the sets of processors, processing the subsequent read completion, including performing at least one of decryption or authentication operations using the further ciphertext.

A non-transitory computer readable medium storing computer readable instructions, which when executed by at least one processor of at least one encryption unit, cause a method for encrypting data to be written to a storage external to a processing unit to be carried out, the processing unit comprising a plurality of sets of processors, the method comprising:

• storing a plurality of sets of state information, wherein each of the sets of state information is associated with at least one of the sets of processors;
• receiving a first read completion for delivery to a processor of a first one of the sets of processors, wherein the first read completion comprises a ciphertext;
• processing the first read completion, said processing including decryption operations for generating a plaintext from the ciphertext;
• updating the set of state information associated with the first one of the sets of processors with results of the processing of the first read completion;
• receiving a subsequent read completion for delivery to the processor of the first one of the sets of processors, wherein the subsequent read completion comprises a further ciphertext;
• and
• using the state information associated with the first one of the sets of processors, processing the subsequent read completion, including performing at least one of decryption or authentication operations using the further ciphertext.