# US 2020/0401733 A1 · Buffer access for side-channel attack resistance

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0401733 A1
- Document ID: US20200401733A1
- Status: Published application
- Kind: A1
- Application number: 16/922,205
- Filed: 2020-07-07
- Published: 2020-12-24
- Earliest claimed: 2014-12-16
- Assignees: Cryptography Research, Inc.
- Applicants: Cryptography Research, Inc
- Inventors: Andrew John LEISERSON; Mark Evan MARSON
- Web page: https://patentgrep.com/patent/US20200401733A1

## CPC

- G06F 21/755: {with measures against power attack}
- G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00)
- G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00)
- H04L 9/003: {for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA]}
- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 2209/08: Randomization, e.g. dummy operations or using noise
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A cryptographic accelerator (processor) retrieves data blocks for processing from a memory. These data blocks arrive and are stored in an input buffer in the order they were stored in memory (or other known order)—typically sequentially according to memory address (i.e., in-order.) The processor waits until a certain number of data blocks are available in the input buffer and then randomly selects blocks from the input buffer for processing. This randomizes the processing order of the data blocks. The processing order of data blocks may be randomized within sets of data blocks associated with a single read transaction, or across sets of data blocks associated with multiple read transactions.

## Claims

### Claim at position 1

1-20. (canceled)

### Claim 21

A cryptographic processing device, comprising:
circuitry to store, in an input buffer, a first set of data blocks in a first memory address order and a second set of data blocks in a second memory address order; and,
a cryptographic engine to cryptographically process, in data block sized units, the first set of data blocks in a first randomly selected cryptographic processing order that is a permutation of the first memory address order and to store cryptographically processed versions of the first set of data blocks in an output buffer in a third memory address order that is based on the first randomly selected cryptographic processing order, the cryptographic engine also to cryptographically process, in data block sized units, the second set of data blocks in a second randomly selected cryptographic processing order that is a permutation of the second memory address order and to store cryptographically processed versions of the second set of data blocks in the output buffer in a fourth memory address order that is based on the second randomly selected cryptographic processing order.

### Claim 22 (depends on 21)

The cryptographic processing device of claim 21, wherein the second randomly selected cryptographic processing order is to be a permutation of a combination of the first memory address order and the second address memory order.

### Claim 23 (depends on 21)

The cryptographic processing device of claim 21, wherein the first randomly selected cryptographic processing order provides resistance to differential power analysis.

### Claim 24 (depends on 21)

The cryptographic processing device of claim 21, wherein the second randomly selected cryptographic processing order provides resistance to differential power analysis.

### Claim 25 (depends on 21)

The cryptographic processing device of claim 21, wherein cryptographic processing is performed according to a block cipher algorithm.

### Claim 26 (depends on 25)

The cryptographic processing device of claim 25, wherein the block cipher algorithm follows the Advanced Encryption Standard (AES).

### Claim 27 (depends on 25)

The cryptographic processing device of claim 25, wherein the block cipher algorithm follows the Data Encryption Standard (DES).

### Claim 28

A cryptographic processing device, comprising:
a cryptographic processing engine;
a read buffer to store a first set of data blocks in a first memory address order and a second set of data blocks in a second memory address order;
first circuitry to provide, to the cryptographic processing engine, the first set of data blocks in a first randomly selected cryptographic processing order that is a permutation of the first memory address order and to provide, to the cryptographic processing engine, the second set of data blocks in a second randomly selected cryptographic processing order that is a permutation of the second memory address order; and,
second circuitry to store cryptographically processed versions of the first set of data blocks in an output buffer in a third memory address order that is based on the first randomly selected cryptographic processing order, the second circuitry also to store cryptographically processed versions of the second set of data blocks in the output buffer in a fourth memory address order that is based on the second randomly selected cryptographic processing order.

### Claim 29 (depends on 28)

The cryptographic processing device of claim 28, wherein the second randomly selected cryptographic processing order is to be a permutation of a combination of the first memory address order and the second memory address order.

### Claim 30 (depends on 28)

The cryptographic processing device of claim 28, wherein the first randomly selected cryptographic processing order provides resistance to differential power analysis.

### Claim 31 (depends on 28)

The cryptographic processing device of claim 28, wherein the second randomly selected cryptographic processing order provides resistance to differential power analysis.

### Claim 32 (depends on 28)

The cryptographic processing device of claim 28, wherein cryptographic processing is performed according to a block cipher algorithm.

### Claim 33 (depends on 32)

The cryptographic processing device of claim 32, wherein the block cipher algorithm follows the Advanced Encryption Standard (AES).

### Claim 34 (depends on 32)

The cryptographic processing device of claim 32, wherein the block cipher algorithm follows the Data Encryption Standard (DES).

### Claim 35

A method, comprising:
providing, to an input buffer, a first set of data blocks in a first memory address order;
providing, to the input buffer, a second set of data blocks in a second memory address order;
providing, to a cryptographic processing engine, the first set of data blocks in a first randomly selected cryptographic processing order that is a permutation of the first memory address order;
providing, to the cryptographic processing engine, the second set of data blocks in a second randomly selected cryptographic processing order that is a permutation of the second memory address order;
storing cryptographically processed versions of the first set of data blocks in an output buffer in a third memory address order that is based on the first randomly selected cryptographic processing order; and,
storing cryptographically processed versions of the second set of data blocks in the output buffer in a fourth memory address order that is based on the second randomly selected cryptographic processing order.

### Claim 36 (depends on 35)

The method of claim 35, wherein the second randomly selected cryptographic processing order is to be a permutation of a combination of the first memory address order and the second memory address order.

### Claim 37 (depends on 35)

The method of claim 35, wherein the first randomly selected cryptographic processing order provides resistance to differential power analysis.

### Claim 38 (depends on 35)

The method of claim 35, wherein the second randomly selected cryptographic processing order provides resistance to differential power analysis.

### Claim 39 (depends on 35)

The method of claim 35, wherein cryptographic processing is performed according to a block cipher algorithm.

### Claim 40 (depends on 39)

The method of claim 39, wherein the block cipher algorithm follows an encryption standard.