# US 2021/0344653 A1 · Securing platform link with encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344653 A1
- Document ID: US20210344653A1
- Status: Published application
- Kind: A1
- Application number: 17/369,824
- Filed: 2021-07-07
- Published: 2021-11-04
- Earliest claimed: 2018-12-07
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: David J. Harriman; Raghunandan Makaram; Ioannis T. Schoinas; Kapil Sood; Yu-Yuan Chen; Vedvyas Shanbhogue; Siddhartha Chhabra; Reshma Lal; Reouven Elbaz
- Web page: https://patentgrep.com/patent/US20210344653A1

## CPC

- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- G06F 13/4282: {on a serial bus, e.g. I2C bus, SPI bus (on daisy chain buses G06F13/4247)}
- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/12: Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- G06F 2213/0026: PCI express
- Y02D 10/00: Energy efficient computing, e.g. low power processors, power management or thermal management
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE

## Abstract

A protected link between a first computing device and a second computing device is set up, wherein communication over the protected link is to comply with a communication protocol that allows packets to be reordered during transit. A plurality of packets are generated according to a packet format that ensures the plurality of packets will not be reordered during transmission over the protected link, the plurality of packets comprising a first packet and a second packet. Data of the plurality of packets are encrypted for transmission over the protected link, wherein data of the first packet is encrypted based on the cryptographic key and a first value of a counter and data of the second packet is encrypted based on the cryptographic key and a second value of the counter.

## Claims

### Claim at position 1

-20. (canceled)

### Claim 21

An apparatus comprising a computing device, the computing device comprising:
first circuitry to generate a plurality of packets for transmission over a Peripheral Component Interconnect Express (PCIe) link between the computing device and a second computing device, the packets comprising first packets having a message type of Posted Request, second packets having a message type of Completion, or third packets having a message type of Non-Posted Request; and
second circuitry to encrypt data of the plurality of packets for transmission over the PCIe link, wherein the second circuitry is to encrypt data of the first packets of the Posted Request message type based on a first cryptographic key and a first counter, encrypt data of the second packets of the Completion message type based on a second cryptographic key and a second counter, or to encrypt data of the third packets of the Non-Posted Request message type based on a third cryptographic key and a third counter.

### Claim 22 (depends on 21)

The apparatus of claim 21, wherein the second circuitry is to encrypt data of the first, second, or third packets according to Advanced Encryption Standard (AES) implemented in the Galois Counter Mode (GCM) (AES-GCM).

### Claim 23 (depends on 22)

The apparatus of claim 22, wherein payloads of the first, second, or third packets form plaintext and headers of the first, second, or third packets form additional authenticated data according to AES-GCM.

### Claim 24 (depends on 21)

The apparatus of claim 21, wherein the third packets having the message type of Non-Posted Request are not allowed to pass the first packets having the message type of Posted Request over the PCIe link.

### Claim 25 (depends on 21)

The apparatus of claim 21, wherein the second packets having the message type of Completion are not allowed to pass the first packets having the message type of Posted Request over the PCIe link.

### Claim 26 (depends on 21)

The apparatus of claim 21, wherein the third packets having a message type of Non-Posted Request are not allowed to pass each other over the PCIe link, but wherein fourth packets having a message type of Non-Posted Request are allowed to pass each other over a second PCIe link between the first computing device and the second computing device.

### Claim 27 (depends on 21)

The apparatus of claim 21, wherein the computing device is to send a current counter value to the second computing device in a Non-Posted Request for verification against a value of a local counter maintained by the second computing device.

### Claim 28 (depends on 21)

The apparatus of claim 21, further comprising the second computing device.

### Claim 29 (depends on 21)

The apparatus of claim 21, further comprising an interconnect over which the PCIe link is established, wherein an order of the first packets, an order of the second packets, and an order of the third packets is maintained over the interconnect.

### Claim 30 (depends on 29)

The apparatus of claim 29, wherein the interconnect comprises a PCIe switch.

### Claim 31

A method comprising:
setting up a protected Peripheral Component Interconnect Express (PCIe) link between a first computing device and a second computing device;
generating a plurality of packets for transmission over the protected PCIe link, the plurality of packets comprising first packets having a message type of Posted Request, second packets having a message type of Completion, and third packets having a message type of Non-Posted Request; and
encrypting data of the plurality of packets for transmission over the protected PCIe link, wherein the first packets, second packets, and third packets are encrypted in respective streams, wherein each stream utilizes a separate cryptographic key and counter.

### Claim 32 (depends on 31)

The method of claim 31, wherein encrypting data of the plurality of packets for transmission over the protected comprises encrypting the data according to Advanced Encryption Standard (AES) implemented in the Galois Counter Mode (GCM).

### Claim 33 (depends on 32)

The method of claim 32, wherein payloads of the first, second, and third packets form plaintext and headers of the first, second, and third packets form additional authenticated data according to AES-GCM.

### Claim 34 (depends on 31)

The method of claim 31, wherein the third packets having the message type of Non-Posted Request are not allowed to pass the first packets having the message type of Posted Request over the protected PCIe link.

### Claim 35 (depends on 31)

The method of claim 31, wherein the second packets have the message type of Completion are not allowed to pass the first packets having the message type of Posted Request over the protected PCIe link.

### Claim 36 (depends on 31)

The method of claim 31, wherein the third packets having a message type of Non-Posted Request are not allowed to pass each other over the protected PCIe link, but wherein fourth packets having a message type of Non-Posted Request are allowed to pass each other over a second PCIe link between the first computing device and the second computing device.

### Claim 37 (depends on 31)

The method of claim 31, further comprising sending a current counter value to the second computing device in a Non-Posted Request for verification against a value of a local counter maintained by the second computing device.

### Claim 38

At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:
exchange, with a Peripheral Component Interconnect Express (PCIe) endpoint, a plurality of cryptographic keys to encrypt data of a plurality of packets communicated over a PCIe link between the machine and the PCIe endpoint, wherein:
a first cryptographic key of the plurality of cryptographic keys is dedicated to encrypt first packets having a message type of Posted Request;
a second cryptographic key of the plurality of cryptographic keys is dedicated to encrypt second packets having a message type of Completion; and
a third cryptographic key of the plurality of cryptographic keys is dedicated to encrypt third packets having a message type of Non-Posted Request.

### Claim 39 (depends on 38)

The medium of claim 38, wherein the data of the first packets, second packets, and third packets are encrypted according to Advanced Encryption Standard (AES) implemented in the Galois Counter Mode (GCM).

### Claim 40 (depends on 39)

The medium of claim 39, wherein payloads of the first, second, and third packets form plaintext and headers of the first, second, and third packets form additional authenticated data according to AES-GCM.

### Claim 41

A server comprising:
a first computing device comprising:
a processor core; and
a controller coupled to the processor core, the controller comprising:
first circuitry to generate a plurality of packets for transmission over a Peripheral Component Interconnect Express (PCIe) link between the computing device and a second computing device, the packets comprising first packets having a message type of Posted Request, second packets having a message type of Completion, or third packets having a message type of Non-Posted Request; and
second circuitry to encrypt data of the plurality of packets for transmission over the PCIe link, wherein the second circuitry is to encrypt data of the first packets of the Posted Request message type based on a first cryptographic key and a first counter, encrypt data of the second packets of the Completion message type based on a second cryptographic key and a second counter, or to encrypt data of the third packets of the Non-Posted Request message type based on a third cryptographic key and a third counter.

### Claim 42 (depends on 41)

The server of claim 41, further comprising a system memory coupled to the processor core.

### Claim 43 (depends on 41)

The server of claim 41, further comprising the second computing device.

### Claim 44 (depends on 43)

The server of claim 43, wherein the second computing device comprises a network interface controller.

### Claim 45 (depends on 43)

The server of claim 43, wherein the second computing device comprises a graphics interface controller.