# US 2020/0401731 A1 · Scalable encryption engine having partitionable data paths > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401731 A1 - Document ID: US20200401731A1 - Status: Published application - Kind: A1 - Application number: 16/446,140 - Filed: 2019-06-19 - Published: 2020-12-24 - Earliest claimed: 2019-06-19 - Assignees: Facebook Technologies, LLC - Applicants: Facebook Technologies, LLC - Inventors: Sudhir Satpathy - Web page: https://patentgrep.com/patent/US20200401731A1 ## CPC - G06F 21/725: {operating on a secure reference time value} - H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms} - G06F 3/14: Digital output to display device {; Cooperation and interconnection of the display device with other functional units} - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - G06F 21/76: in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD] - H04L 2209/125: Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In general, this disclosure describes scalable, partitionable encryption engines. The partitionable encryption engines of this disclosure yield power savings, such as by controlling operation of partitioned sub-datapaths at reduced clock rates. An apparatus includes an interface configured to receive a block of encrypted data for decryption, and a decryption engine in communication with the interface. The decryption engine includes a plurality of decryption sub-datapaths, where each respective decryption sub-datapath has no data interdependency with any other decryption sub-datapath of the plurality of decryption sub-datapaths. The decryption engine is configured to selectively enable one or more decryption sub-datapaths of the plurality of decryption sub-datapaths to decrypt the block of encrypted data to form a decrypted block of data. ## Claims ### Claim 1 An artificial reality system comprising: a decryption engine comprising a plurality of decryption sub-datapaths where each decryption sub-datapath has no data interdependency with any other decryption sub-datapath of the plurality of decryption sub-datapaths, and wherein the decryption engine is configured to selectively enable one or more decryption sub-datapaths of the plurality of decryption sub-datapaths to decrypt a block of encrypted data to form a decrypted block of data; and a head-mounted display (HMD) configured to output artificial reality content that includes the decrypted block of data. ### Claim 2 (depends on 1) The artificial reality system of claim 1, wherein to decrypt the block of encrypted data, the decryption engine is further configured to: partition the block of encrypted data into a plurality of sub-blocks, wherein each sub-block of the plurality of sub-blocks is associated with a respective category; perform shifting operations to arrange the respective sub-blocks of each respective category in a respective sequential run; and perform transposition operations on each respective sequential run without data interdependency on any other sequential run formed from the plurality of sub-blocks. ### Claim 3 (depends on 2) The artificial reality system of claim 2, wherein the block has a length of sixteen bytes, and wherein each respective sub-block of the plurality of sub-blocks has a length of four bytes. ### Claim 4 (depends on 1) The artificial reality system of claim 1, wherein the decryption engine is configured to implement a plurality of clocks, each clock of the plurality of clocks being associated with a respective decryption sub-datapath of the plurality of the decryption sub-datapaths, wherein to selectively enable the one or more decryption sub-datapaths, the decryption engine is configured to, for each of the one or more decryption sub-datapaths, activate the clock associated with the respective decryption sub-datapath, and wherein the decryption engine is configured to activate at least two clocks of the plurality of clocks for different non-overlapping clock cycles. ### Claim 5 (depends on 4) The artificial reality system of claim 4, wherein the plurality of clocks comprises four clocks, and wherein the decryption engine is configured to: implement each clock of the four clocks at a quarter round frequency; and stagger activation of the four clocks such that one of the clocks is in an activated state and three of the clocks are in inactive states during a given clock cycle. ### Claim 6 (depends on 4) The artificial reality system of claim 4, wherein the plurality of clocks comprises four clocks, and wherein the decryption engine is configured to: implement each clock of the four clocks at a half round frequency; and stagger activation of the four clocks such that two of the clocks are in activated states and two of the clocks are in inactive states during a given clock cycle. ### Claim 7 (depends on 1) The artificial reality system of claim 1, wherein the decryption engine is configured to selectively enable the one or more decryption sub-datapaths based on a decryption mode according to which the decryption engine is operating, and wherein the decryption engine is configured to determine the decryption mode based on a frequency at which one or more clocks are presently operating, wherein each clock the one or more clocks controls a respective sub-datapath of the plurality of sub-datapaths. ### Claim 8 (depends on 7) The artificial reality system of claim 7, wherein the decryption mode is one of a full decryption mode or a sample decryption mode, and wherein the decryption mode is configured to select between the full decryption mode and the sample decryption mode based on whether all frames of input data including the block are to be decrypted or only a subset of frames of input data including the block are to be decrypted. ### Claim 9 (depends on 1) The artificial reality system of claim 1, wherein the decryption engine is integrated within the HMD. ### Claim 10 A method comprising: determining, by a decryption engine, a decryption mode based on a frequency at which one or more clocks are presently operating, wherein each clock the one or more clocks controls a respective sub-datapath of a plurality of sub-datapaths of the decryption engine, and wherein each decryption sub-datapath has no data interdependency with any other decryption sub-datapath of the plurality of decryption sub-datapaths; selectively enabling, by the decryption engine, one or more decryption sub-datapaths of the plurality of decryption sub-datapaths to decrypt a block of encrypted data to form a decrypted block of data based on a determination that the respective clocks that control the one or more enabled decryption sub-datapaths are in an activated state; and decrypting, by the decryption engine, a block of encrypted data to form a decrypted block of data using the one or more selectively enabled sub-datapaths. ### Claim 11 An apparatus for data decryption, the apparatus comprising: an interface configured to receive a block of encrypted data for decryption; and a decryption engine in communication with the interface, the decryption engine comprising a plurality of decryption sub-datapaths, where each respective decryption sub-datapath has no data interdependency with any other decryption sub-datapath of the plurality of decryption sub-datapaths, wherein the decryption engine is configured to selectively enable one or more decryption sub-datapaths of the plurality of decryption sub-datapaths to decrypt the block of encrypted data to form a decrypted block of data. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein to decrypt the block of encrypted data, the decryption engine is further configured to: partition the block of encrypted data into a plurality of sub-blocks, wherein each sub-block of the plurality of sub-blocks is associated with a respective category; perform shifting operations to arrange the respective sub-blocks of each respective category in a respective sequential run; and perform transposition operations on each respective sequential run without data interdependency on any other sequential run formed from the plurality of sub-blocks. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the block has a length of sixteen bytes, and wherein each respective sub-block of the plurality of sub-blocks has a length of four bytes. ### Claim 14 (depends on 11) The apparatus of claim 11, wherein the decryption engine is configured to implement a plurality of clocks, each respective clock of the plurality of clocks being associated with a respective decryption sub-datapath of the plurality of the decryption sub-datapaths, and wherein to selectively enable the one or more decryption sub-datapaths, the decryption engine is configured to, for each of the one or more decryption sub-datapaths, activate the clock associated with the respective decryption sub-datapath. ### Claim 15 (depends on 14) The apparatus of claim 14, wherein the plurality of clocks comprises four clocks, and wherein the decryption engine is configured to: implement each clock of the four clocks at a quarter round frequency; and stagger activation of the four clocks such that one of the clocks is in an activated state and three of the clocks are in inactive states during a given clock cycle. ### Claim 16 (depends on 14) The apparatus of claim 14, wherein the plurality of clocks comprises four clocks, and wherein the decryption engine is configured to: implement each clock of the four clocks at a half round frequency; and stagger activation of the four clocks such that two clocks of the clocks are in activated states and two of the clocks are in inactive states during a given clock cycle. ### Claim 17 (depends on 11) The apparatus of claim 11, wherein the decryption engine is configured to selectively enable the one or more decryption sub-datapaths based on a decryption mode according to which the decryption engine is operating, and wherein the description engine is configured to determine the decryption mode based on a frequency at which one or more clocks are presently operating, wherein each clock the one or more clocks controls a respective sub-datapath of the plurality of sub-datapaths. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the decryption mode is one of a full decryption mode or a sample decryption mode, and wherein the decryption mode is configured to select between the full decryption mode and the sample decryption mode based on whether all frames of input data including the block are to be decrypted or only a subset of frames of input data including the block are to be decrypted. ### Claim 19 (depends on 11) The apparatus of claim 11, wherein the apparatus is a system on a chip (SoC). ### Claim 20 (depends on 19) The apparatus of claim 19, wherein the SoC is configured to support an artificial reality application. ### Claim 21 An artificial reality system comprising: an encryption engine comprising a plurality of encryption sub-datapaths where each encryption sub-datapath has no data interdependency with any other encryption sub-datapath of the plurality of encryption sub-datapaths, and wherein the encryption engine is configured to selectively enable one or more encryption sub-datapaths of the plurality of encryption sub-datapaths to encrypt a block of input data to form an encrypted block of data; and a head-mounted display (HMD) configured to output the encrypted block of data.