# US 12,008,150 B2 · Encrypted data processing design including cleartext register files > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,150 B2 - Document ID: US12008150B2 - Status: Granted - Kind: B2 - Application number: 17/356,784 - Filed: 2021-06-24 - Published: 2022-12-29 - Granted: 2024-06-11 - Earliest claimed: 2021-06-24 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Jessica Hui-Chun Tseng; Jose E. Moreira; Pratap C. Pattnaik; Manoj Kumar; Kattamuri Ekanadham; Gianfranco Bilardi - Web page: https://patentgrep.com/patent/US12008150B2 ## CPC - G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories - G06F 21/54: by adding security routines or objects to programs - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - G06F 21/107: {License processing; Key processing} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Aspects of the present disclosure relate to encrypted data processing (EDAP). Encrypted data from a cache to be loaded into a register file can be accessed. The encrypted data can be decrypted to receive cleartext data. The cleartext data can be written to the register file. The cleartext data can be processed using at least one functional unit to receive cleartext computation results. The cleartext computation results can then be written back to the register file. ## Claims ### Claim 1 A method comprising: accessing, in response to a load instruction, encrypted data from a cache of a central processing unit (CPU) to be loaded into a register entry of a register file, the register file accessible by at least one functional unit of the CPU; setting, based on the accessing being responsive to the load instruction, a protection tag within the register entry to on by setting a bit placeholder associated with the protection tag to a first value, wherein protection tags are set to on for any register entries of the register file that are protected by encrypted data processing (EDAP) responsive to data of such register entries originating from load instructions; decrypting, in response to receiving an encryption key from an application authorized to access the encrypted data, the encrypted data to receive cleartext data; writing the cleartext data to the register entry, wherein the cleartext data written to the register entry is only accessible by the at least one functional unit during execution; processing the cleartext data using the at least one functional unit to receive cleartext computation results; writing the cleartext computation results back to the register entry; accessing the cleartext computation results within the register entry; encrypting, in response to receiving the encryption key from the application authorized to access the encrypted data, the cleartext computation results to receive ciphertext computation results; and storing the ciphertext computation results to the cache of the CPU. ### Claim 2 (depends on 1) The method of claim 1, wherein all register entries of the register file which include the protection tag set to on are erased in response to a context switch. ### Claim 3 (depends on 1) The method of claim 1, wherein the method further comprises: receiving an indication of a context switch; and performing a store-and-clear on a cleartext register entry of the register file by: encrypting data stored within the cleartext register entry to receive ciphertext; storing the ciphertext to the cache; and erasing the cleartext register entry. ### Claim 4 (depends on 3) The method of claim 3, wherein the method further comprises: receiving an indication that processing associated with the context switch is complete; and performing a load-and-hide processing on the ciphertext by: loading the ciphertext from the cache; decrypting the ciphertext to receive the data that was previously stored within the cleartext register entry; and storing the data back to the cleartext register entry with a protection tag set to on. ### Claim 5 (depends on 1) The method of claim 1, wherein the register file storing cleartext computation results is only accessible by the application having access to the encryption key used to encrypt and decrypt the data. ### Claim 6 (depends on 1) The method of claim 1, wherein the register file storing cleartext computation results is accessible by the application in a user-mode and not one selected from a group consisting of: a supervisor during a privileged mode, a hypervisor during a privileged mode, and an operating system (OS) during a privileged mode. ### Claim 7 (depends on 1) The method of claim 1, wherein the protection tag is set to on for a first register entry in response to determining that data of first register entry was received from a source register that has a protection tag set to on. ### Claim 8 A processor comprising: a cache of a central processing unit (CPU) configured to store ciphertext data; a register file configured to store cleartext data, the register file accessible by functional units of the CPU, wherein protection tags are set to on for any register entries of the register file that are protected by encrypted data processing (EDAP) responsive to data of such register entries originating from load instructions, wherein the protection tags are set to on by setting bit placeholders associated with the protection tags in each respective register entry to a first value; functional units configured to process the cleartext data from the register file, wherein the cleartext data of the register file is only accessible by the functional units during execution; and an encryption unit configured to decrypt ciphertext data from the cache into cleartext to be loaded into the register file and further configured to encrypt cleartext computation results from the register file into ciphertext computation results to be stored into the cache upon execution by the functional units, wherein the register file storing cleartext data is only available to an authorized application having access to an encryption key used to encrypt and decrypt the data by the encryption unit. ### Claim 9 (depends on 8) The processor of claim 8, wherein register entries having the protection tag set to on are erased in response to a context switch. ### Claim 10 (depends on 8) The processor of claim 8, wherein in response to a context switch, a store-and-clear processing is performed on each register entry of the register file by: encrypting cleartext data within each register entry to receive ciphertext; storing the ciphertext to the cache; and erasing each register entry. ### Claim 11 (depends on 10) The processor of claim 10, wherein in response to processing associated with the context switch being complete, a load-and-hide processing is performed on each register entry to restore a thread state by: loading the ciphertext from cache; decrypting the ciphertext to receive the cleartext; and storing the cleartext back to each respective register entry with a protection tag set to on for each respective register entry. ### Claim 12 A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method comprising: accessing, in response to a load instruction, encrypted data from a cache of a central processing unit (CPU) to be loaded into a register entry of a register file, the register file accessible by at least one functional unit of the CPU; setting, based on the accessing being responsive to the load instruction, a protection tag within the register entry to on by setting a bit placeholder associated with the protection tag to a first value, wherein protection tags are set to on for any register entries of the register file that are protected by encrypted data processing (EDAP) responsive to data of such register entries originating from load instructions; decrypting, in response to receiving an encryption key from an application authorized to access the encrypted data, the encrypted data to receive cleartext data; writing the cleartext data to the register entry, wherein the cleartext data written to the register entry is only accessible by the at least one functional unit during execution; processing the cleartext data using the at least one functional unit to receive cleartext computation results; writing the cleartext computation results back to the register entry; accessing the cleartext computation results within the register entry; encrypting, in response to receiving the encryption key from the application authorized to access the encrypted data, the cleartext computation results to receive ciphertext computation results; and storing the ciphertext computation results to the cache of the CPU. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein the method performed by the one or more processors further comprises: receiving an indication of a context switch; and performing a store-and-clear on a cleartext register entry of the register file by: encrypting data stored within the cleartext register entry to receive ciphertext; storing the ciphertext to the cache; and erasing the cleartext register entry. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the one or more computer readable storage media store additional program instructions configured to cause the one or more processors to perform the method further comprising: receiving an indication that processing associated with the context switch is complete; and performing a load-and-hide processing on the ciphertext by: loading the ciphertext from the cache; decrypting the ciphertext to receive the data that was previously stored within the cleartext register entry; and storing the data back to the cleartext register entry with a protection tag set to on. ### Claim 15 (depends on 12) The computer program product of claim 12, wherein the register file storing cleartext computation results is only available to the authorized application in a user-mode and not one selected from a group consisting of: a supervisor during a privileged mode, a hypervisor during a privileged mode, and an operating system (OS) during a privileged mode.