# US 2014/0195821 A1 · Method for encrypting a program for subsequent execution by a microprocessor configured to decrypt and execute the encrypted program

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0195821 A1
- Document ID: US20140195821A1
- Status: Published application
- Kind: A1
- Application number: 14/066,350
- Filed: 2013-10-29
- Published: 2014-07-10
- Earliest claimed: 2010-05-25
- Assignees: VIA Technologies, Inc.
- Applicants: VIA Technologies, Inc.
- Inventors: G. Glenn Henry; Terry Parks; Brent Bean; Thomas A. Crispin
- Web page: https://patentgrep.com/patent/US20140195821A1

## CPC

- H04L 9/0827: {involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18)}
- G06F 9/30003: {Arrangements for executing specific machine instructions}
- G06F 9/30058: {Conditional branch instructions}
- G06F 9/30079: {Pipeline control instructions, e.g. multicycle NOP}
- G06F 9/30178: {of compressed or encrypted instructions}
- G06F 9/30189: {according to execution mode, e.g. mode flag}
- G06F 12/0875: with dedicated cache, e.g. instruction or stack
- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/54: by adding security routines or objects to programs
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/71: to assure secure computing or processing of information
- G06F 21/72: in cryptographic circuits
- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- G06F 2212/402: Encrypted data
- G06F 2212/452: Instruction code
- G06F 2221/2107: File encryption
- H04L 2209/12: Details relating to cryptographic hardware or logic circuitry
- H04L 2209/20: Manipulating the length of blocks of bits, e.g. padding or block truncation
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method for encrypting a program for subsequent execution by a microprocessor configured to decrypt and execute the encrypted program includes receiving an object file specifying an unencrypted program that includes conventional branch instructions whose target address may be determined pre-run time. The method also includes analyzing the program to obtain chunk information that divides the program into a sequence of chunks each comprising a sequence of instructions and that includes encryption key data associated with each of the chunks. The encryption key data associated with each of the chunks is distinct. The method also includes replacing each of the conventional branch instructions that specifies a target address that is within a different chunk than the chunk in which the conventional branch instruction resides with a branch and switch key instruction. The method also includes encrypting the program based on the chunk information.

## Claims

### Claim 1

A method for encrypting a program for subsequent execution by a microprocessor configured to decrypt and execute the encrypted program, the method comprising:
receiving an object file specifying an unencrypted program that includes conventional branch instructions whose target address may be determined prior to the time in which the microprocessor runs the program;
analyzing the program to obtain chunk information, wherein the chunk information divides the program into a sequence of chunks, wherein each of the chunks comprises a sequence of instructions, wherein the chunk information further comprises encryption key data associated with each of the chunks, wherein the encryption key data associated with each of the chunks is distinct;
replacing each of the conventional branch instructions that specifies a target address that is within a different chunk than the chunk in which the conventional branch instruction resides with a branch and switch key instruction; and
encrypting the program based on the chunk information.

### Claim 2 (depends on 1)

The method of claim 1, wherein each of the branch and switch key instructions specifies a storage location within the microprocessor storing the encryption key data associated with the chunk that includes the target address specified by the branch and switch key instruction.

### Claim 3 (depends on 1)

The method of claim 1, wherein said encrypting the program based on the chunk information comprises:
for each block of instruction data of each of the chunks, generating an encryption key based on the encryption key data associated with the chunk and a portion of a memory address of the block;
performing a Boolean exclusive-OR (XOR) operation of the block with the generated encryption key.

### Claim 4 (depends on 3)

The method of claim 3, wherein said generating the encryption key based on the encryption key data associated with the chunk and a portion of a memory address of the block comprises:
selecting first and second key values from the encryption key data based on a first portion of the memory address;
rotating the first key value based on a second portion of the memory address;
adding or subtracting the rotated first key value to or from the second key value based on a third portion of the memory address to generate the encryption key.

### Claim 5 (depends on 4)

The method of claim 4, wherein the encryption key data includes K key values, wherein the width of the encryption key and each of the K key values is W bytes, wherein said selecting, rotating, and adding or subtracting yields approximately W2*(K!/(2*(K−2)!)) different combination of bytes of the K key values over a sequence of memory addresses.

### Claim 6 (depends on 3)

The method of claim 3, wherein the encryption key data includes K key values, wherein the width of the encryption key and each of the K key values is W bytes, wherein said generating the encryption key based on the encryption key data associated with the chunk and a portion of a memory address of the block yields an effective encryption key length of approximately W2*(K!/(2*(K−2)!)) bytes.

### Claim 7

A method for encrypting a program for subsequent execution by a microprocessor configured to decrypt and execute the encrypted program, the method comprising:
receiving an object file specifying an unencrypted program that includes conventional branch instructions whose target address may only be determined at the time in which the microprocessor runs the program;
analyzing the program to obtain chunk information, wherein the chunk information divides the program into a sequence of chunks, wherein each of the chunks comprises a sequence of instructions, wherein the chunk information further comprises encryption key data associated with each of the chunks, wherein the encryption key data associated with each of the chunks is distinct;
replacing each of the conventional branch instructions with a branch and switch key instruction; and
encrypting the program based on the chunk information.

### Claim 8 (depends on 7)

The method of claim 7, further comprising:
including the chunk information within the object file for loading into the microprocessor prior to execution of the program by the microprocessor.

### Claim 9 (depends on 8)

The method of claim 8, wherein the chunk information within the object file for loading into the microprocessor prior to execution of the program specifies for each of the chunks a storage location within the microprocessor storing the encryption key data associated with the chunk.

### Claim 10 (depends on 7)

The method of claim 7, wherein said encrypting the program based on the chunk information comprises:
for each block of instruction data of each of the chunks, generating an encryption key based on the encryption key data associated with the chunk and a portion of a memory address of the block;
performing a Boolean exclusive-OR (XOR) operation of the block with the generated encryption key.

### Claim 11 (depends on 10)

The method of claim 10, wherein said generating the encryption key based on the encryption key data associated with the chunk and a portion of a memory address of the block comprises:
selecting first and second key values from the encryption key data based on a first portion of the memory address;
rotating the first key value based on a second portion of the memory address;
adding or subtracting the rotated first key value to or from the second key value based on a third portion of the memory address to generate the encryption key.

### Claim 12 (depends on 11)

The method of claim 11, wherein the encryption key data includes K key values, wherein the width of the encryption key and each of the K key values is W bytes, wherein said selecting, rotating, and adding or subtracting yields approximately W2*(K!/(2*(K−2)!)) different combination of bytes of the K key values over a sequence of memory addresses.

### Claim 13 (depends on 10)

The method of claim 10, wherein the encryption key data includes K key values, wherein the width of the encryption key and each of the K key values is W bytes, wherein said generating the encryption key based on the encryption key data associated with the chunk and a portion of a memory address of the block yields an effective encryption key length of approximately W2*(K!/(2*(K−2)!)) bytes.

### Claim 14

A computer program product encoded in at least one non-transitory computer usable medium for use with a computing device, the computer program product comprising:
computer usable program code embodied in said medium, for specifying a method for encrypting a program for subsequent execution by a microprocessor configured to decrypt and execute the encrypted program, the computer usable program code comprising:
first program code for receiving an object file specifying an unencrypted program that includes conventional branch instructions whose target address may be determined prior to the time in which the microprocessor runs the program;
second program code for analyzing the program to obtain chunk information, wherein the chunk information divides the program into a sequence of chunks, wherein each of the chunks comprises a sequence of instructions, wherein the chunk information further comprises encryption key data associated with each of the chunks, wherein the encryption key data associated with each of the chunks is distinct;
third program code for replacing each of the conventional branch instructions that specifies a target address that is within a different chunk than the chunk in which the conventional branch instruction resides with a branch and switch key instruction; and
fourth program code for encrypting the program based on the chunk information.

### Claim 15 (depends on 14)

The computer program product of claim 14, wherein each of the branch and switch key instructions specifies a storage location within the microprocessor storing the encryption key data associated with the chunk that includes the target address specified by the branch and switch key instruction.

### Claim 16 (depends on 14)

The computer program product of claim 14, wherein said encrypting the program based on the chunk information comprises:
for each block of instruction data of each of the chunks, generating an encryption key based on the encryption key data associated with the chunk and a portion of a memory address of the block;
performing a Boolean exclusive-OR (XOR) operation of the block with the generated encryption key.

### Claim 17 (depends on 16)

The computer program product of claim 16, wherein said generating the encryption key based on the encryption key data associated with the chunk and a portion of a memory address of the block comprises:
selecting first and second key values from the encryption key data based on a first portion of the memory address;
rotating the first key value based on a second portion of the memory address;
adding or subtracting the rotated first key value to or from the second key value based on a third portion of the memory address to generate the encryption key.

### Claim 18 (depends on 17)

The computer program product of claim 17, wherein the encryption key data includes K key values, wherein the width of the encryption key and each of the K key values is W bytes, wherein said selecting, rotating, and adding or subtracting yields approximately W2*(K!/(2*(K−2)!)) different combination of bytes of the K key values over a sequence of memory addresses.

### Claim 19 (depends on 16)

The computer program product of claim 16, wherein the encryption key data includes K key values, wherein the width of the encryption key and each of the K key values is W bytes, wherein said generating the encryption key based on the encryption key data associated with the chunk and a portion of a memory address of the block yields an effective encryption key length of approximately W2*(K!/(2*(K−2)!)) bytes.

### Claim 20 (depends on 14)

The computer program product of claim 14, wherein the at least one non-transitory computer usable medium is selected from the set of a disk, tape, or other magnetic, optical, or electronic storage medium.