# US 12,223,100 B2 · Hardware protection of inline cryptographic processor > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,100 B2 - Document ID: US12223100B2 - Status: Granted - Kind: B2 - Application number: 18/480,815 - Filed: 2023-10-04 - Published: 2024-01-25 - Granted: 2025-02-11 - Earliest claimed: 2014-06-16 - Assignees: Texas Instruments Incorporated - Applicants: Texas Instruments Incorporated - Inventors: Amritpal S. Mundra; William C. Wallace - Web page: https://patentgrep.com/patent/US12223100B2 ## CPC - G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 21/606: {by securing the transmission between two devices or processes} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 2221/2107: File encryption - G06F 2221/2125: Just-in-time application of countermeasures, e.g., on-the-fly decryption, just-in-time obfuscation or de-obfuscation - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A real time, on-the-fly data encryption system is operable to encrypt and decrypt data flow between a secure processor and an unsecure external memory system. Multiple memory segments are supported, each with its own separate encryption capability, or no encryption at all. Data integrity is ensured by hardware protection from code attempting to access data across memory segment boundaries. Protection is also provided against dictionary attacks by monitoring multiple access attempts to the same memory location. ## Claims ### Claim 1 A data encryption system comprising: an encryption engine including a plurality of encryption cores, each configured to perform at least one of multiple types of cryptographic operations, including an encryption operation, a decryption operation, and a message authentication operation; a memory interface configured to write encrypted data received from one or more of the plurality of encryption cores to a memory, and further configured to provide encrypted data received from the memory to one or more of the plurality of encryption cores; a command buffer configured to associate each transaction of multiple transactions of the data encryption system with a corresponding response of multiple responses by the memory interface; and a scheduler configured to determine that a command specifies one of the multiple types of cryptographic operations based on a mode of a region of the memory which is specified by an address of the command. ### Claim 2 (depends on 1) The data encryption system of claim 1, wherein the memory includes a plurality of regions including a first memory region and a second memory region, wherein the encryption engine is further configured to identify a memory write access command that attempts to cross from the first memory region to the second memory region. ### Claim 3 (depends on 2) The data encryption system of claim 2, wherein, when the encryption engine identifies the memory write access command, the encryption engine is further configured to inhibit execution of the identified memory write access command so that write data corresponding to the identified memory write access command is prevented from being written to any location in the memory. ### Claim 4 (depends on 3) The data encryption system of claim 3, wherein, when the encryption engine identifies the memory write access command, the encryption engine is further configured to generate an error condition. ### Claim 5 (depends on 3) The data encryption system of claim 3, wherein the execution of the identified memory write access command is inhibited by forcing all write byte enables to a null value. ### Claim 6 (depends on 2) The data encryption system of claim 2, wherein the encryption engine is further configured to perform a dictionary checker function to: identify whether a memory read access command issued to the memory interface is one of multiple accesses to the same memory location. ### Claim 7 (depends on 6) The data encryption system of claim 6, wherein, in performing the dictionary checker function, the encryption engine is further configured to: inhibit execution of the identified memory read access command to prevent malicious code from accessing a secure area of the memory, when the memory read access command is identified as being one of multiple accesses to the same memory location. ### Claim 8 (depends on 7) The data encryption system of claim 7, wherein, in performing the dictionary checker function, the encryption engine is further configured to inhibit the execution of the identified memory read access command by forcing all read data to zero. ### Claim 9 A computing system comprising: an encryption engine including a plurality of encryption cores, each configured to perform at least one of multiple types of cryptographic operations, including an encryption operation, a decryption operation, and a message authentication operation; a memory including a plurality of regions including a first memory region and a second memory region; a memory interface coupled to the memory and configured to write encrypted data received from one or more of the plurality of encryption cores to the memory, and further configured to provide encrypted data received from the memory to one or more of the plurality of encryption cores; a command buffer configured to associate each transaction of multiple transactions of the data encryption system with a corresponding response of multiple responses by the memory interface; and a scheduler configured to determine that a command specifies one type of cryptographic operation of the multiple types of cryptographic operations based on a mode of a region of the external memory which is specified by an address of the command. ### Claim 10 (depends on 9) The computing system of claim 9, wherein the encryption engine is further configured to identify a memory write access command that attempts to cross from the first memory region to the second memory region. ### Claim 11 (depends on 10) The computing system of claim 10, wherein, when the encryption engine identifies the memory write access command, the encryption engine is further configured to inhibit execution of the identified memory write access command so that write data corresponding to the identified memory write access command is prevented from being written to any location in the memory. ### Claim 12 (depends on 11) The computing system of claim 11, wherein, when the encryption engine identifies the memory write access command, the encryption engine is further configured to generate an error condition. ### Claim 13 (depends on 11) The computing system of claim 11, wherein the execution of the identified memory write access command is inhibited by forcing all write byte enables to a null value. ### Claim 14 (depends on 10) The computing system of claim 10, wherein the encryption engine is further configured to perform a dictionary checker function to: identify whether a memory read access command issued to the memory interface is one of multiple accesses to the same memory location. ### Claim 15 (depends on 14) The computing system of claim 14, wherein, in performing the dictionary checker function, the encryption engine is further configured to: inhibit execution of the identified memory read access command to prevent malicious code from accessing a secure area of the memory, when the memory read access command is identified as being one of multiple accesses to the same memory location. ### Claim 16 (depends on 14) The computing system of claim 14, wherein, in performing the dictionary checker function, the encryption engine is further configured to inhibit the execution of the identified memory read access command by forcing all read data to zero.