Data processing device and operating method therefor

Patent metadata

Field	Value
Publication number	US-11238166-B2
Application number	US-201916418505-A
Country	US
Kind code	B2
Filing date	May 21, 2019
Priority date	May 23, 2018
Publication date	Feb 1, 2022
Grant date	Feb 1, 2022

Abstract

Data processing device, in particular, for a control unit, the data processing device including at least one computing device, a memory device, a hardware security module and at least one cryptography module.

First claim

What is claimed is:

1. A data processing device, comprising:
at least one computing device;
a memory device;
a hardware security module;
at least one cryptography module; and
a first data bus for exchanging data among the at least one computing device, the memory device, the hardware security module, and the at least one cryptography module, wherein the at least one cryptography module includes a first data interface for exchanging data via the first data bus, wherein the at least one cryptography module includes a second data interface that bypasses the first data bus and is for directly exchanging data with the hardware security module, wherein the at least one cryptography module includes a primary cryptography unit for carrying out at least one first cryptographic function, and wherein the first cryptographic function includes CMAC, Cipher-Based Message Authentication Code, and wherein the at least one cryptography module is configured to compare a first truncated CMAC value with a second, calculated CMAC value.

2. The data processing device as recited in claim 1 , wherein the at least one cryptography module includes hardware circuitry, and wherein the at least one cryptography module is externally to the hardware security module.

3. The data processing device as recited in claim 1 , wherein the at least one cryptography module includes at least one of the following components:
a processing unit,
a key memory device for at least temporarily storing cryptographic keys,
an interrupt request control unit,
a rule monitoring unit,
a control register,
a status register, and
data buffers.

4. The data processing device as recited in claim 3 , wherein the processing unit includes a comparator unit for carrying out at least one second cryptographic function.

5. The data processing device as recited in claim 3 , wherein the first cryptographic function includes at least one of the following elements:
a) AES algorithm,
b) ECB, Electronic code book mode,
c) CBC, Cipher block chaining mode,
d) CTR, Counter mode,
e) OFB, Output feedback mode,
f) CFB, Cipher feedback mode, and
g) GCM, Galois counter mode.

6. The data processing device as recited in claim 1 , further comprising a second data bus via which the hardware security module exchanges data with the at least one cryptography module.

7. A method for operating a data processing device, the data processing device including at least one computing device, a memory device, a hardware security module, and at least one cryptography module, the method comprising:
carrying out, by the cryptography module, at least one first cryptographic function, wherein the at least one cryptography module includes a first data interface for exchanging data via a first data bus of the data processing device and a second data interface that bypasses the first data bus and is for directly exchanging data with the hardware security module, wherein the first cryptographic function includes CMAC, Cipher-Based Message Authentication Code; and
comparing a first truncated CMAC value with a second, calculated CMAC value.

8. The method as recited in claim 7 , wherein the cryptography module carries out the first cryptographic function in parallel to an operation of the hardware security module.

9. The method as recited in claim 7 , wherein the cryptography module carries out the first cryptographic function independently of the hardware security module.

10. The method as recited in claim 7 , wherein the first cryptographic function includes at least one of the following elements:
a) AES algorithm,
b) ECB, Electronic code book mode,
c) CBC, Cipher block chaining mode,
d) CTR, Counter mode,
e) OFB, Output feedback mode,
f) CFB, Cipher feedback mode, and
g) GCM, Galois counter mode.

11. A control unit, comprising:
at least one data processing device that includes:
at least one computing device;
a memory device;
a hardware security module;
at least one cryptography module; and

a first data bus for exchanging data among the at least one computing device, the memory device, the hardware security module, and the at least one cryptography module, wherein the at least one cryptography module includes a first data interface for exchanging data via the first data bus, wherein the at least one cryptography module includes a second data interface that bypasses the first data bus and is for directly exchanging data with the hardware security module, wherein the at least one cryptography module includes a primary cryptography unit for carrying out at least one first cryptographic function, and wherein the first cryptographic function includes CMAC, Cipher-Based Message Authentication Code, and wherein the at least one cryptography module is configured to compare a first truncated CMAC value with a second, calculated CMAC value.

12. The data processing device as recited in claim 1 , wherein the data processing device is for a control unit.

13. The method as recited in claim 7 , wherein the data processing device is for a control unit.

14. The data processing device as recited in claim 1 , wherein the computing device and the memory device are incapable of accessing the second data interface.

15. The method as recited in claim 7 , wherein the computing device and the memory device are incapable of accessing the second data interface.

16. The control unit as recited in claim 11 , wherein the computing device and the memory device are incapable of accessing the second data interface.

Assignees

• Bosch Gmbh Robert

Inventors

• Schramm Juergen
• Soenkens Andreas
• Kasper Bjoern

Classifications

• G06F21/70

  Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F21/72

  in cryptographic circuits · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title