Decryption and encryption during write accesses to a memory
AssigneeInfineon Technologies AG
InventorsRainer Goettfert, Erwin Hess, Bernd Meyer, Steffen Sonnekalb
Life of this patent
Estimating the term…
Abstract
An encryption part or a decryption part of an encryption/decryption apparatus or a part common to both parts is used both for encryption and decryption of a datum to be stored and the encrypted memory content and for the generation of the address-individual key and the address-dependent key, respectively.
Claims16
An apparatus for encrypting a datum to be stored during a write access to a memory at an access address into an encrypted datum, comprising:
- a cryptographic module for generating an address-dependent key from the access address and for encrypting the datum to be stored with the address-dependent key, wherein the cryptographic module includes a cryptographic calculating unit with a data input, a key input, and a data output for performing a cryptographic algorithm on data at the data input and key input, to output a cryptographic result at the data output;
- and
- a controller for controlling the cryptographic module, such that in a first phase the access address passes through the cryptographic module in a first data path into which the cryptographic calculating unit is connected with data input and data output, and a master key is present at the key input of the cryptographic calculating unit in the first phase when the access address passes through the cryptographic calculating unit, in order to obtain the address-dependent key at the end of the first phase, and in the second phase the datum to be stored passes through a second data path into which the cryptographic calculating unit is connected with data input and data output, and the address-dependent key is present at the key input of the cryptographic calculating unit in the second phase when the datum to be stored passes through the cryptographic calculating unit, so that the datum to be stored is obtained at the end of the second phase.
An apparatus for decrypting a memory content during a read access to a memory at an access address into a decrypted datum, comprising:
- a cryptographic module for generating an address-dependent key from the access address and for decrypting the memory content with the address-dependent key, wherein the cryptographic module includes a cryptographic calculating unit with a data input, a key input, and a data output for performing a cryptographic algorithm on data at the data input and key input, to output a cryptographic result at the data output;
- and
- a controller for controlling the cryptographic module, such that in a first phase the access address passes through the cryptographic module in a first data path into which the cryptographic calculating unit is connected with data input and data output, and a master key is present at the key input of the cryptographic calculating unit in the first phase when the access address passes through the cryptographic calculating unit, in order to obtain the address-dependent key at the end of the first phase, and in the second phase the memory content passes through a second path into which the cryptographic calculating unit is connected with data input and data output, and the address-dependent key is present at the key input of the cryptographic calculating unit in the second phase when the memory content passes through the cryptographic calculating unit, so that the decrypted datum is obtained at the end of the second phase.
A method of encrypting a datum to be stored during a write access to a memory at a memory address into an encrypted datum by means of a cryptographic module for generating an address-dependent key from the access address and for encrypting the datum to be stored with the address-dependent key, wherein the cryptographic module includes a cryptographic calculating unit with a data input, a key input, and a data output for performing a cryptographic algorithm on data at the data input and key input, to output a cryptographic result at the data output, wherein the method comprises the steps of:
- controlling the cryptographic module, such that in a first phase the access address passes through the cryptographic module in a first data path into which the cryptographic calculating unit is connected with data input and data output, and a master key is present at the key input of the cryptographic calculating unit in the first phase when the access address passes through the cryptographic calculating unit, in order to obtain the address-dependent key at the end of the first phase;
- and
- controlling the cryptographic module, such that in a second phase the datum to be stored passes through a second data path into which the cryptographic calculating unit is connected with data input and data output, and the address-dependent key is present at the key input of the cryptographic calculating unit in the second phase when the datum to be stored passes through the cryptographic calculating unit, so that the datum to be stored is obtained at the end of the second phase.
A method of decrypting a memory content during a read access to a memory at an access address into a decrypted datum by means of a cryptographic module for generating an address-dependent key from the access address and for decrypting the memory content with the address-dependent key, wherein the cryptographic module includes a data input, a key input, and a data output for performing a cryptographic algorithm on data at the data input and key input, to output a cryptographic result at the data output, wherein the method comprises the steps of:
- controlling the cryptographic module, such that in a first phase the access address passes through the cryptographic module in a first data path into which the cryptographic calculating unit is connected with data input and data output, and a master key is present at the key input of the cryptographic calculating unit in the first phase when the access address passes through the cryptographic calculating unit, in order to obtain the address-dependent key at the end of the first phase;
- and
- controlling the cryptographic module, such that in a second phase the memory content passes through a second path into which the cryptographic calculating unit is connected with data input and data output, and the address-dependent key is present at the key input of the cryptographic calculating unit in the second phase when the memory content passes through the cryptographic calculating unit, so that the decrypted datum is obtained at the end of the second phase.
A computer program with program code for performing, when the computer program is executed on a computer, the method of encrypting a datum to be stored during a write access to a memory at a memory address into an encrypted datum by means of a cryptographic module for generating an address-dependent key from the access address and for encrypting the datum to be stored with the address-dependent key, wherein the cryptographic module includes a cryptographic calculating unit with a data input, a key input, and a data output for performing a cryptographic algorithm on data at the data input and key input, to output a cryptographic result at the data output, wherein the method comprises the steps of:
- controlling the cryptographic module, such that in a first phase the access address passes through the cryptographic module in a first data path into which the cryptographic calculating unit is connected with data input and data output, and a master key is present at the key input of the cryptographic calculating unit in the first phase when the access address passes through the cryptographic calculating unit, in order to obtain the address-dependent key at the end of the first phase;
- and
- controlling the cryptographic module, such that in a second phase the datum to be stored passes through a second data path into which the cryptographic calculating unit is connected with data input and data output, and the address-dependent key is present at the key input of the cryptographic calculating unit in the second phase when the datum to be stored passes through the cryptographic calculating unit, so that the datum to be stored is obtained at the end of the second phase.
A computer program with program code for performing, when the computer program is executed on a computer, the method of decrypting a memory content during a read access to a memory at an access address into a decrypted datum by means of a cryptographic module for generating an address-dependent key from the access address and for decrypting the memory content with the address-dependent key, wherein the cryptographic module includes a data input, a key input, and a data output for performing a cryptographic algorithm on data at the data input and key input, to output a cryptographic result at the data output, wherein the method comprises the steps of:
- controlling the cryptographic module, such that in a first phase the access address passes through the cryptographic module in a first data path into which the cryptographic calculating unit is connected with data input and data output, and a master key is present at the key input of the cryptographic calculating unit in the first phase when the access address passes through the cryptographic calculating unit, in order to obtain the address-dependent key at the end of the first phase;
- and
- controlling the cryptographic module, such that in a second phase the memory content passes through a second path into which the cryptographic calculating unit is connected with data input and data output, and the address-dependent key is present at the key input of the cryptographic calculating unit in the second phase when the memory content passes through the cryptographic calculating unit, so that the decrypted datum is obtained at the end of the second phase.
Dependencies are inferred from the claim text.