# US 11,907,408 B2 · Encryption and decryption for a multi-tile processing unit > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,408 B2 - Document ID: US11907408B2 - Status: Granted - Kind: B2 - Application number: 17/215,746 - Filed: 2021-03-29 - Published: 2022-03-17 - Granted: 2024-02-20 - Earliest claimed: 2021-03-29 - Assignees: Graphcore Limited - Applicants: Graphcore Limited - Inventors: Graham Cunningham; Daniel Wilkinson - Web page: https://patentgrep.com/patent/US11907408B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/72: in cryptographic circuits - G06F 3/0623: {in relation to content} - G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling} - G06F 3/0683: {Plurality of storage devices} - G06F 21/71: to assure secure computing or processing of information - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A device comprising a processing unit having a plurality of processors is provided. At least one encryption unit is provided as part of the device for encrypting data written by the processors to external storage and decrypting data read from that storage. The processors are divided into different sets, with state information held in the encryption unit for performing encryption/decryption operations for requests for different sets of processors. This enables interleaved read completions or write requests from different sets of processors to be handled by the encryption unit, since associated state information for each set of processors is independently maintained. ## Claims ### Claim 1 A device comprising: a processing unit comprising a plurality of sets of processors, wherein each of the processors is operable to issue read requests to read data from storage external to the processing unit and to receive in response, read completions comprising said data; and at least one encryption unit comprising a memory operable to store a plurality of sets of state information, wherein each set of state information is associated with at least one of the sets of processors, wherein the at least one encryption unit comprises processing circuitry configured to: receive a first read completion for delivery to a processor of a first one of the sets of processors, wherein the first read completion comprises a ciphertext; process the first read completion, said processing including decryption operations for generating a plaintext from the ciphertext; store as state information associated with the first one of the sets of processors, data generated from the processing of the first read completion; subsequently, in response to a second read completion for delivery to a processor of a second one of the sets of processors, perform decryption operations using data of the second read completion; subsequently, receive a further one or more read completions for delivery to the processor of the first one of the sets of processors, wherein the one or more further read completions comprises a further ciphertext; and using the state information associated with the first one of the sets of processors, process the further one or more read completions, said processing of the further one or more read completions comprising performing at least one of decryption or authentication operations for the further ciphertext. ### Claim 2 (depends on 1) The device of claim 1, wherein the at least one of decryption or authentication operations comprise authentication operations, the authentication operations comprising operations for generating a message authentication code associated with the ciphertext and the further ciphertext. ### Claim 3 (depends on 2) The device of claim 2, wherein the state information used for performing the authentication operations comprises a partial hash, wherein the processing of the first read completion comprises generating the partial hash using the ciphertext. ### Claim 4 (depends on 1) The device of claim 1, wherein the at least one of decryption or authentication operations comprises decryption operations, the decryption operations comprising generating a further plaintext from the further ciphertext. ### Claim 5 (depends on 4) The device of claim 4, wherein the state information comprises an initialisation vector used for performing the decryption operations. ### Claim 6 (depends on 5) The device of claim 5, wherein the processing circuitry of the at least one encryption unit is configured to, when decrypting each ciphertext block received in the first read completion and one or more further read completions, update the initialisation vector using a counter. ### Claim 7 (depends on 1) The device of claim 1, wherein one or more of the sets of state information are each associated with a plurality of the sets of processors. ### Claim 8 (depends on 1) The device of claim 1, wherein for each of a group of processors associated with a same set of state information, the processors of the respective group are configured to implement a constraint such that only one of the processors of the respective group may have an outstanding read request open at any one time. ### Claim 9 (depends on 8) The device of claim 8, comprising a plurality of exchange circuits, wherein each of the exchange circuits is associated with a set of processors and is configured to enforce the constraint for each of its respective set of processors by granting permission to the processors of its associated set to transmit read requests. ### Claim 10 (depends on 1) The device of claim 1, wherein the device is a subsystem for acting as a work accelerator to a host system coupled to the device, wherein the storage external to the processing unit is memory of the host system. ### Claim 11 A device comprising: a processing unit comprising a plurality of sets of processors, wherein each of the processors is operable to issue write requests to write data to storage external to the processing unit; and an encryption unit comprising a memory operable to store a plurality of sets of state information, wherein each of the sets of state information is associated with at least one of the sets of processors, wherein the encryption unit comprises processing circuitry configured to: receive a first write request issued by a processor of a first one of the sets of processors, wherein the first write request comprises a plaintext; process the first write request, including performing encryption operations for generating a ciphertext from the plaintext; store as state information associated with the first one of the sets of processors, data generated from the processing of the first write request; receive a subsequent write request issued by the processor of the first one of the sets of processors, wherein the subsequent write request comprises a further plaintext; and using the state information associated with the first one of the sets of processors, process the subsequent write request, including performing at least one of encryption or authentication operations using the further plaintext. ### Claim 12 (depends on 11) The device of claim 11, wherein the at least one of encryption or authentication operations comprise authentication operations, the authentication operations comprising operations for generating a message authentication code associated with the plaintext and the further plaintext. ### Claim 13 (depends on 12) The device of claim 12, wherein the state information used for performing the authentication operations comprises a partial hash, wherein the processing of the first write request comprises generating the partial hash using the ciphertext. ### Claim 14 (depends on 11) The device of claim 11, wherein the at least one of encryption or authentication operations comprises encryption operations, the encryption operations comprising generating a further ciphertext from the further plaintext. ### Claim 15 (depends on 14) The device of claim 14, wherein the state information comprises an initialisation vector used for performing the encryption operations. ### Claim 16 (depends on 15) The device of claim 15, wherein the processing circuitry of the encryption unit is configured to when encrypting each plaintext block received in the first write request and the subsequent write request, update the initialisation vector used for encrypting the respective plaintext block using a counter. ### Claim 17 (depends on 11) The device of claim 11, wherein one or more of the sets of state information are each associated with a plurality of the sets of processors. ### Claim 18 (depends on 11) The device of claim 11, wherein for each of the at least one set of processors associated with a same set of state information, the respective processors are configured to implement a constraint such that only one of the processors of the respective at least one set of processors may issue write requests comprising a plaintext block at any one time. ### Claim 19 (depends on 18) The device of claim 18, comprising a plurality of exchange circuits, wherein each of the exchange circuits is associated with one of the sets of processors and is configured to enforce the constraint for its associated set of processors by granting permission to the processors of its associated set to transmit the write requests. ### Claim 20 (depends on 11) The device of claim 11, wherein the device is a subsystem for acting as a work accelerator to a host system coupled to the device, wherein the storage external to the processing unit is memory of the host system. ### Claim 21 A method for decrypting data read from a storage external to a processing unit comprising a plurality of sets of processors, the method comprising: storing a plurality of sets of state information, wherein each of the sets of state information is associated with at least one of the sets of processors; receiving a first read completion for delivery to a processor of a first one of the sets of processors, wherein the first read completion comprises a ciphertext; processing the first read completion, said processing including decryption operations for generating a plaintext from the ciphertext; updating the set of state information associated with the first one of the sets of processors with results of the processing of the first read completion; receiving a subsequent read completion for delivery to the processor of the first one of the sets of processors, wherein the subsequent read completion comprises a further ciphertext; and using the state information associated with the first one of the sets of processors, processing the subsequent read completion, including performing at least one of decryption or authentication operations using the further ciphertext. ### Claim 22 A method for encrypting data to be written to a storage external to a processing unit comprising a plurality of sets of processors, the method comprising: storing a plurality of sets of state information, wherein each of the sets of state information is associated with at least one of the sets of processors; receiving a first write request issued by a processor of a first one of the sets of processors, wherein the first write request comprises a plaintext; processing the first write request, said processing of the first write request including performing encryption operations for generating a ciphertext from the plaintext; updating the set of state information associated with the first one of the sets of processors with results of the processing of the first write request; receiving a subsequent write request issued by the processor of the first one of the sets of processors, wherein the subsequent write request comprises a further plaintext; and using the state information associated with the first one of the sets of processors, processing the subsequent write request, including performing at least one of encryption or authentication operations using the further plaintext. ### Claim 23 A non-transitory computer readable medium storing computer readable instructions, which when executed by at least one processor of at least one encryption unit, cause a method for decrypting data read from a storage external to a processing unit to be carried out, the processing unit comprising a plurality of sets of processors, the method comprising: storing a plurality of sets of state information, wherein each of the sets of state information is associated with at least one of the sets of processors; receiving a first read completion for delivery to a processor of a first one of the sets of processors, wherein the first read completion comprises a ciphertext; processing the first read completion, said processing including decryption operations for generating a plaintext from the ciphertext; updating the set of state information associated with the first one of the sets of processors with results of the processing of the first read completion; receiving a subsequent read completion for delivery to the processor of the first one of the sets of processors, wherein the subsequent read completion comprises a further ciphertext; and using the state information associated with the first one of the sets of processors, processing the subsequent read completion, including performing at least one of decryption or authentication operations using the further ciphertext. ### Claim 24 A non-transitory computer readable medium storing computer readable instructions, which when executed by at least one processor of at least one encryption unit, cause a method for encrypting data to be written to a storage external to a processing unit to be carried out, the processing unit comprising a plurality of sets of processors, the method comprising: storing a plurality of sets of state information, wherein each of the sets of state information is associated with at least one of the sets of processors; receiving a first read completion for delivery to a processor of a first one of the sets of processors, wherein the first read completion comprises a ciphertext; processing the first read completion, said processing including decryption operations for generating a plaintext from the ciphertext; updating the set of state information associated with the first one of the sets of processors with results of the processing of the first read completion; receiving a subsequent read completion for delivery to the processor of the first one of the sets of processors, wherein the subsequent read completion comprises a further ciphertext; and using the state information associated with the first one of the sets of processors, processing the subsequent read completion, including performing at least one of decryption or authentication operations using the further ciphertext.