Swapping of encryption and decryption operations for side channel attack protection

1. A system on a chip (SoC) comprising:

an encryption/decryption engine configured to:

encrypt transmission (Tx) channel data using a multi-round encryption datapath; and

decrypt encrypted received (Rx) channel data using a multi-round decryption datapath; and

a security processor configured to:

multiplex the multi-round encryption datapath against the multi-round decryption datapath on a round-by-round basis to generate a mixed sequence of encryption rounds and decryption rounds; and

control the encryption/decryption engine to encrypt the Tx channel data and decrypt the encrypted Rx channel data according to the mixed sequence of encryption rounds and decryption rounds;

apply side-channel attack (SCA) protection while executing a subset of the rounds of the mixed sequence; and

not applying the SCA protection while executing all remaining rounds of the mixed sequence not included in the subset;

wherein the remaining rounds of the mixed sequence not included in the subset and executed while the SCA protection is not applied comprise all remaining encryption rounds of the mixed sequence not included in the subset of encryption rounds of the mixed sequence to which the SCA protection is applied and all remaining decryption rounds of the mixed sequence not included in the subset of decryption rounds of the mixed sequence and executed while the SCA protection is applied.

2. The SoC of claim 1 ,

wherein the subset of rounds of the mixed sequence executed while the SCA protection is applied comprises each encryption round of the mixed sequence, and

wherein the remaining rounds of the mixed sequence not included in the subset and executed while the SCA protection is not applied comprise each decryption round of the mixed sequence.

3. The SoC of claim 1 ,

wherein the subset of rounds of the mixed sequence executed while the SCA protection is applied comprises each decryption round of the mixed sequence, and

wherein the remaining rounds of the mixed sequence not included in the subset and executed without applying the SCA protection comprise each encryption round of the mixed sequence.

4. The SoC of claim 1 ,

wherein the subset of rounds of the mixed sequence executed while the SCA protection is applied comprises a combination of a subset of the encryption rounds of the mixed sequence with a subset of the decryption rounds of the mixed sequence.

5. The SoC of claim 1 , wherein the SCA protection comprises masking using a random number.

6. The SoC of claim 1 , wherein the SoC is integrated into one of a head-mounted device (HMD) of an artificial reality system or a peripheral device of the artificial reality system.

7. The system on a chip (SoC) of claim 1 , wherein the security processor is further configured to control the encryption/decryption engine to encrypt the Tx channel data and decrypt the encrypted Rx channel data according to the mixed sequence of encryption rounds and decryption rounds such that the subset of rounds of the multi-round encryption datapath are interleaved with a subset of rounds of the multi-round decryption datapath.

8. The system on a chip (SoC) of claim 7 , wherein the subset of rounds of the multi-round encryption datapath are interleaved with a subset of rounds of the multi-round decryption datapath on one of a random basis, a pseudo-random basis, or a deterministic basis.

9. A head-mounted device (HMD) comprising:

a system on a chip (SoC) comprising:

an encryption/decryption engine configured to:

encrypt transmission (Tx) channel data using a multi-round encryption datapath; and

decrypt encrypted received (Rx) channel data using a multi-round decryption datapath; and

a security processor configured to:

multiplex the multi-round encryption datapath against the multi-round decryption datapath on a round-by-round basis to generate a mixed sequence of encryption rounds and decryption rounds; and

control the encryption/decryption engine to encrypt the Tx channel data and decrypt the encrypted Rx channel data according to the mixed sequence of encryption rounds and decryption rounds;

apply side-channel attack (SCA) protection while executing a subset of the rounds of the mixed sequence; and

not applying the SCA protection while executing all remaining rounds of the mixed sequence not included in the subset;

wherein the remaining rounds of the mixed sequence not included in the subset and executed while the SCA protection is not applied comprise all remaining encryption rounds of the mixed sequence not included in the subset of encryption rounds of the mixed sequence to which the SCA protection is applied and all remaining decryption rounds of the mixed sequence not included in the subset of decryption rounds of the mixed sequence and executed while the SCA protection is applied; and

an interface coupled to the SoC, the interface being configured to:

transmit the Tx traffic; and

receive the encrypted Rx traffic.

10. The HMD of claim 9 ,

wherein the subset of rounds of the mixed sequence executed while the SCA protection is applied comprises each encryption round of the mixed sequence, and

wherein the remaining rounds of the mixed sequence not included in the subset and executed while the SCA protection is not applied comprise each decryption round of the mixed sequence.

11. The HMD of claim 9 ,

wherein the subset of rounds of the mixed sequence executed while the SCA protection is applied comprises each decryption round of the mixed sequence, and

wherein the remaining rounds of the mixed sequence not included in the subset and executed without applying the SCA protection comprise each encryption round of the mixed sequence.

12. The HMD of claim 9 ,

wherein the subset of rounds of the mixed sequence executed while the SCA protection is applied comprises a combination of a subset of the encryption rounds of the mixed sequence with a subset of the decryption rounds of the mixed sequence.

13. The HMD of claim 9 , wherein the SCA protection comprises masking using a random number.

14. The HMD of claim 9 ,

wherein the encryption rounds form a multi-round encryption datapath,

wherein a respective result of each encryption round is used by a subsequently executed encryption round of the multi-round encryption datapath,

wherein the decryption rounds form a multi-round decryption datapath, and

wherein a respective result of each decryption round is used by a subsequently executed decryption round of the multi-round decryption datapath.

15. A peripheral device comprising:

a system on a chip (SoC) comprising: a system on a chip (SoC) comprising:

an encryption/decryption engine configured to:

encrypt transmission (Tx) channel data using a multi-round encryption datapath; and

decrypt encrypted received (Rx) channel data using a multi-round decryption datapath; and

a security processor configured to:

multiplex the multi-round encryption datapath against the multi-round decryption datapath on a round-by-round basis to generate a mixed sequence of encryption rounds and decryption rounds; and

control the encryption/decryption engine to encrypt the Tx channel data and decrypt the encrypted Rx channel data according to the mixed sequence of encryption rounds and decryption rounds;

apply side-channel attack (SCA) protection while executing a subset of the rounds of the mixed sequence; and

not applying the SCA protection while executing all remaining rounds of the mixed sequence not included in the subset;

wherein the remaining rounds of the mixed sequence not included in the subset and executed while the SCA protection is not applied comprise all remaining encryption rounds of the mixed sequence not included in the subset of encryption rounds of the mixed sequence to which the SCA protection is applied and all remaining decryption rounds of the mixed sequence not included in the subset of decryption rounds of the mixed sequence and executed while the SCA protection is applied; and

an interface coupled to the SoC, the interface being configured to:

transmit the Tx traffic; and

receive the encrypted Rx traffic.

16. The peripheral device of claim 15 ,

wherein the subset of rounds of the mixed sequence executed while the SCA protection is applied comprises each encryption round of the mixed sequence, and

wherein the remaining rounds of the mixed sequence not included in the subset and executed while the SCA protection is not applied comprise each decryption round of the mixed sequence.

17. The peripheral device of claim 15 ,

wherein the subset of rounds of the mixed sequence executed while the SCA protection is applied comprises each decryption round of the mixed sequence, and

wherein the remaining rounds of the mixed sequence not included in the subset and executed without applying the SCA protection comprise each encryption round of the mixed sequence.

18. The peripheral device of claim 15 ,

wherein the subset of rounds of the mixed sequence executed while the SCA protection is applied comprises a combination of a subset of the encryption rounds of the mixed sequence with a subset of the decryption rounds of the mixed sequence.

19. The peripheral device of claim 15 , wherein the SCA protection comprises masking using a random number.

20. The peripheral device of claim 15 ,

wherein the encryption rounds form a multi-round encryption datapath,

wherein a respective result of each encryption round is used by a subsequently executed encryption round of the multi-round encryption datapath,

wherein the decryption rounds form a multi-round decryption datapath, and wherein a respective result of each decryption round is used by a subsequently executed decryption round of the multi-round decryption datapath.