# US 2014/0195820 A1 · Apparatus for generating a decryption key for use to decrypt a block of encrypted instruction data being fetched from an instruction cache in a microprocessor

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0195820 A1
- Document ID: US20140195820A1
- Status: Published application
- Kind: A1
- Application number: 14/066,270
- Filed: 2013-10-29
- Published: 2014-07-10
- Earliest claimed: 2010-05-25
- Assignees: VIA Technologies, Inc.
- Applicants: VIA Technologies, Inc.
- Inventors: G. Glenn Henry; Terry Parks; Brent Bean; Thomas A. Crispin
- Web page: https://patentgrep.com/patent/US20140195820A1

## CPC

- H04L 9/0827: {involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18)}
- G06F 9/30003: {Arrangements for executing specific machine instructions}
- G06F 9/30058: {Conditional branch instructions}
- G06F 9/30079: {Pipeline control instructions, e.g. multicycle NOP}
- G06F 9/30178: {of compressed or encrypted instructions}
- G06F 9/30189: {according to execution mode, e.g. mode flag}
- G06F 12/0875: with dedicated cache, e.g. instruction or stack
- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/54: by adding security routines or objects to programs
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/71: to assure secure computing or processing of information
- G06F 21/72: in cryptographic circuits
- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- G06F 2212/402: Encrypted data
- G06F 2212/452: Instruction code
- G06F 2221/2107: File encryption
- H04L 2209/12: Details relating to cryptographic hardware or logic circuitry
- H04L 2209/20: Manipulating the length of blocks of bits, e.g. padding or block truncation
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An apparatus for generating a decryption key for use to decrypt a block of encrypted instruction data being fetched from an instruction cache in a microprocessor at a fetch address includes a first multiplexer that selects a first key value from a plurality of key values based on a first portion of the fetch address. A second multiplexer selects a second key value from the plurality of key values based on the first portion of the fetch address. A rotater rotates the first key value based on a second portion of the fetch address. An arithmetic unit selectively adds or subtracts the rotated first key value to or from the second key value based on a third portion of the fetch address to generate the decryption key.

## Claims

### Claim 1

An apparatus for generating a decryption key for use to decrypt a block of encrypted instruction data being fetched from an instruction cache in a microprocessor at a fetch address, the apparatus comprising:
a first multiplexer, configured to select a first key value from a plurality of key values based on a first portion of the fetch address;
a second multiplexer, configured to select a second key value from the plurality of key values based on the first portion of the fetch address;
a rotater, configured to rotate the first key value based on a second portion of the fetch address; and
an arithmetic unit, configured to selectively add or subtract the rotated first key value to or from the second key value based on a third portion of the fetch address to generate the decryption key.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the decryption key is generated for use by the microprocessor to Boolean exclusive-OR (XOR) the generated decryption key with the fetched block of encrypted instruction data to decrypt the block.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the apparatus is configured to generate the decryption key in less time than required to fetch the encrypted instruction data from the instruction cache at the fetch address.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein the apparatus is configured to yield an effective decryption key length over a plurality of consecutive blocks of encrypted instruction data of approximately W2*(K!/(2*(K−2)!)) bytes, wherein the width of the decryption key and of the first and second key values is W bytes, wherein the plurality of key values is K.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein plain text data decrypted from the encrypted instruction data using the decryption key is unobservable outside the microprocessor.

### Claim 6 (depends on 1)

The apparatus of claim 1, further comprising:
a control bit, configured to store an indication of whether the microprocessor is in a decryption mode or a plain text mode;
wherein the decryption key is generated for use by the microprocessor to Boolean exclusive-OR (XOR) the generated decryption key with the fetched block of encrypted instruction data to decrypt the block if the microprocessor is in the decryption mode;
wherein the fetched block of encrypted instruction data is Boolean XORed with zeroes if the microprocessor is in the plain text mode.

### Claim 7 (depends on 1)

The apparatus of claim 1, wherein the plurality of key values from which the first and second key values are selected is subject to an update prior to selection by the first and second multiplexers.

### Claim 8 (depends on 7)

The apparatus of claim 7, wherein the update is performed in response to execution of an instruction that instructs the microprocessor to perform the update.

### Claim 9 (depends on 8)

The apparatus of claim 8, wherein the instruction further instructs the microprocessor to conditionally branch and to perform the update only if the branch is taken.

### Claim 10 (depends on 7)

The apparatus of claim 7, wherein the update is performed in response to a task switch of the microprocessor.

### Claim 11 (depends on 7)

The apparatus of claim 7, wherein the update is performed in response to execution of a return from interrupt instruction by the microprocessor.

### Claim 12

A method for generating a decryption key for use to decrypt a block of encrypted instruction data being fetched from an instruction cache in a microprocessor at a fetch address, the method comprising:
selecting a first key value from a plurality of key values based on a first portion of the fetch address;
selecting a second key value from the plurality of key values based on the first portion of the fetch address;
rotating the first key value based on a second portion of the fetch address; and
selectively adding or subtracting the rotated first key value to or from the second key value based on a third portion of the fetch address to generate the decryption key.

### Claim 13 (depends on 12)

The method of claim 12, wherein the decryption key is generated for use by the microprocessor to Boolean exclusive-OR (XOR) the generated decryption key with the fetched block of encrypted instruction data to decrypt the block.

### Claim 14 (depends on 12)

The method of claim 12, wherein the method for generating the decryption key is performed in less time than required to fetch the encrypted instruction data from the instruction cache at the fetch address.

### Claim 15 (depends on 12)

The method of claim 12, wherein over a plurality of consecutive blocks of encrypted instruction data, an effective decryption key length is yielded of approximately W2*(K!/(2*(K−2)!)) bytes, wherein the width of the decryption key and of the first and second key values is W bytes, wherein the plurality of key values is K.

### Claim 16 (depends on 12)

The method of claim 12, wherein the plurality of key values from which the first and second key values are selected is subject to an update prior to selection by the first and second multiplexers.

### Claim 17 (depends on 16)

The method of claim 16, wherein the update is performed in response to execution of an instruction that instructs the microprocessor to perform the update.

### Claim 18 (depends on 16)

The method of claim 16, wherein the update is performed in response to a task switch of the microprocessor.

### Claim 19

A computer program product encoded in at least one non-transitory computer usable medium for use with a computing device, the computer program product comprising:
computer usable program code embodied in said medium, for specifying an apparatus for generating a decryption key for use to decrypt a block of encrypted instruction data being fetched from an instruction cache in a microprocessor at a fetch address, the computer usable program code comprising:
first program code for specifying a first multiplexer, configured to select a first key value from a plurality of key values based on a first portion of the fetch address;
second program code for specifying a second multiplexer, configured to select a second key value from the plurality of key values based on the first portion of the fetch address;
third program code for specifying a rotater, configured to rotate the first key value based on a second portion of the fetch address; and
fourth program code for specifying an arithmetic unit, configured to selectively add or subtract the rotated first key value to or from the second key value based on a third portion of the fetch address to generate the decryption key.

### Claim 20 (depends on 19)

The computer program product of claim 19, wherein the at least one non-transitory computer usable medium is selected from the set of a disk, tape, or other magnetic, optical, or electronic storage medium.