Input/output data encryption

Patent metadata

Field	Value
Publication number	US-10896267-B2
Application number	US-201715420736-A
Country	US
Kind code	B2
Filing date	Jan 31, 2017
Priority date	Jan 31, 2017
Publication date	Jan 19, 2021
Grant date	Jan 19, 2021

Abstract

Examples relate to Input/Output (I/O) data encryption and decryption. In an example, an encryption/decryption engine on an Integrated Circuit (IC) of a computing device obtains at least one plaintext data. Some examples determine, by the encryption/decryption engine, whether the at least one plaintext data is to be sent to a memory in the computing device or to an I/O device. Some examples apply, when the at least one plaintext data is to be sent to the I/O device and by the encryption/decryption engine, an encryption primitive of a block cipher encryption algorithm to the at least one plaintext data to create output encrypted data, wherein an initialization vector that comprises a random number is applied to the encryption primitive.

First claim

What is claimed:

1. A method comprising:
receiving, by a processor on an Integrated Circuit (IC) of a computing device, plaintext data;
determining, by the processor based on a selector indication associated with the plaintext data, whether the plaintext data is to be sent to a memory in the computing device or to an Input/Output (I/O) device, wherein a first value of the selector indication indicates that the plaintext data is to be sent to the memory, and a second value of the selector indication indicates that the plaintext data is to be sent to the I/O device; and
in response to determining based on the selector indication that the plaintext data is to be sent to the I/O device:
selecting, by the processor, a first technique from different techniques for generating an initialization vector, the different techniques comprising the first technique to use a random number in the initialization vector, and a second technique to use an address in the initialization vector, and
applying, by the processor an encryption primitive of a block cipher encryption algorithm to the plaintext data to create output encrypted data, wherein the initialization vector that comprises the random number is applied to the encryption primitive; and

generating a page in the memory of the computing device, the page comprising a data subpage storing the output encrypted data, and a metadata subpage storing the initialization vector.

2. The method of claim 1 , comprising:
in response to determining based on the selector indication that the plaintext data is to be sent to the memory:
selecting, by the processor, the second technique that uses the address in the initialization vector, wherein the address is an address of the plaintext data, and
applying, by the processor, the encryption primitive to the plaintext data to create output encrypted data, wherein the initialization vector that comprises the address is applied to the encryption primitive.

3. The method of claim 1 , wherein the selector indication comprises a selector bit settable to the first value or the second value.

4. The method of claim 1 , comprising:
receiving, by the IC, a request to write the plaintext data to the I/O device, wherein the determining, the selecting, and the applying are performed in response to the request;
storing, by the processor, the output encrypted data into a respective address of the memory; and
sending, by the processor, a writing request to the I/O device including the respective address, to cause the I/O device to copy the output encrypted data from the memory to the I/O device.

5. The method of claim 4 , wherein the copying of the output encrypted data from the memory to the I/O device is part of a Direct Memory Access operation of the I/O device.

6. The method of claim 1 , comprising receiving, by the block cipher encryption algorithm, an encryption key that in combination with the initialization vector determines a functional output of the encryption primitive.

7. The method of claim 1 , comprising:
generating, by the processor, an authentication tag for the output encrypted data; and
using the authentication tag to verify the output encrypted data during a decryption process.

8. The method of claim 7 , wherein the metadata subpage further includes the authentication tag.

9. The method of claim 1 , comprising generating the random number by a random number generator on the IC.

10. The method of claim 1 , comprising generating the random number by:
generating, in a True Random Number Generator (TRNG) of the IC, a random seed;
seeding a Pseudo Random Number Generator (PRNG) of the IC with the random seed; and
generating, in the PRNG, the random number based on the random seed.

11. The method of claim 1 , comprising:
obtaining, by the processor, the output encrypted data; and
applying, by the processor, a decryption primitive of the block cipher encryption algorithm to the output encrypted data to create output plaintext data, wherein the initialization vector comprising the random number is applied to the decryption primitive.

12. The method of claim 11 , comprising:
sending, by the IC, a reading request to the I/O device for the output encrypted data that contains a respective address of the memory of the computing device to store the output encrypted data, to cause copying, by the I/O device, of the output encrypted data into the respective address of the memory; and
decrypting, by the processor, the output encrypted data by applying the decryption primitive to the output encrypted data copied by the I/O device.

13. A non-transitory machine-readable storage medium comprising instructions executable by an Integrated Circuit (IC) in a computing device to:
receive plaintext data;
determine, based on a selector indication associated with the plaintext data, whether the plaintext data is to be sent to a memory in the computing device or to an Input/Output (I/O) device, wherein a first value of the selector indication indicates that the plaintext data is to be sent to the memory, and a second value of the selector indication indicates that the plaintext data is to be sent to the I/O device;
in response to determining based on the selector indication that the plaintext data is to be sent to the I/O device:
select a first technique from different techniques for generating an initialization vector, the different techniques comprising the first technique to use a random number in the initialization vector, and a second technique to use an address of the plaintext data in the initialization vector,
apply an encryption primitive of an authenticated block cipher encryption algorithm to the plaintext data to create output encrypted data, wherein the initialization vector comprising the random number is applied to the encryption primitive, and
generate an authentication tag for the output encrypted data; and
generate a page in the memory of the computing device, the page comprising a data subpage storing the output encrypted data, and a metadata subpage storing the initialization vector.

14. The non-transitory machine-readable storage medium of claim 13 , wherein the instructions are executable by the IC to:
in response to determining based on the selector indication that the plaintext data is to be sent to the memory:
select the second technique that uses the address in the initialization vector, and
apply the encryption primitive to the plaintext data to create output encrypted data, wherein the initialization vector that comprises the address is applied to the encryption primitive.

15. The non-transitory machine-readable storage medium of claim 13 , wherein the metadata subpage is further to store the authentication tag.

16. A method comprising:
receiving, by a processor on an Integrated Circuit (IC) of a computing device, plaintext data;
determining, by the processor based on a selector indication associated with the plaintext data, whether the plaintext data is to be sent to a memory in the computing device or to an Input/Output (I/O) device, wherein a first value of the selector indication indicates that the plaintext data is to be sent to the memory, and a second value of the selector indication indicates that the plaintext data is to be sent to the I/O device; and
in response to determining based on the selector indication that the plaintext data is to be sent to the I/O device:
selecting, by the processor, a first technique from different techniques for generating an initialization vector, the different techniques comprising the first technique to use a random number in the initializ

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Ndu Geoffrey
• Manadhata Pratyusa K
• Dalton Christopher L
• Shaw Adrian
• Haber Stuart

Classifications

• G06F12/1408 Primary

  by using cryptography (for digital transmission H04L9/00) · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F21/80

  in storage media based on magnetic or optical technology, e.g. disks with sectors (preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00) · CPC title

• H04L9/0662

  with particular pseudorandom sequence generator · CPC title

• G06F2212/1052

  Security improvement · CPC title