# US 2019/0171583 A1 · Apparatus and Method for Memory Address Encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0171583 A1
- Document ID: US20190171583A1
- Status: Published application
- Kind: A1
- Application number: 16/253,831
- Filed: 2019-01-22
- Published: 2019-06-06
- Earliest claimed: 2013-07-15
- Assignees: Infineon Technologies AG
- Applicants: Infineon Technologies AG
- Inventors: Berndt Gammel
- Web page: https://patentgrep.com/patent/US20190171583A1

## CPC

- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- G06F 12/10: Address translation
- G06F 12/145: {the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism}
- G06F 2212/1024: Latency reduction
- G06F 2212/1028: Power efficiency
- G06F 2212/1052: Security improvement
- Y02D 10/00: Energy efficient computing, e.g. low power processors, power management or thermal management
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE

## Abstract

An apparatus for encrypting an input memory address to obtain an encrypted memory address comprises an input interface for receiving the input memory address being an address of a memory. Moreover, the apparatus comprises an encryption module for encrypting the input memory address depending on a cryptographic key to obtain the encrypted memory address. The encryption module is configured to encrypt the input memory address by applying a map mapping the input memory address to the encrypted memory address, wherein the encryption module is configured to apply the map by conducting a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation, such that the map is bijective.

## Claims

### Claim 1

An apparatus for encrypting an input memory address to obtain an encrypted memory address, comprising:
an input interface configured to receive the input memory address being an address of a memory,
a segmentation module configured to segment the input memory address into a plurality of input memory address segments, and
an encryption module configured to encrypt each input memory address segment of the plurality of input memory address segments depending on a respective one of a plurality of cryptographic subkeys, wherein the encryption module is configured to encrypt said input memory address segment by applying a map mapping said input memory address segment to an encrypted memory address segment, said encrypted memory address segment being one of a plurality of encrypted memory address segments, wherein the encryption module is configured to apply the map by conducting a multiplication and a modulo operation using one of the plurality of cryptographic subkeys and one of a plurality of divisors, such that the map is bijective,
wherein the encrypted memory address segments of the plurality of encrypted memory address segments together form the encrypted memory address.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein each of the plurality of input memory address segments indicates a polynomial of a first group of polynomials, wherein each of the plurality of encrypted memory address segments indicates a polynomial of a second group of polynomials, wherein each of the plurality of cryptographic subkeys indicates a third polynomial, and wherein each of the plurality of divisors indicates a fourth polynomial being an irreducible polynomial.

### Claim 3 (depends on 1)

The apparatus of claim 1,
wherein the encryption module is configured to encrypt each of the input memory address segments by applying said map mapping said input memory address segment to on of the plurality of encrypted memory address segments, by employing the formula
ai′=aiki(mod pi),
wherein i indicates an index of said input memory address segment,
wherein ai indicates said input memory address segment,
wherein ai′ indicates said one of the plurality of encrypted memory address segments,
wherein ki indicates one of the encryption subkeys, and
wherein pi indicates one of the divisors.

### Claim 4 (depends on 3)

The apparatus of claim 3, wherein the apparatus is configurable to select for each input memory address segment al of the input memory address segments an identity key as the encryption key ki, such that ai ki (mod pi)=ai (mod pi).

### Claim 5 (depends on 3)

The apparatus of claim 3, wherein the apparatus is configurable to select for each input memory address segment as of the input memory address segments a zero key as the encryption key ki, such that ai ki (mod pi)=0.

### Claim 6 (depends on 1)

The apparatus of claim 1,
wherein the encryption module is configured to encrypt each of the input memory address segments by applying said map mapping said input memory address segment to one of the plurality of encrypted memory address segments, by employing the formula
ai′=aiki(mod pi)+bi,
wherein i indicates an index of said input memory address segment,
wherein ai indicates said input memory address segment,
wherein ai′ indicates said one of the plurality of encrypted memory address segments,
wherein ki indicates one of the encryption subkeys,
wherein pi indicates one of the divisors, and
wherein bi indicates one of a plurality of auxiliary keys.

### Claim 7 (depends on 6)

The apparatus of claim 6, wherein the apparatus is configurable to select for each input memory address segment ad of the input memory address segments an identity key as the encryption key ki, such that
aiki(mod pi0+bi=ai(mod pi)+bi.

### Claim 8 (depends on 6)

The apparatus of claim 6, wherein the apparatus is configurable to select for each input memory address segment as of the input memory address segments a zero key as the encryption key ki, such that
aiki(mod pi)+bi=bi.

### Claim 9 (depends on 1)

The apparatus of claim 1, wherein the encryption module is configured to conduct the multiplication and the modulo operation further using one or more bits of the input memory address other than bits of the input memory address segment being mapped.

### Claim 10

An apparatus comprising:
a microprocessor for providing an original logical address,
an MMU for generating a shifted logical address depending on the original logical address,
an address encryption unit for encrypting the shifted logical address to obtain a physical address, the address encryption unit comprising an input interface for receiving the shifted logical address, and further comprising an encryption module for encrypting the shifted logical address depending on a cryptographic key to obtain the physical address, wherein the encryption module is configured to encrypt the shifted logical address by applying a map mapping the shifted logical address to the physical address, wherein the encryption module is configured to apply the map by conducting a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation, such that the map is bijective,
a data encryption-decryption unit for encrypting first plaintext data to obtain first ciphertext data and for decrypting second ciphertext data to obtain second plaintext data,
a key storage for storing the cryptographic key,
and a memory being configured to either store the first ciphertext data at the physical address, or to provide the second ciphertext data being stored at the physical address to the data encryption-decryption module.

### Claim 11

A method for encrypting an input memory address to obtain an encrypted memory address, comprising:
receiving the input memory address being an address of a memory,
segmenting the input memory address into a plurality of input memory address segments, and
encrypting each input memory address segment of the plurality of input memory address segments depending on a respective one of a plurality of cryptographic subkeys to obtain the encrypted memory address, wherein encrypting said input memory address segment comprises applying a map mapping said input memory address segment to an encrypted memory address segment of a plurality of encrypted memory address segments by conducting a multiplication and a modulo operation using one of the plurality of cryptographic subkeys and one of a plurality of divisors, such that the map is bijective,
wherein the encrypted memory address segments of the plurality of encrypted memory address segments together form the encrypted memory address.

### Claim 12 (depends on 11)

The method of claim 11, wherein each of the plurality of input memory address segments indicates a polynomial of a first group of polynomials, wherein each of the plurality of encrypted memory address segments indicates a polynomial of a second group of polynomials, wherein each of the plurality of cryptographic subkeys indicates a third polynomial, and wherein each of the plurality of divisors indicates a fourth polynomial being an irreducible polynomial.

### Claim 13 (depends on 11)

The method of claim 11, wherein conducting the multiplication and the modulo operation further uses one or more bits of the input memory address other than bits of the input address segment being mapped.

### Claim 14 (depends on 11)

A computer program for implementing the method of claim 11, when being executed by a computer or signal processor.