# US 2020/0403779 A1 · Error resilient cryptographic units and methods

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0403779 A1
- Document ID: US20200403779A1
- Status: Published application
- Kind: A1
- Application number: 17/010,577
- Filed: 2020-09-02
- Published: 2020-12-24
- Earliest claimed: 2020-09-02
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: Vinodh GOPAL; Kirk YAP
- Web page: https://patentgrep.com/patent/US20200403779A1

## CPC

- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- G06F 11/0772: {Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers}
- G06F 11/1004: {to protect a block of data words, e.g. CRC or checksum (G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00)}
- G06F 11/1044: {with specific ECC/EDC distribution}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00)
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 9/3236: {using cryptographic hash functions}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 2209/34: Encoding or coding, e.g. Huffman coding or error correction
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An apparatus of an aspect includes an encryption unit to receive unencrypted data. The encryption unit is to encrypt the unencrypted data to generate encrypted data. The apparatus also includes circuitry coupled with the encryption unit. The circuitry is to generate a first checksum for a copy of the unencrypted data, generate a second checksum for a copy of the encrypted data, and combine the first and second checksums to generate a first value.

## Claims

### Claim 1

An apparatus comprising:
an encryption unit to receive unencrypted data, the encryption unit to encrypt the unencrypted data to generate encrypted data; and
circuitry coupled with the encryption unit, the circuitry to:
generate a first checksum for a copy of the unencrypted data;
generate a second checksum for a copy of the encrypted data; and
combine the first and second checksums to generate a first value.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the circuitry comprises:
a first checksum unit to receive the copy of the unencrypted data, the first checksum unit to generate the first checksum;
a second checksum unit coupled with an output of the encryption unit to receive the copy of the encrypted data, the second checksum unit to generate the second checksum; and
combinational logic coupled with an output of the first checksum unit to receive the first checksum, and coupled with an output of the second checksum unit to receive the second checksum, the combinational logic to combine the first and second checksums to generate the first value.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the circuitry comprises one selected from a group consisting of a parity bit generation logic to generate one or more parity bits as the first checksum, a cyclic redundancy check (CRC) logic to generate a CRC as the first checksum, and a cryptographic hash logic to generate a cryptographic hash as the first checksum.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein the circuitry comprises a message authentication code (MAC) unit to generate a MAC as the second checksum.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein the circuitry comprises:
one selected from a group consisting of a parity bit generation logic to generate one or more parity bits as the first checksum, a cyclic redundancy check (CRC) logic to generate a CRC as the first checksum, and a cryptographic hash logic to generate a cryptographic hash as the first checksum; and
a message authentication code (MAC) unit to generate a MAC as the second checksum.

### Claim 6 (depends on 5)

The apparatus of claim 5, wherein the MAC unit is to generate one selected from a group consisting of a keyed-hash MAC (HMAC), a KECCAK MAC (KMAC), a cipher-based MAC (CMAC), a one-key MAC (OMAC), a cipher block chaining MAC (CBC-MAC), a counter with CBC-MAC (CCM mode), a Galois Counter Mode MAC (GMAC), and a parallelizable MAC (PMAC).

### Claim 7 (depends on 1)

The apparatus of claim 1, wherein the circuitry is to generate the first value to have a number of bits that is less than a number of bits of the first checksum plus a number of bits of the second checksum.

### Claim 8 (depends on 1)

The apparatus of claim 1, wherein the circuitry is to generate the first value to have a number of bits that is no more than a number of bits of one of the first and second checksums with a largest number of bits.

### Claim 9 (depends on 1)

The apparatus of claim 1, wherein the circuitry comprises combinational logic to generate the first value, and wherein the combination logic comprises one selected from a group consisting of an array of logic gates, an adder, and a subtractor.

### Claim 10 (depends on 1)

The apparatus of claim 1, wherein the circuitry comprises an array of logic gates to generate the first value.

### Claim 11 (depends on 1)

The apparatus of claim 1, wherein the circuitry comprises an array of exclusive OR (XOR) gates to generate the first value.

### Claim 12 (depends on 1)

The apparatus of claim 1, further comprising:
a decryption unit to receive the encrypted data, the decryption unit to decrypt the encrypted data to generate unencrypted data; and
second circuitry to:
generate a third checksum for a copy of the encrypted data that is decrypted;
generate a fourth checksum for a copy of the unencrypted data that is generated by said decrypting the encrypted data;
combine the third and fourth checksums to generate a second value;
compare the first value and the second value.

### Claim 13 (depends on 12)

The apparatus of claim 12, wherein the second circuitry comprises:
a third checksum unit to receive the copy of the encrypted data being provided to the decryption unit, the third checksum unit to generate the third checksum;
a fourth checksum unit coupled with an output of the decryption unit to receive the copy of the unencrypted data generated by the decryption unit, the fourth checksum unit to generate the fourth checksum;
combinational logic coupled with an output of the third checksum unit to receive the third checksum, and coupled with an output of the fourth checksum unit to receive the fourth checksum, the combinational logic to combine the third and fourth checksums to generate the second value; and
comparator logic coupled to receive the first value and coupled with an output of the combinational logic to receive the second value, the comparator logic to compare the first and second values.

### Claim 14 (depends on 1)

The apparatus of claim 1, wherein the circuitry is to use at least some cryptographic information to generate the first checksum, and wherein the circuitry is coupled with the encryption unit to receive the cryptographic information.

### Claim 15 (depends on 1)

The apparatus of claim 1, further comprising a memory controller, wherein the memory controller is to store the encrypted data and the first value in a memory.

### Claim 16

A method comprising:
encrypting unencrypted data to generate encrypted data;
generating a first checksum for a copy of the unencrypted data;
generating a second checksum for a copy of the encrypted data; and
combining the first and second checksums to generate a first value.

### Claim 17 (depends on 16)

The method of claim 16, wherein said generating the first checksum comprises generating one selected from a group consisting of one or more parity bits, a cyclic redundancy check (CRC), and a cryptographic hash.

### Claim 18 (depends on 17)

The method of claim 17, wherein said generating the second checksum comprises generating a message authentication code (MAC).

### Claim 19 (depends on 16)

The method of claim 16, wherein said combining the first and second checksums to generate the first value comprises one of performing a logical operation on the first and second checksums, adding the first and second checksums, and subtracting the first and second checksums.

### Claim 20 (depends on 16)

The method of claim 16, wherein said generating the first checksum comprises using at least some encrypted information to generate the first checksum.

### Claim 21 (depends on 16)

The method of claim 16, further comprising storing the encrypted data and the first value in a memory.

### Claim 22 (depends on 16)

The method of claim 16, further comprising:
decrypting the encrypted data to generate unencrypted data;
generating a third checksum for a copy of the encrypted data that is decrypted;
generating a fourth checksum for a copy of the unencrypted data that is generated by said decrypting the encrypted data;
combining the third and fourth checksums to generate a second value;
comparing the first value and the second value; and
providing an error indication if the first and second values are not equal.

### Claim 23

A system comprising:
a central processing unit (CPU) to execute an instruction to store unencrypted data to memory;
a memory controller coupled with the CPU, the memory controller comprising:
an encryption unit to receive the unencrypted data, the encryption unit to encrypt the unencrypted data to generate encrypted data;
a first checksum unit to receive a copy of the unencrypted data, the first checksum unit to generate a first checksum for the copy of the unencrypted data;
a second checksum unit coupled with an output of the encryption unit to receive a copy of the encrypted data, the second checksum unit to generate a second checksum for the copy of the encrypted data; and
combinational logic coupled with an output of the first checksum unit to receive the first checksum, and coupled with an output of the second checksum unit to receive the second checksum, the combinational logic to combine the first and second checksums to generate a first value; and
a dynamic random access memory (DRAM) coupled with the memory controller, the DRAM to store the encrypted data and the first value.

### Claim 24 (depends on 23)

The system of claim 23, wherein the memory controller further comprises:
a decryption unit to receive the encrypted data, the decryption unit to decrypt the encrypted data to generate unencrypted data;
a third checksum unit to receive a copy of the encrypted data being provided to the decryption unit, the third checksum unit to generate a third checksum for the copy of the encrypted data being provided to the decryption unit;
a fourth checksum unit coupled with an output of the decryption unit to receive a copy of the unencrypted data generated by the decryption unit, the fourth checksum unit to generate a fourth checksum for the copy of the unencrypted data generated by the decryption unit;
combinational logic coupled with an output of the third checksum unit to receive the third checksum, and coupled with an output of the fourth checksum unit to receive the fourth checksum, the combinational logic to combine the third and fourth checksums to generate a second value; and
comparator logic to receive the first value and coupled with an output of the combinational logic to receive the second value, the comparator logic to compare the first and second values.