Storage and retrieval of encrypted data blocks with in-line message authentication codes

1. A method comprising the steps of:

encrypting a given data block;

generating a message authentication code for the encrypted data block;

determining a first address for storage of the encrypted data block in a memory;

modifying the first address to permit in-line storage of the message authentication code with the encrypted data block in the memory; and

transferring the encrypted data block and the message authentication code to the memory for storage at the modified address instead of at the first address;

wherein the first address is specified in a request that directs storage of the encrypted data block at the first address in the memory.

2. The method of claim 1 wherein the transferring step includes transferring the encrypted data block and the message authentication code to the memory utilizing one or more burst transactions.

3. The method of claim 1 wherein the steps are implemented by a system on a chip and the memory comprises an off-chip memory relative to said system.

4. The method of claim 3 wherein the encrypting and generating steps are implemented in a cryptography engine that is part of the system on a chip.

5. The method of claim 1 wherein the encrypting step utilizes cipher feedback encryption based on a designated encryption algorithm to encrypt the given data block.

6. The method of claim 5 wherein the message authentication code is generated by applying the designated encryption algorithm to an initialization vector comprising a portion of the encrypted data block.

7. The method of claim 5 wherein the designated encryption algorithm comprises an AES-128 encryption algorithm.

8. The method of claim 1 wherein the encrypted data block and the message authentication code are stored in a common row of the memory.

9. The method of claim 1 further including the steps of:

receiving a request to retrieve the encrypted data block from the first address in the memory;

modifying the first address to obtain the modified address;

retrieving the encrypted data block and the message authentication code from the modified address in the memory;

decrypting the encrypted data block; and

verifying the message authentication code.

10. A non-transitory machine-readable storage medium having encoded therein machine-executable instructions that when executed implement the steps of the method of claim 1 .

11. A method comprising the steps of:

encrypting a given data block;

generating a message authentication code for the encrypted data block;

determining a first address for storage of the encrypted data block in a memory;

modifying the first address to permit in-line storage of the message authentication code with the encrypted data block in the memory; and

transferring the encrypted data block and the message authentication code to the memory for storage at the modified address instead of at the first address;

wherein the step of modifying the first address comprises adjusting said first address by a factor given by:

N

+

M

N

,

 where N denotes the number of k-bit elements in the encrypted data block, and M denotes the number of k-bit elements in the message authentication code, where k is a power of 2.

12. The method of claim 11 wherein k≧8 and M=1.

13. The method of claim 12 wherein k=32, N=8 and M=1.

14. A method comprising the steps of:

encrypting a given data block;

generating a message authentication code for the encrypted data block;

determining a first address for storage of the encrypted data block in a memory;

modifying the first address to permit in-line storage of the message authentication code with the encrypted data block in the memory; and

transferring the encrypted data block and the message authentication code to the memory for storage at the modified address instead of at the first address;

wherein the transferring step includes transferring the encrypted data block and the message authentication code to the memory utilizing one or more burst transactions; and

wherein the encrypted data block comprises a plurality of words and the message authentication code comprises at least one word, and further wherein the encrypted data block and the message authentication code are transferred to the memory utilizing a plurality of multi-word burst transactions.

15. A method comprising the steps of:

receiving a request to retrieve an encrypted data block from a first address in a memory;

modifying the first address to obtain a modified address;

retrieving the encrypted data block and a corresponding message authentication code stored in-line with the encrypted data block from the modified address in the memory;

decrypting the encrypted data block; and

verifying the message authentication code.

16. The method of claim 15 wherein the retrieving step includes retrieving the encrypted data block and the message authentication code from the memory utilizing one or more burst transactions.

17. An apparatus comprising:

a processor configured to communicate with a memory; and

a cryptography engine associated with the processor;

the processor being operative to control the cryptography engine to perform encryption of a given data block and generation of a message authentication code for the encrypted data block;

wherein the processor is further operative to determine a first address for storage of the encrypted data block in the memory; to modify the first address to permit in-line storage of the message authentication code with the encrypted data block in the memory; and to transfer the encrypted data block and the message authentication code to the memory for storage at the modified address instead of at the first address; and

wherein the first address is specified in a request that directs storage of the encrypted data block at the first address in the memory.

18. The apparatus of claim 17 wherein the processor communicates with the memory via a memory controller that implements at least a portion of the cryptography engine.

19. The apparatus of claim 17 wherein the processor is an element of a system on a chip and the memory comprises an off-chip memory relative to said system.

20. A processing system comprising:

a processor;

a cryptography engine associated with the processor; and

a memory coupled to the processor;

wherein the cryptography engine is configured to encrypt a given data block and to generate a message authentication code for the encrypted data block; and

wherein the processor is configured to determine a first address for storage of the encrypted data block in the memory; to modify the first address to permit in-line storage of the message authentication code with the encrypted data block in the memory; and to transfer the encrypted data block and the message authentication code to the memory for storage at the modified address instead of at the first address; and

wherein the first address is specified in a request that directs storage of the encrypted data block at the first address in the memory.

21. A method comprising the steps of:

encrypting a given data block;

generating a message authentication code for the encrypted data block;

determining a first address for storage of the encrypted data block in a memory;

modifying the first address to permit in-line storage of the message authentication code with the encrypted data block in the memory; and

transferring the encrypted data block and the message authentication code to the memory for storage at the modified address instead of at the first address;

wherein the first address is determined for storage of the encrypted data block without in-line storage of the message authentication code.