# US 11,909,855 B2 · Cryptographic data communication apparatus

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,855 B2
- Document ID: US11909855B2
- Status: Granted
- Kind: B2
- Application number: 18/075,460
- Filed: 2022-12-06
- Published: 2023-03-30
- Granted: 2024-02-20
- Earliest claimed: 2020-08-05
- Assignees: Mellanox Technologies, Ltd.
- Applicants: Mellanox Technologies, Ltd.
- Inventors: Miriam Menes; Noam Bloch; Adi Menachem; Idan Burstein; Ariel Shahar; Maxim Fudim
- Web page: https://patentgrep.com/patent/US11909855B2

## CPC

- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 9/0625: {with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/3247: {involving digital signatures}
- H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In one embodiment, data communication apparatus includes packet processing circuitry to receive data from a memory responsively to a data transfer request, and cryptographically process the received data in units of data blocks using a block cipher so as to add corresponding cryptographically processed data blocks to a sequence of data packets, the sequence including respective ones of the cryptographically processed data blocks having block boundaries that are not aligned with payload boundaries of respective one of the packets, such that respective ones of the cryptographically processed data blocks are divided into two respective segments, which are contained in successive respective ones of the packets in the sequence, and a network interface which includes one or more ports for connection to a packet data network and is configured to send the sequence of data packets to a remote device over the packet data network via the one or more ports.

## Claims

### Claim 1

Data communication apparatus, comprising:
packet processing circuitry configured to:
receive data including a first data chunk from a memory responsively to a data transfer request;
find that the first data chunk includes a first partial block;
request a first additional data chunk from the memory;
cryptographically process the received data in units of data blocks using a block cipher including cryptographically processing the first partial block and the first additional data chunk together as a whole block using the block cipher yielding a first cryptographically processed data block;
add cryptographically processed data blocks to a sequence of data packets, wherein non-aligned cryptographically processed data blocks of the cryptographically processed data blocks have block boundaries that are not aligned with packet payload boundaries; and
divide each of the non-aligned cryptographically processed data blocks into two respective segments, which are contained in successive packets in the sequence; and
a network interface which comprises one or more ports for connection to a packet data network and is configured to send the sequence of data packets to a remote device over the packet data network via the one or more ports.

### Claim 2 (depends on 1)

The apparatus according to claim 1, further comprising a host interface, which is configured to be connected to a host computer including a processing unit configured to manage fulfilment of the data transfer request, wherein the packet processing circuitry is configured to receive the data from the host computer over the host interface responsively to the data transfer request.

### Claim 3 (depends on 1)

The apparatus according to claim 1, wherein the packet processing circuitry is configured to:
divide the first cryptographically processed data block into the first and second segments;
add the first segment to the first packet; and
store the second segment in the memory until the second packet is processed by the packet processing circuitry.

### Claim 4 (depends on 3)

The apparatus according to claim 3, wherein the packet processing circuitry is configured to request the first additional data chunk from the memory responsively to finding that the first data chunk includes the first partial block.

### Claim 5 (depends on 3)

The apparatus according to claim 3, wherein the packet processing circuitry is configured to:
find the stored second segment in the memory;
request a second data chunk from the memory, responsively to the found second segment;
find that the second data chunk includes a second partial block;
request an additional second data chunk from the memory, responsively to finding that the second data chunk includes the second partial block;
cryptographically process the second data chunk without the second partial block using the block cipher yielding at least one second cryptographically processed data block;
cryptographically process the second partial block and the additional second data chunk together as a whole block using the block cipher yielding an additional second cryptographically processed data block;
divide the additional second cryptographically processed data block into third and fourth segments;
add the second segment, the at least one second cryptographically processed data block, and the third segment to the second packet; and
store the fourth segment in the memory until a third packet is processed by the packet processing circuitry.

### Claim 6 (depends on 1)

The apparatus according to claim 1, wherein each of the data packets includes respective whole ones of the cryptographically processed data blocks.

### Claim 7 (depends on 1)

The apparatus according to claim 1, wherein the packet processing circuitry is configured to:
read cryptographic parameters registered in the memory by a processing unit, the cryptographic parameters including an initial cryptographic key and an initial value;
compute a first cryptographic key responsively to the initial cryptographic key and the initial value;
cryptographically process a first block of the received data blocks responsively to the first cryptographic key;
compute an updated value responsively to the initial value and a size of the first block;
compute a second cryptographic key responsively to the initial cryptographic key and the updated value; and
cryptographically process a second block of the received data blocks responsively to the second cryptographic key.

### Claim 8 (depends on 7)

The apparatus according to claim 7, wherein the updated value is indicative of a storage location of the second block.

### Claim 9 (depends on 1)

The apparatus according to claim 1, wherein the packet processing circuitry is configured to encrypt the received data blocks using the block cipher so as to add corresponding ciphertext data blocks to the sequence of data packets.

### Claim 10 (depends on 9)

The apparatus according to claim 9, wherein the packet processing circuitry is configured to: compute respective signatures of the received data blocks or the ciphertext data blocks; and add the computed signatures to the sequence of data packets.

### Claim 11 (depends on 1)

The apparatus according to claim 1, wherein the packet processing circuitry is configured to decrypt the received data blocks using the block cipher so as to add corresponding plaintext data blocks to the sequence of data packets.

### Claim 12 (depends on 11)

The apparatus according to claim 11, wherein the packet processing circuitry is configured to: authenticate respective signatures of the received data blocks or the plaintext data blocks; and add respective ones of the plaintext data blocks to the sequence of data packets responsively to respective ones of the signatures being authenticated.

### Claim 13

Data communication method, comprising:
receiving data including a first data chunk from a memory responsively to a data transfer request;
finding that the first data chunk includes a first partial block;
requesting a first additional data chunk from the memory;
cryptographically processing the received data in units of data blocks using a block cipher including cryptographically processing the first partial block and the first additional data chunk together as a whole block using the block cipher yielding a first cryptographically processed data block;
adding cryptographically processed data blocks to a sequence of data packets, wherein non-aligned cryptographically processed data blocks of the cryptographically processed data blocks have block boundaries that are not aligned with packet payload boundaries;
divide each of the non-aligned cryptographically processed data blocks into two respective segments, which are contained in successive packets in the sequence; and
sending the sequence of data packets to a remote device over a packet data network.

### Claim 14 (depends on 13)

The method according to claim 13, wherein the receiving includes receiving the data from a host computer over a host interface responsively to the data transfer request.

### Claim 15 (depends on 13)

The method according to claim 13, further comprising:
dividing the first cryptographically processed data block into the first and second segments;
adding the first segment to the first packet; and
storing the second segment in the memory until the second packet is processed by packet processing circuitry.

### Claim 16 (depends on 15)

The method according to claim 15, wherein the requesting includes requesting the first additional data chunk from the memory, responsively to finding that the first data chunk includes the first partial block.

### Claim 17 (depends on 15)

The method according to claim 15, further comprising:
finding the stored second segment in the memory;
requesting a second data chunk from the memory, responsively to the found second segment;
finding that the second data chunk includes a second partial block;
requesting an additional second data chunk from the memory, responsively to finding that the second data chunk includes the second partial block;
cryptographically processing the second data chunk without the second partial block using the block cipher yielding at least one second cryptographically processed data block;
cryptographically processing the second partial block and the additional second data chunk together as a whole block using the block cipher yielding an additional second cryptographically processed data block;
dividing the additional second cryptographically processed data block into third and fourth segments;
adding the second segment, the at least one second cryptographically processed data block, and the third segment to the second packet; and
storing the fourth segment in the memory until a third packet is processed by the packet processing circuitry.

### Claim 18 (depends on 13)

The method according to claim 13, wherein each of the data packets includes respective whole ones of the cryptographically processed data blocks.

### Claim 19 (depends on 13)

The method according to claim 13, further comprising:
reading cryptographic parameters registered in the memory by a processing unit, the cryptographic parameters including an initial cryptographic key and an initial value;
computing a first cryptographic key responsively to the initial cryptographic key and the initial value;
cryptographically processing a first block of the received data blocks responsively to the first cryptographic key;
computing an updated value responsively to the initial value and a size of the first block;
computing a second cryptographic key responsively to the initial cryptographic key and the updated value; and
cryptographically processing a second block of the received data blocks responsively to the second cryptographic key.

### Claim 20 (depends on 19)

The method according to claim 19, wherein the updated value is indicative of a storage location of the second block.

### Claim 21 (depends on 13)

The method according to claim 13, further comprising encrypting the received data blocks using the block cipher so as to add corresponding ciphertext data blocks to the sequence of data packets.

### Claim 22 (depends on 21)

The method according to claim 21, further comprising:
computing respective signatures of the received data blocks or the ciphertext data blocks; and
adding the computed signatures to the sequence of data packets.

### Claim 23 (depends on 13)

The method according to claim 13, further comprising decrypting the received data blocks using the block cipher so as to add corresponding plaintext data blocks to the sequence of data packets.

### Claim 24 (depends on 23)

The method according to claim 23, further comprising:
authenticating respective signatures of the received data blocks or the plaintext data blocks; and
adding respective ones of the plaintext data blocks to the sequence of data packets responsively to respective ones of the signatures being authenticated.