Layout-optimized random mask distribution system and method
A data processing system includes a module for generating and distributing random masks to a number of cryptographic accelerators while providing for fewer total interconnects among the components generating the random masks. The module segments the tasks associated with generating random masks across a number of modules and blocks such that routing and timing problems can be minimized and layout can be optimized. A method for generating and distributing random masks to a number of cryptographic accelerators is also provided. The random masks are utilized by cryptographic accelerators to protect secret keys, and data associated with those keys, from discovery by unauthorized users.
1. A data processing system comprising:
a random number source configured to provide random numbers;
a random number distribution circuit electronically coupled to said random number source via a first bus, wherein said random number distribution circuit is configured to receive random numbers from said random number source via said first bus and provide the random numbers external to said random number distribution circuit;
a first mask generating circuit electronically coupled to said random number distribution circuit via a second bus, wherein said first mask generating circuit is configured to receive random numbers via said second bus from said random number distribution circuit, create random masks from the random numbers, and provide random masks external to said mask generating circuit; and
first cryptographic accelerator circuitry electronically coupled to said first mask generating circuit via a third bus, wherein said first cryptographic accelerator circuitry is configured to receive random masks from said mask generating circuit via said third bus, and use the random masks to perform a cryptographic algorithm.
2. A data processing system as claimed in claim 1 additionally comprising second cryptographic accelerator circuitry electronically coupled to said first mask generating circuit via a fourth bus, wherein said second cryptographic accelerator circuitry is configured to receive random masks from said mask generating circuit via said fourth bus, and use the random masks to perform a cryptographic algorithm.
3. A data processing system as claimed in claim 1 additionally comprising a second mask generating circuit electronically coupled to said random number distribution circuit via a fifth bus, wherein said second mask generating circuit is configured to receive random numbers via said fifth bus from said random number distribution circuit, create random masks from the random numbers, and provide the random numbers external to said mask generating circuit, said data processing system still further comprising a third cryptographic accelerator electronically coupled to said second mask generating circuit via a sixth bus, and a fourth cryptographic accelerator electronically coupled to said second mask generating circuit via a seventh bus, wherein said third and fourth cryptographic accelerators are configured to receive random masks from said mask generating circuit via said sixth and seventh busses, and use the masks to perform a cryptographic algorithm.
4. A data processing system as claimed in claim 1 , wherein said random number source is a random number generator.
5. A data processing system as claimed in claim 1 , wherein said first mask generating circuit is further configured to monitor the number of random masks created by said first mask generating circuit from a given random number, and when a pre-determined number of random masks have been created, request a new random number from said random number distribution circuit, receive a new random number from said random number distribution circuit, and use the new random number to generate random masks.
6. A data processing system as claimed in claim 1 , wherein said random number distribution circuit further comprises a register configured to store random numbers received from said random number source, and wherein said random number distribution circuit is further configured to provide a random number stored in said register, in segments having a size less than the size of the random number, in a sequential fashion, external to said random number distribution circuit via said second bus.
7. A data processing system as claimed in claim 1 , further comprising clock circuitry providing a clock signal having clock cycles to said mask generating circuit, wherein said mask generating circuit is further configured to be capable of providing a random mask to said cryptographic accelerator on each clock cycle.
8. A random mask distribution system comprising:
a random number source;
a random number distribution circuit electronically coupled to said random number source via a first bus, wherein said random number distribution circuit is configured to receive random numbers from said random number source via said first bus and provide the random numbers external to said random number distribution circuit;
a first mask generating circuit electronically coupled to said random number distribution circuit via a second bus, wherein said first mask generating circuit is configured to request random numbers from said random number distribution circuit, receive requested random numbers via said second bus from said random number distribution circuit, create random masks from the random numbers, and provide the random masks external to said mask generating circuit; and
first and second cryptographic accelerator circuits electronically coupled to said first mask generating circuit via third and fourth busses, respectively, wherein said first and second cryptographic accelerator circuits are each configured to receive random masks from said mask generating circuit via said third and fourth busses, and use the masks to perform cryptographic algorithms.
9. The random mask distribution system as claimed in claim 8 , further comprising
a second mask generating circuit electronically coupled to said random number distribution circuit via a fifth bus, wherein said second mask generating circuit is configured to request random numbers from said random number distribution circuit, receive requested random numbers via said fifth bus from said random number distribution circuit, create random masks from the random numbers, and provide the random masks external to said mask generating circuit; and
third and fourth cryptographic accelerator circuits electronically coupled to said second mask generating circuit via sixth and seventh busses, respectively, wherein said third and fourth cryptographic accelerator circuits are each configured to receive random masks from said mask generating circuit via said sixth and seventh busses, and use the masks to perform cryptographic algorithms.
10. The random mask distribution system as claimed in claim 8 , wherein said first, second and third busses are parallel busses having a width in bits, and wherein said first and third busses have a width in bits that is at least twice the width of said second bus.
11. The random mask distribution system as claimed in claim 8 , wherein said third bus has a width that is at least twice the width of said first bus.
12. The random mask distribution system as claimed in claim 8 , wherein said random number distribution circuit further comprises a register configured to store random numbers received from said random number source, and wherein said random number distribution circuit is further configured to provide a random number stored in said register, in segments having a size less than the size of the random number, in a sequential fashion, to said first mask generating circuit via said second bus.
13. The random mask distribution system as claimed in claim 8 , further comprising clock circuitry providing a clock signal having clock cycles to said random number distribution circuit and said first mask generating circuit, wherein said mask generating circuit is further configured, responsive to a request from a cryptographic accelerator, to create a random mask on each clock cycle, and provide the random mask to a cryptographic accelerator on each clock cycle.
14. The random mask distribution system as claimed in claim 8 , wherein said first mask generating circuit is further configured to monitor the number of random masks created by said first mask generating circuit from a given random number, and when a pre-determined number of random masks have been created, request a new random number from said random number distribution circuit, receive a new random number from said random number distribution circuit, and use the new random number to generate random masks.
15. The random mask distribution system as claimed in claim 8 , wherein said random number source is a random number generator.
16. The random mask distribution system as claimed in claim 8 , wherein said first mask generating circuit further comprises a register electronically coupled to said first and second cryptographic accelerators, wherein said registers is configured to use a random number provided by said mask distribution system to generate random masks and distribute them to said first and second cryptographic accelerators.