# US 2018/0323960 A1 · Timing attack protection in a cryptographic processing system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0323960 A1 - Document ID: US20180323960A1 - Status: Published application - Kind: A1 - Application number: 15/585,535 - Filed: 2017-05-03 - Published: 2018-11-08 - Earliest claimed: 2017-05-03 - Assignees: Seagate Technology LLC - Applicants: Seagate Technology, LLC - Inventors: Timothy J. Courtney - Web page: https://patentgrep.com/patent/US20180323960A1 ## CPC - H04L 9/005: {for timing attacks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Apparatus and method for enacting data security in a cryptographic processing system, such as a data storage device. In some embodiments, a timer circuit is initiated to denote an elapsed time interval of predetermined duration responsive to a function call by an initiator circuit to perform a selected cryptographic function upon input data. The selected cryptographic function is executed to generate output data which are temporarily stored in a memory location during a waiting period prior to a conclusion of the elapsed time interval. Additional functions may be performed during the waiting period. A notification from the timer circuit is received at the conclusion of the elapsed time interval, and the output data are transferred from the memory to the initiator circuit. In this way, a timing attack may be defended against by configuring the selected cryptographic function to have the same overall execution time for different input data sets. ## Claims ### Claim 1 A method of reducing leakage of side-channel information in a communication channel, comprising: initializing a timer circuit to denote an elapsed time interval of predetermined duration responsive to a function call by an initiator circuit; executing a selected cryptographic function upon input data to generate output data; temporarily storing the output data in a memory location prior to a conclusion of the elapsed time interval; receiving a notification from the timer circuit responsive to the conclusion of the elapsed time interval; and transferring the output data from the memory to the initiator circuit responsive to the notification from the timer circuit. ### Claim 2 (depends on 1) The method of claim 1, wherein the input data is a first set of input data, the output data is a first set of output data and a crypto engine circuit generates the first set of output data over a first interval of time having a first duration less than the predetermined duration, and wherein the initializing, using, temporarily storing, receiving and transferring steps are repeated for a different, second set of input data to generate a second set of output data over a second interval of time having a second duration less than the first duration. ### Claim 3 (depends on 2) The method of claim 2, wherein the elapsed time interval denoted by the timer circuit has the same predetermined duration for both the first set of output data and the second set of output data so that both the first set of output data and the second set of output data are nominally received by the initiator circuit after the respective function calls by the initiator circuit by a common amount of elapsed time corresponding to the predetermined duration. ### Claim 4 (depends on 2) The method of claim 2, wherein the elapsed time interval denoted by the timer circuit is a first elapsed time interval having a first overall duration during the generation of the first set of output data established responsive to a first random number, and the elapsed time interval denoted by the timer circuit is a second elapsed time interval having a different, second overall duration during the generation of the second set of output data established responsive to a different, second random number. ### Claim 5 (depends on 1) The method of claim 1, wherein the timer circuit is initialized by supplying the timer circuit with an initial value, and the timer circuit operates to count up or down to a final value responsive to the initial value, the initial value corresponding to the predetermined duration of the elapsed time interval. ### Claim 6 (depends on 5) The method of claim 5, wherein the same initial value is supplied to the timer circuit for the execution of the selected cryptographic function upon a plurality of different sets of input data. ### Claim 7 (depends on 1) The method of claim 1, wherein a control circuit is configured to receive the function call, select a timer initialization value in response to the function call, and initialize the timer circuit using the timer initialization value. ### Claim 8 (depends on 1) The method of claim 1, further comprising executing a second function during an interval of time during which the output data are temporarily stored in the memory location and prior to receiving the notification from the timer circuit at the conclusion of the elapsed time interval. ### Claim 9 (depends on 8) The method of claim 8, wherein the selected cryptographic function is executed by a crypto engine circuit to generate the output data, and the second function is performed by the crypto engine circuit upon dummy data not associated with a function call to generate output data responsive to input data. ### Claim 10 (depends on 1) The method of claim 1, wherein the input data are encrypted user data stored on a main memory of a data storage device, and the selected cryptographic function operates to decrypt the encrypted user data retrieved from the main memory responsive to a host access command received from a host device coupled to the data storage device. ### Claim 11 (depends on 1) The method of claim 1, wherein the use of the timer circuit is configured to defeat a potential timing attack upon a data storage device, and the execution of the selected cryptographic function comprises use of a modulated clock rate at different frequencies during the generation of the output data to defeat a potential differential power analysis (DPA) attack upon the data storage device. ### Claim 12 An apparatus comprising: an initiator circuit configured to issue a function call to perform a selected cryptographic function upon input data; a timer circuit configured to denote an elapsed time interval of predetermined duration responsive to an initialization value supplied responsive to the function call by the initiator circuit; a crypto engine circuit configured to execute the selected cryptographic function upon the input data to generate output data during the elapsed time interval; a memory configured to temporarily store the output data prior to a conclusion of the elapsed time interval; and a control circuit configured to receive a notification from the timer circuit responsive to the conclusion of the elapsed time interval, and to transfer the output data from the memory to the initiator circuit responsive to the notification from the timer circuit. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the control circuit is configured to supply the initialization value to the timer circuit responsive to receipt, by the control circuit, of the function call. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the control circuit is further configured to issue the same initialization value to the timer circuit for each received function call from the initiator device for execution of the selected cryptographic function irrespective of the associated input data. ### Claim 15 (depends on 12) The apparatus of claim 12, wherein the initiator circuit is a programmable processor having associated programming in a processor memory, and the function call is a software/firmware based command issued by the programmable processor. ### Claim 16 (depends on 12) The apparatus of claim 12, wherein the elapsed time interval denoted by the timer circuit has the same predetermined duration for both a first set of output data and a second set of output data from the crypto engine circuit so that both the first set of output data and the second set of output data are nominally received by the initiator circuit after the respective function calls by the initiator circuit by a common amount of elapsed time corresponding to the predetermined duration. ### Claim 17 (depends on 12) The apparatus of claim 12, wherein the control circuit is further configured to forward a request along with the input data to the crypto engine to execute the cryptographic function, to receive the output data from the crypto engine at a conclusion of the execution of the cryptographic function, and to place the received output data in the memory pending receipt of the notification from the timer circuit. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the control circuit is further configured to forward a second request to the crypto engine to perform a different, second function during an interval of time during which the output data are temporarily stored in the memory and prior to receiving the notification from the timer circuit at the conclusion of the elapsed time interval. ### Claim 19 (depends on 12) The apparatus of claim 12, characterized as a data storage device further comprising a main memory, wherein the input data are encrypted user data stored in the main memory, and the selected cryptographic function operates to decrypt the encrypted user data retrieved from the main memory responsive to a host access command received from a host device coupled to the data storage device. ### Claim 20 (depends on 12) The apparatus of claim 12, further comprising a differential power attack (DPA) countermeasures circuit which supplies a modulated clock signal at different frequencies to the crypto engine circuit during the generation of the output data.