JP4851077B2 - Data conversion apparatus and method - Google Patents

Description

  The present invention relates to a data conversion device and method for realizing a data conversion method used for an authentication method and the like, and more particularly to a data conversion device and method that can be realized with a small mounting scale and have high data disturbance performance.

  In a challenge-response authentication method that is one of means for confirming the authenticity of a communication partner, a secret conversion method is required on the authenticating side and the authenticated side. As a requirement desired for the secret conversion method, it is desired that not only high data disturbance performance (avalanche performance) but also that method can be implemented in equipment at low cost.

As a conventional example of the data conversion method, there is a method using a secret key encryption method. For example, when the challenge-response authentication method is realized by a data conversion method using a 56-bit key length DES (Data Encryption Standard) encryption method (refer to Non-Patent Document 1 for details of the DES encryption method), the DES encryption method is used. The 56-bit key is secretly held on both the authenticating side and the authenticated side as an authentication key. Also, the plaintext and ciphertext of the DES encryption method are used as the input and output of the data conversion method, respectively. As a result, the DES encryption method can be used as a secret data conversion method for authentication (see Non-Patent Document 1 for details of the authentication method).
Tatsuaki Okamoto, Hiroshi Yamamoto "Contemporary Cryptography" (Industry Books), 1997

  However, a secret key cryptosystem such as the DES cryptosystem is not a scheme that considers circuit sharing with other circuits mounted in the device together with the cryptographic circuit. Must be implemented as an independent circuit. Therefore, in the data conversion method using the secret key encryption method of the conventional example, the encryption circuit is mounted completely independent of other circuits mounted in the device, and the circuit scale of the entire device increases. . In other words, in general, in order to realize a device at low cost, the total scale of circuits mounted on the device is required to be as small as possible. Therefore, the encryption circuit mounted on the device can be shared with other circuits. Although it is more desirable, the conventional configuration has a problem that it is not realized.

  The present invention has been made to solve the above-described problems, and an object of the present invention is to provide a data conversion apparatus capable of reducing the total mounting scale in a device.

The data conversion apparatus according to the present invention includes a dividing unit that divides input data into a plurality of data, and a value on a finite field GF (2 ⁿ ) (n is a natural number) for each of the plurality of data Power means for performing conversion based on a power operation with a predetermined power on a polynomial remainder ring, and output data generation means for generating output data based on the plurality of data after being converted by the power means, The predetermined power number is 3 or more and a value other than 2 ^m (m is an integer of 1 or more).

According to this configuration, multiplication on the polynomial remainder ring is performed in the power step. When an operation is performed on the polynomial remainder ring, if any part of the input data is changed as will be described later, the influence is exerted on all bits of the output data. For this reason, data disturbance property can be improved. In addition, when multiplication of two or more variables is performed, if any one of the variables is 0, the multiplication result becomes 0 regardless of the value of the other variables, and good data disturbance Although the performance is not shown, such a problem does not occur when the input data is a power, and the disturbance of the data can be improved. Further, in the power step, an operation is performed on a polynomial remainder ring having a value on the finite field GF (2 ⁿ ) (n is a natural number) as a coefficient. Circuit sharing with an arithmetic circuit on a finite field GF (2 ⁿ ) used in an error correction encoding circuit such as a Reed-Solomon code or a BCH (Bose-Chaudhuri-Hocqenghem) code becomes possible. For this reason, the mounting scale as the whole equipment can be reduced, and equipment mounting with a compact circuit scale is realized.

Embodiments of the present invention will be described below with reference to the drawings.
(Configuration of authentication system using data converter)
FIG. 1 is a block diagram showing a configuration of an authentication system according to an embodiment of the present invention. In this authentication system, the authentication device 3 authenticates the device to be authenticated 4 by a challenge-response authentication method. In this authentication system, for example, the authentication device 3 is an in-vehicle device that controls unlocking and locking of a car door, and the authenticated device 4 is a portable terminal that is carried by the user for unlocking and locking the door of the car. A car keyless entry system can be specifically considered.

  The authentication device 3 generates 64-bit random number data in the random number generator 5 and sends this to the device to be authenticated 4 as challenge data. The device to be authenticated 4 performs data conversion processing in the data conversion device 2 on the received challenge data, and sends 64-bit conversion data as a conversion result to the authentication device 3 as response data. The authentication device 3 performs data conversion processing on the random number data in the data conversion device 1 while the device to be authenticated 4 performs the above-described processing, and creates 64-bit conversion data as a conversion result. Then, the authentication device 3 compares the response data received from the device to be authenticated 4 with the converted data in the data comparator 6, and assumes that the device to be authenticated 4 is valid only if they match. Certify. Here, the data conversion device 1 in the authentication device 3 and the data conversion device 2 in the device to be authenticated 4 perform the same conversion process, and the processing contents are secretly shared between the authentication device 3 and the device to be authenticated 4. Has been.

(Configuration of data converters 1 and 2)
Since the data converters 1 and 2 have the same configuration, only the internal configuration of the data converter 1 will be described below.

  FIG. 2 is a diagram showing an internal configuration of the data conversion apparatus 1. The data conversion device 1 is a processing device that performs a predetermined secret conversion process on 64-bit input data and generates 64-bit output data, and includes a finite field polynomial cube unit 10 and data fusion units 11a to 11d, 12 and 13, a first conversion unit 14, a second conversion unit 15, a data division unit 16, and a data combination unit 17. The internal operation when 64-bit input data is input will be described below.

  First, the data dividing unit 16 divides the input data into two pieces of data from the upper 32 bits. Here, the two data are data A and data B from the top. Data A is input to data fusion units 11a and 11c, and data B is input to data fusion units 11b and 11d, respectively. The data fusion units 11a and 11c perform bitwise exclusive OR (XOR) with the fixed 32-bit data K1 and K3 on the input 32-bit data A, respectively, and the 32-bit data A0 and A1. Are output respectively. Further, the data fusion units 11b and 11d perform an exclusive OR operation (XOR) for each bit with the fixed 32-bit data K2 and K4 on the input 32-bit data B, respectively, and the 32-bit data B0 And B1 are output respectively. Here, the 32-bit data K1 to K4 are fixed values set in advance to predetermined values.

Next, the finite field polynomial cube unit 10 applies a value on a polynomial remainder ring whose coefficient is a value on a finite field GF (2 ⁸ ) described later to each of the 32-bit data A0, B0, A1, and B1. Are multiplied by ³ to calculate 32-bit data (A0) ³ , (B0) ³ , (A1) ³ , and (B1) ³ , respectively. Details of the processing of the finite field polynomial cube section 10 will be described later.

Next, the 32-bit data (A0) ³ and (B0) ³ are input to the data fusion unit 12, and the 32-bit data (A1) ³ and (B1) ³ are input to the data fusion unit 13.

The data merging unit 12 and the data merging unit 13 perform an exclusive OR operation for each two bits of the input 32-bit data to obtain 32-bit data (A0) ³ (+) (B0) ³ and ( A1) ³ (+) (B1) ³ is output. Here, “X (+) Y” means a bitwise exclusive OR operation (XOR) of X and Y.

Next, the first conversion unit 14 performs a predetermined conversion on the 32-bit data (A0) ³ (+) (B0) ³ based on an operation on the finite field GF (2 ⁸ ) described later, and generates the 32-bit data Data G0 is output. Further, the second conversion unit 15 performs predetermined conversion on the (A1) ³ (+) (B1) ³ based on an operation on a finite field GF (2 ⁸ ) described later, and generates 32-bit data G1. Is output.

  After the above processing, the data combiner 17 concatenates the 32-bit data G0 as the upper 32 bits and the 32-bit data G1 as the lower 32 bits, and outputs the result as 64-bit data. This 64-bit data becomes the output data of the data converter 1. Next, the internal configuration and operation of the finite field polynomial cube unit 10 will be described.

(Internal configuration of the finite field polynomial cube 10)
FIG. 3 is a diagram showing an example of the internal configuration of the finite field polynomial cube section 10. The finite field polynomial cube unit 10 is a processing unit that performs three multiplications on a polynomial remainder ring having a value on the finite field GF (2 ⁸ ) as a coefficient. The input control unit 101, the finite field polynomial multiplication unit 100, And the output control unit 102.

The input control unit 101 performs control to output either one of the two input data. The finite field polynomial multiplication unit 100 performs multiplication on a polynomial remainder ring using the values on the finite field GF (2 ⁸ ) as coefficients for the two input data. The output control unit 102 performs control so that input data is output to one of two output destinations.

The internal operation when 32-bit input data X is input to the finite field polynomial cube section 10 will be described below. The input data X is input to the input control unit 101 and the finite field polynomial multiplication unit 100. The input control unit 101 inputs the input data X as it is to the finite field polynomial multiplication unit 100. The finite field polynomial multiplication unit 100 is on a polynomial remainder ring whose coefficient is a value on the finite field GF (2 ⁸ ) between the 32-bit data X input from the outside and the 32-bit data X input from the input control unit 101. And the multiplication result X ² is output and input to the output control unit 102. Details of the processing of the finite field polynomial multiplier 100 will be described later.

The output control unit 102 inputs the input data X ² to the input control unit 101 as it is. Then, the input control unit 101 inputs the input data X ² to the finite field polynomial multiplication unit 100.

The finite field polynomial multiplication unit 100 performs multiplication of the input data X ² and the input data X, and inputs the multiplication result X ³ to the output control unit 102. The multiplication at this time is multiplication on a polynomial remainder ring as already described.

The output control unit 102 outputs the input data X ³ as output data of the finite field polynomial cube unit 10. Next, the internal configuration and operation of the finite field polynomial multiplier 100 will be described.

(Internal configuration of finite field polynomial multiplier 100)
FIG. 4 is a diagram illustrating an example of an internal configuration of the finite field polynomial multiplication unit 100. The finite field polynomial multiplication unit 100 performs multiplication on a polynomial remainder ring using a value on a finite field GF (2 ⁸ ) of the 32-bit first input data X and the 32-bit second input data Y as a coefficient, 32-bit output data D is output. The remainder polynomial of the polynomial remainder ring at this time is L (X) = X ⁴ −1, and the primitive polynomial m (x) of the finite field GF (2 ⁸ ) is m (x) = x ⁸ + x ⁴ + x ³ + x + 1. . Before describing the operation of the finite field polynomial multiplication unit 100, operations on the finite field GF (2 ⁸ ) and operations on the polynomial remainder ring will be briefly described.

First, the calculation on the finite field GF (2 ⁸ ) will be described. In the calculation on the finite field GF (2 ⁸ ), when the value of each bit of the 8-bit data A is a7, a6,..., A0 from the top, the seventh-order polynomial a (x) = a7 × x ⁷ Consider + a6 × x ⁶ +... + A1 × x + a0. Similarly, each bit of the 8-bit data B is b7, b6,..., B0 from the top, and is associated with a seventh-order polynomial b (x) = b7 × x ⁷ + b6 + x ⁶ +... + B1 × x + b0. At this time, the addition result C of A and B on the finite field GF (2 ⁸ ) is c (x) as a result of calculating c (x) = a (x) + b (x) on the finite field GF (2). ) Is converted into 8-bit data by associating the 7th-order polynomial described above with 8-bit data. That is, when c (x) = c7 × x ⁷ + c6 + x ⁶ +... + C1 × x + c0,
c7 = a7 + b7
c6 = a6 + b6
... ... ...
c1 = a1 + b1
c0 = a0 + b0
As required. Here, all the additions “+” between the 1-bit data are performed on the finite field GF (2). That is, 0 + 0 = 1 + 1 = 0 and 0 + 1 = 1 + 0 = 1 are calculated.

From the above, the addition on the finite field GF (2 ⁸ ) is nothing but an exclusive OR operation for each bit. That is, the addition result C for A and B is C = A (+) B.

Next, multiplication on the finite field GF (2 ⁸ ) will be described. As described above, when the 8-bit data A, B, and C are set to the seventh order polynomials a (x), b (x), and c (x), the multiplication results C of the 8-bit data A and B correspond to the respective values. Is calculated by the following calculation using a 7th order polynomial a (x), b (x), c (x).

c (x) = a (x) × b (x) mod m (x)
Here, “f (x) mod g (x)” is a remainder calculation result of f (x) modulo g (x), and m (x) is a finite field GF as described above. The primitive polynomial m (x) on (2 ⁸ ) = x ⁸ + x ⁴ + x ³ + x + 1. Further, the polynomial multiplication and the addition and multiplication of the coefficients in the remainder are performed on the finite field GF (2). The addition over the finite field GF (2) is as described above, and the multiplication is calculated as 0 × 0 = 0 × 1 = 1 × 0 = 0, 1 × 1 = 1.

An example of the above multiplication is given. When A = 57 (hexadecimal number) and B = 83 (hexadecimal number), a (x) = x ⁶ + x ⁴ + x ² + x + 1, b (x) = x ⁷ + x + 1. From this, a (x) × b (x) = x ¹³ + x ¹¹ + x ⁹ + x ⁸ + x ⁶ + x ⁵ + x ⁴ + x ³ +1 and a (x) × b (x) mod m (x) = x ⁷ + x ^{Since 6} + 1, the multiplication result C of A and B is C1 in hexadecimal.

Next, an operation on a polynomial remainder ring using a value on the finite field GF (2 ⁸ ) as a coefficient will be described. In the operation on the polynomial remainder ring, when each byte of the 32-bit data A is A0, A1, A2, A3 from the upper byte, the 1-byte data A0 to A3 is converted to a third-order polynomial A (X) = A0 + A1 × X + A2 × Consider it in association with X ² + A3 × X ³ . Similarly, when each byte of 32-bit data B and C is changed to B0, B1, B2, B3 and C0, C1, C2, and C3 from the upper byte, 1-byte data B0 to B3 and C0 to C3 are converted to a third-order polynomial B. Consider (X) = B0 + B1 × X + B2 × X ² + B3 × X ³ and C (X) = C0 + C1 × X + C2 × X ² + C3 × X ³ respectively. At this time, the addition on the polynomial remainder ring is obtained as C (X) = A (X) + B (X). The addition of the polynomial coefficient at this time is the addition on the finite field GF (2 ⁸ ) described above. In other words, the addition of the 32-bit data A and B is performed simply by performing an exclusive OR operation for each bit.

  Next, multiplication on the polynomial remainder ring will be described. When the multiplication result of the 32-bit data A and B is 32-bit data C and each data is associated with the cubic polynomial A (X), B (X), and C (X) as described above, the polynomial remainder ring The above multiplication is represented by the following polynomial operation.

C (X) = A (X) × B (X) mod L (X)
Here, as already described, L (X) is the remainder polynomial L (X) = X ⁴ −1, and the addition and multiplication of the above polynomial coefficients are performed on the finite field GF (2 ⁸ ). For this reason, the above equation is calculated as follows.

C (X) = A0 × B0
+ (A0 × B1 + A1 × B0) × X
+ (A0 × B2 + A2 × B0 + A1 × B1) × X ²
+ (A0 × B3 + A1 × B2 + A2 × B1 + A3 × B0) × X ³
+ (A1 × B3 + A3 × B1 + A2 × B2) × X ⁴
+ (A2 × B3 + A3 × B2) × X ⁵
+ (A3 × B3) × X ⁶ (mod X ⁴ −1)
At this time, since X4 = 1 (mod X ⁴ −1), the above equation can be further modified as follows.

C (X) = (A0 × B0 + A3 × B1 + A2 × B2 + A1 × B3)
+ (A1 × B0 + A0 × B1 + A3 × B2 + A2 × B3) × X
+ (A2 × B0 + A1 × B1 + A0 × B2 + A3 × B3) × X ²
+ (A3 × B0 + A2 × B1 + A1 × B2 + A0 × B3) × X ³
From this,
C0 = A0 × B0 + A3 × B1 + A2 × B2 + A1 × B3
C1 = A1 × B0 + A0 × B1 + A3 × B2 + A2 × B3
C2 = A2 × B0 + A1 × B1 + A0 × B2 + A3 × B3
C3 = A3 × B0 + A2 × B1 + A1 × B2 + A0 × B3
As can be seen, C can be calculated. At this time, the above addition “+” and multiplication “×” are performed on the finite field GF (2 ⁸ ).

This completes the description of the operation on the finite field GF (2 ⁸ ) and the operation on the polynomial remainder ring, so the operation of the finite field polynomial multiplication unit 100 will be described.

The finite field polynomial multiplication unit 100 is a processing unit that performs multiplication on a polynomial remainder ring using the values on the finite field GF (2 ⁸ ) as coefficients for the two input data. The division unit 111 to 112, the data addition unit 113 to 115, the data combination unit 116, and the calculation control unit 117 are included.

The finite field multiplier 110 performs multiplication on the finite field GF (2 ⁸ ). Each of the data division units 111 to 112 divides 32-bit input data into four 8-bit data. Each of the data addition units 113 to 115 performs addition on the finite field GF (2 ⁸ ) for the two input data. The data combining unit 116 combines four 8-bit data and outputs it as 32-bit data. The arithmetic control unit 117 performs input control of multiplicands and multipliers input from the data dividing unit 111 and the data dividing unit 112 to the finite field multiplication unit 110 and output destination control of data output from the finite field multiplication unit 110. Hereinafter, the operation of the finite field polynomial multiplier 100 will be described.

  The data dividing unit 111 divides the 32-bit first input data into four pieces of data of 8 bits from the top. Here, the four data are designated as data X0, X1, X2, and X3 from the top. Similarly, the data dividing unit 112 divides the 32-bit second input data into four pieces of data of 8 bits from the top. Here, the four data are designated as data Y0, Y1, Y2, and Y3 from the top. Hereinafter, the input / output data of the finite field multiplication unit 110 and the data addition units 113 to 115 are appropriately controlled by the arithmetic control unit 117, and the 8-bit data D0, D1, and D2 according to the following equations (1) to (4). And calculate the value of D3.

D0 = X0 * Y0 + X3 * Y1 + X2 * Y2 + X1 * Y3 (1)
D1 = X1 * Y0 + X0 * Y1 + X3 * Y2 + X2 * Y3 (2)
D2 = X2 * Y0 + X1 * Y1 + X0 * Y2 + X3 * Y3 (3)
D3 = X3 * Y0 + X2 * Y1 + X1 * Y2 + X0 * Y3 (4)
However, the above multiplication “×” and addition “+” are all performed on the finite field GF (2 ⁸ ). The reason why the above formula indicates the product of data X and data Y is as described above.

  Of the above four equations, only the operation of the finite polynomial multiplier 100 when calculating the data D0 will be described. The data D1 to D3 are calculated by the same operation.

The arithmetic control unit 117 selects data X0 from the 8-bit data X0 to X3 and data Y0 from the 8-bit data Y0 to Y3 as inputs to the finite field multiplication unit 110, respectively. The finite field multiplication unit 110 performs multiplication on the data X0 and the data Y0 on the finite field GF (2 ⁸ ), and outputs the multiplication result as data Z0. That is,
Z0 = X0 × Y0
Calculate

Next, by a similar operation, the finite field multiplication unit 110 performs multiplication on the data X3 and Y1 on the finite field GF (2 ⁸ ) and outputs the result as data Z1. That is,
Z1 = X3 × Y1
Calculate Similarly, Z2 = X2 × Y2
Z3 = X1 × Y3
Calculate

After the output of Z0 to Z3 is completed, the data adders 113 to 115 perform addition on the finite field GF (2 ⁸ ) to the data Z0 to Z3. That is,
D0 = Z0 + Z1 + Z2 + Z3
Calculate However, addition on the finite field GF (2 ⁸ ) is nothing but an exclusive OR operation for each bit. For this reason, the above calculation performs a bitwise exclusive OR operation on the data Z0 to Z3. Similarly, the data adding units 113 to 115
D1 = X1 * Y0 + X0 * Y1 + X3 * Y2 + X2 * Y3
D2 = X2 * Y0 + X1 * Y1 + X0 * Y2 + X3 * Y3
D3 = X3 * Y0 + X2 * Y1 + X1 * Y2 + X0 * Y3
Calculate The data combining unit 116 concatenates the data D0, D1, D2, and D3 from the higher order and outputs 32-bit data D as output data of the finite field polynomial multiplication unit 100.

Next, the internal configuration and operation of the first conversion unit 14 will be described.
(Internal configuration of the first converter 14)
FIG. 5 is a diagram illustrating an example of the internal configuration of the first conversion unit 14.

The first conversion unit 14 is a processing unit that performs a predetermined conversion using an operation on a finite field GF (2 ⁸ ) on the 32-bit input data X and outputs 32-bit output data Y. The data division unit 20, the data combination unit 21, the constant storage unit 22, and the finite field multiplication unit 210 are included. The data dividing unit 20 divides 32-bit input data into four 8-bit data. The data combining unit 21 combines four 8-bit data and outputs it as 32-bit data. The constant storage unit 22 stores four 8-bit constants C1 to C4. The finite field multiplier 210 multiplies the two 8-bit input data on the finite field GF (2 ⁸ ) and outputs 8-bit output data. Hereinafter, the operation of the first conversion unit 14 will be described.

The data dividing unit 20 divides the 32-bit input data X by 8 bits from the top. Here, the divided 8-bit data is set as data X0, X1, X2, and X3 from the top. The finite field multiplication unit 210 performs multiplication on the finite field GF (2 ⁸ ) between the data X0 and the 8-bit constant C1 stored in the constant storage unit 22, and outputs the result as output data Y0. Similarly, the finite field multiplier 210 multiplies the data X1 and the constant C2 and outputs the result as data Y1, multiplies the data X2 and the constant C3 and outputs the data Y2, and multiplies the data X3 and the constant C4. And output as data Y3. Y0 = C1 × X0 by the above series of operations
Y1 = C2 × X1
Y2 = C3 × X2
Y3 = C4 × X3
Is calculated. However, all the multiplications “×” are performed on the finite field GF (2 ⁸ ).

  After the above processing, the data combination unit 21 combines the data Y0, Y1, Y2, and Y3 from the higher order and outputs 32-bit data Y as output data of the first conversion unit 14.

(Internal configuration of second converter 15)
As shown in FIG. 6, the internal configuration of the second conversion unit 15 is such that the constants stored in the constant storage unit 32 are changed from C1, C2, C3 and C4 to C5, C6, C7 and C8 in the configuration of the first conversion unit 14. The other internal configurations and operations are the same as those of the first converter 14. Therefore, detailed description thereof will not be repeated here.

  Next, the internal configuration and operation of the finite field multipliers 110, 210 and 310 will be described with reference to FIG.

(Internal configuration of finite field multipliers 110, 210 and 310)
The finite field multipliers 110, 210, and 310 all have the same internal configuration and perform the same operation. For this reason, only operation | movement of the finite field multiplication part 110 is demonstrated here. The multiplication method on the finite field GF (2 ⁸ ) has already been described, but here, the configuration when the calculation is realized by a compact circuit will be described.

The finite field multiplication unit 110 is a processing unit that multiplies the 8-bit first input data X and the second input data Y over the finite field GF (2 ⁸ ) and outputs 8-bit output data Z. A first input control unit 411, a second input control unit 414, an output control unit 412, a finite field doubling unit 410, a data fusion unit 413, and a data dividing unit 415.

Each of the first input control unit 411 and the second input control unit 414 performs control to select and output one of the two input data. The finite field doubling unit 410 performs doubling on the finite field GF (2 ⁸ ) for the input data. The data fusion unit 413 fuses two input data. The data dividing unit 415 divides input data into a plurality of data. Hereinafter, the operation of the finite field multiplier 110 will be described.

  First, the data dividing unit 415 divides the 8-bit second input data Y into one bit from the higher order to obtain values Y7, Y6,. Next, the following processes (1) to (5) are repeatedly executed in the order of i = 7, 6, 5, 4, 3, 2, 1, 0.

  (1) The first input control unit 411 sets the 8-bit initial value = 0 when i = 7, and the 8-bit data output from the output control unit 412 when i ≠ 7. Input to 410.

(2) The finite field doubling unit 410 performs doubling on the finite field GF (2 ⁸ ) with respect to the 8-bit data input from the first input control unit 411, and uses the resulting 8-bit data as data. Input to the fusion unit 413.

  (3) The second input control unit 414 is a data fusion unit that uses 8-bit constant 0 when Yi (i = 7, 6,..., 0) is 0, and first input data X otherwise. Input to 413.

  (4) The data fusion unit 413 performs an exclusive OR operation for each bit on the 8-bit data input from the finite field doubling unit 410 and the 8-bit data input from the second input control unit 414. The 8-bit data of the calculation result is input to the output control unit 412.

  (5) When i ≠ 0, the output control unit 412 inputs the 8-bit data input from the data fusion unit 413 to the first input control unit 411. Thereafter, the value of i is decreased by 1, and the processing is restarted from (1). When i = 0, the output control unit 412 outputs the 8-bit data input from the data fusion unit 413 as output data of the finite field multiplication unit 110. Thereafter, a series of processing ends.

  The reason why the multiplication result of the first input data X and the second input data Y can be calculated by the above processing will be briefly described.

The second input data is Y = Y7 × 2 ⁷ + Y6 × 2 ⁶ +... + Yi × 2 ⁱ +... + Y0 using the values Y7, Y6,.
It can be expressed as
X × Y = X × (Y7 × 2 ⁷ + Y6 × 2 ⁶ +... + Yi × 2 ⁱ +... + Y0)
= (... ((((((0 + X * Y7) * 2 + X * Y6) * 2 + X * Y5) * 2 + X * Y4) * 2 + X * Y3) ...) * 2 + X * Y0
It can be expressed as. The processing based on this calculation formula is performed as described above.

Next, the internal configuration and operation of the finite field doubling unit 410 will be described.
(Internal configuration of finite field doubling unit 410)
FIG. 8 is a diagram illustrating an internal configuration of the finite field doubling unit 410.

The finite field doubling unit 410 is a processing unit that performs doubling on the finite field GF (2 ⁸ ) for the input 8-bit data X and outputs the resulting 8-bit data Y. The dividing unit 511, the data combining unit 512, and the data fusion units 513 to 515 are included.

  The data dividing unit 511 divides input data into 1-bit data. The data combination unit 512 combines a plurality of input data and outputs the combined data. Each of the data fusion units 513 to 515 fuses two input data. Hereinafter, the operation of the finite field doubling unit 410 will be described.

  First, the data division unit 511 divides the 8-bit input data X bit by bit from the upper order and outputs the data as data X7, X6,. Next, the data fusion unit 513 performs an exclusive OR operation between the data X7 and the data X3 and outputs the result as data Y4. The data fusion unit 514 performs an exclusive OR operation between the data X7 and the data X2, and outputs the result as data Y3. The data fusion unit 515 performs an exclusive OR operation on the data X7 and the data X0 and outputs the result as data Y1. Data X6, X5, X4, X1 and X7 are data Y7, Y6, Y5, Y2 and Y0, respectively. The data combining unit 512 outputs, as output data of the finite field doubling unit 410, 8-bit data obtained by combining the data Y7, Y6, Y5,.

The finite field doubling unit 410 applies the respective bits X7, X6,..., X0 of the 8-bit input data X to
Y7 = X6
Y6 = X5
Y5 = X4
Y4 = X3 (+) X7
Y3 = X2 (+) X7
Y2 = X1
Y1 = X0 (+) X7
Y0 = X7
As a result, the value of each bit Y7, Y6,..., Y0 of the 8-bit output data Y is calculated. At this time, the output data Y is the result of doubling the input data X over the finite field GF (2 ⁸ ). This will be explained briefly.

  The input data X can be expressed by the following α polynomial whose coefficient is the value of the finite field GF (2).

X7 × α ⁷ + X6 × α ⁶ +... + X1 × α + X0
At this time, doubling over the finite field GF (2 ⁸ ) means multiplying the above polynomial by α.
X7 × α ⁸ + X6 × α ⁷ +... + X1 × α ² + X0 × α
It becomes. Here, since the primitive polynomial is x ⁸ + x ⁴ + x ³ + x + 1, α ⁸ = α ⁴ + α ³ + α + 1 holds. For this reason, the above polynomial is
X6 × α ⁷ + X5 × α ⁶ + X4 × α ⁵ + (X3 + X7) × α ⁴ + (X2 + X7) × α ³ + X1 × α + (X0 + X7)
Rewritten. This is Y7 × α ⁷ + Y5 × α ⁶ +... + Y1 × α + Y0
The reason why the process like the finite field doubling unit 410 is performed can be explained.

  The data conversion apparatuses 1 and 2 perform the following processing on the 64-bit input data X.

  (1) The input data X is divided into upper 32 bits and lower 32 bits to obtain data X0 and X1.

(2) Calculate T0 = (X0 + K1) ³ + (X1 + K2) ³ and T1 = (X0 + K3) ³ + (X1 + K4) ³ . However, all the additions and multiplications here are performed on a polynomial remainder ring having values on the finite field GF (2 ⁸ ) as coefficients.

  (3) The 32-bit data T0 is divided into 8 bits from the upper part to obtain data a0, a1, a2, and a3, and the 32-bit data T1 is divided into 8 bits from the upper part to obtain data b0, b1, Let b2 and b3.

(4) Calculate G0 = C1 × a0‖C2 × a1‖C3 × a2‖C4 × a3 and G1 = C5 × b0‖C6 × b1‖C7 × b2‖C8 × b3, and output G0‖G1 as output data To do. However, “‖” represents data connection, and all the above multiplications are performed on the finite field GF (2 ⁸ ).

As can be seen from the equations (1) to (4), the multiplication on the polynomial remainder ring using the value on the finite field GF (2 ⁸ ) as a coefficient changes the influence of the change when a part of the input data is changed. Will cover all of the output data. For example, it is assumed that the value of the data X0 is changed in the equations (1) to (4). Data X0 is used for all calculations of Equations (1) to (4). For this reason, all of the output data D0 to D3 are affected. The same can be said for other values (X1 to X3, Y0 to Y3). Thus, in the present embodiment, high data disturbance performance can be realized by using the above multiplication for the conversion process. Next, in this embodiment, power multiplication is used instead of multiplication of two or more variables (for example, X × Y, X × Y × Z), but this is the multiplication of two or more variables. If any one of these variables is 0, the multiplication result is always 0 regardless of the values of the other variables, and there are combinations of input variable values for which the operation result value is 0. This is because many exist and do not show good data disturbance performance. On the other hand, when exponentiation is used, the calculation result becomes 0 only when the input variable value is 0. Therefore, there is no problem of reducing the data disturbance performance as described above, and high data disturbance performance is guaranteed.

In the present embodiment, the power of the third power is used. This is for the following reason. First, when a conversion such as Y = X ² is considered using the multiplication by ^two , the output value for the input value α is α ² . Next, the output value when the difference Δ is added to the input value α is (α + Δ) ² = α ² + α × Δ + Δ × α + Δ ² , where α × Δ = Δ × α and α × Δ + α × Δ = 0 ( Since both are apparent from the calculation method on the finite field GF (2 ⁸ ), (α + Δ) ² = α ² + Δ ² . Therefore, the change in the output value by adding the difference Δ to the input value is Δ ² . That is, the change in the output value becomes a constant output difference Δ ² regardless of the input value α, which is not a desirable property from the viewpoint of data disturbance. As a result, it is necessary to use a power multiplication of at least the third power. However, as the power number is larger, the power processing increases and the conversion processing load increases. Therefore, in this embodiment, the power multiplication of the third power is used. At this time,
(Α + Δ) ³ = (α + Δ) × (α + Δ) × (α + Δ)
= (Α ² + α × Δ + Δ × α + Δ ² ) × (α + Δ)
= (Α ² + Δ ² ) × (α + Δ)
= Α ³ + Δ × α ² + Δ ² × α + Δ ³
Therefore, in the case of the power multiplication of the third power, the output difference does not become constant regardless of the input value α unlike the power multiplication of the second power. When the power multiplication number N is N = 2 ^k (k is an integer equal to or greater than 1), the output value obtained when the power multiplication X ^N is used as a data conversion process and an input difference Δ is given to the input value α. (Α + Δ) ^ (2 ^k ) = α ^ (2 ^k ) + Δ ^ (2 ^k ), and it is understood as follows regardless of the input value. Here, “X ^ α” means X to the power of α.

When k = 1, since the power number = 2, the output value is (α + Δ) ² = α ² + Δ ² from the above description. Next, when k = m, that is, when power number = 2 ^m , (α + Δ) ^ (2 ^m ) = α ^ (2 ^m ) + Δ ^ (2 ^m ) holds, (α + Δ) ^ (2 ^{m + 1} ) = {(α + Δ) ^ (2 ^m )} ² = {α ^ (2 ^m ) + Δ ^ (2 ^m )} ² = α ^ (2 ^{m + 1} ) + Δ ^ (2 ^{m + 1} ) The above holds even when k = m + 1. Therefore, the mathematical induction shows that (α + Δ) ^ (2 ^k ) = α ^ (2 ^k ) + Δ ^ (2 ^k ) for any integer k greater than or equal to 1. Therefore, it is understood that the power number may be a value other than 2 ^k (k is an integer of 1 or more). That is, although 3 is used as the power in this embodiment, this is 2 ^k (k is an integer of 1 or more) if the processing time in the data converter may take some time. Any value is acceptable as long as the value is 3 or more.

In this embodiment, addition (exclusive OR operation) using a constant K is performed before power multiplication such as (X + K) ^3. By changing this constant K, the data conversion device Many variations can be given to the conversion process. For example, by using this constant K for each authentication partner, the conversion process used for authentication can be used for each authentication partner.

At this time, since the value of (X + K) ³ becomes 0 only when X = K, the advantage that high data disturbance performance can be ensured by using the power calculation as described above is lost. I can't.

  In the present embodiment, power multiplication by the same power number 3 is performed on the four pieces of data A0 to A3. However, this need not be the same power number, and should be different from each other. Also good.

Further, in the data conversion apparatus of the present embodiment, arithmetic processing on the finite field GF (2 ⁸ ) is used for processing that becomes the core of data disturbance. For this reason, circuit sharing with an arithmetic circuit on a finite field GF (2 ⁸ ) used in an error correction encoding circuit such as a Reed-Solomon code or a BCH (Bose-Chaudhuri-Hocqenghem) code becomes possible. For this reason, the mounting scale as the whole equipment can be reduced, and equipment mounting with a compact circuit scale is realized.

  Note that the data sizes in the present embodiment are merely examples, and may be other than the data sizes described here. Further, the primitive polynomial and the remainder polynomial according to the present embodiment are merely examples, and are not limited thereto.

  In this embodiment, the case where the data conversion apparatus is used in the authentication system is described. However, any data conversion apparatus according to this embodiment can be used as long as it uses secret data conversion. As another application example of the data conversion apparatus, for example, application to a content distribution system as shown in FIG. 9 can be considered. The content distribution system includes a content distribution device 7 that distributes content in an encrypted state via broadcast or a network, and a playback device 8 that receives the decrypted encrypted content, decrypts it, and reproduces it. The content distribution device 7 performs data conversion processing on key seed data (data serving as a seed for generating a content key) in the data conversion device 70 to generate a content key. Then, the content encryption device 71 encrypts plaintext content data to generate encrypted content data. After the above processing, the content distribution device 7 sends the key seed data and the encrypted content data to the playback device 8. The playback device 8 that has received the data first converts the key seed data in the data converter 80 to generate a content key. Then, the content decrypting device 81 decrypts the encrypted content data to obtain plain text content. By mounting the same data conversion device as that of the content distribution device only on the reproduction device that is permitted to reproduce the content, it is possible to prevent the reproduction of the distribution content by the unauthorized reproduction device.

  In the present embodiment, the fixed values K1 to K4 for performing data fusion in the data fusion units 11a to 11d are set as predetermined fixed values. However, these fixed values are input from the outside of the data converter. The user may be able to set freely. Further, the constants C1 to C4 stored in the constant storage unit 22 are also fixed values set in advance, but these are also input from the outside of the data converter so that the user can freely set them. Good.

In the present embodiment, the finite field GF (2 ⁸ ) is used as the finite field, but other finite fields may be used. For example, the finite field GF (2 ⁿ ) (n is a natural number). May be.

  Each functional block in the block diagram (such as FIG. 2) is typically realized as an LSI which is an integrated circuit. These may be individually made into one chip, or may be made into one chip so as to include a part or all of them.

  FIG. 10 shows an external view of an LSI of an error correction / data conversion apparatus including a data conversion apparatus having the same function as the data conversion apparatus shown in FIG. FIG. 11 is a functional block diagram showing the configuration of the LSI of the error correction / data conversion apparatus.

  As shown in FIG. 11, error correction / data conversion apparatus 600 is an apparatus for performing data conversion after performing error correction coding on data. Reed-Solomon error correction coding section 601 and data conversion apparatus 604.

The Reed-Solomon error correction encoding unit 601 is a processing unit that performs Reed-Solomon error correction encoding on input data and outputs the encoded data. The data receiving unit 602 and the encoding unit 603 And. The data receiving unit 602 is a processing unit that receives data input from the outside. The encoding unit 603 is a processing unit that performs Reed-Solomon error correction encoding by multiplying the data received by the data receiving unit 602 on a finite field GF (2 ⁿ ). The encoding unit 603 includes a finite field multiplication unit 110 that performs multiplication on a finite field GF (2 ⁿ ). The configuration of the finite field multiplier 110 is as described above.

The data converter 604 has the same configuration as that of the data converter 1 (2) described above, but uses a finite field polynomial multiplier 605 instead of the finite field polynomial multiplier 100, and uses the first converter 14 instead of the first converter 14. One conversion unit 606 is used, and a second conversion unit 607 is used instead of the second conversion unit 15. The finite field polynomial multiplication unit 605 is different from the finite field polynomial multiplication unit 100 in that the finite field multiplication unit 110 provided in the encoding unit 603 is used to perform multiplication on the finite field GF (2 ⁿ ). Is the same as that of the finite field polynomial multiplier 100. The first conversion unit 606 is different from the first conversion unit 14 in that the first conversion unit 606 performs multiplication on the finite field GF (2 ⁿ ) using the finite field multiplication unit 110 provided in the encoding unit 603. This is the same as the one converting unit 14. The second conversion unit 607 is different from the second conversion unit 15 in that the finite field multiplication unit 110 provided in the encoding unit 603 is used to perform multiplication on the finite field GF (2 ⁿ ). This is the same as the 2 conversion unit 15.

  As described above, the Reed-Solomon error correction encoding unit 601 and the data conversion device 604 can share the finite field multiplication unit 110. For this reason, the circuit scale of LSI can be reduced.

  Here, the error correction / data conversion apparatus 600 is realized by an LSI, but may be called an IC, a system LSI, a super LSI, or an ultra LSI depending on the degree of integration.

  Further, the method of circuit integration is not limited to LSI, and implementation with a dedicated circuit or a general-purpose processor is also possible. An FPGA (Field Programmable Gate Array) that can be programmed after manufacturing the LSI or a reconfigurable processor that can reconfigure the connection and setting of circuit cells inside the LSI may be used.

  Further, if integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology. Biotechnology etc. are possible as another technology.

  The data conversion apparatus according to the present invention has an effect that the scale of the entire circuit including the data conversion apparatus can be reduced by sharing the error correction coding circuit and the data conversion circuit. This is useful for a device having a function of authenticating the other party. In addition, the present invention is not limited to this example, and any device can be applied as long as it is a device that needs to implement some data conversion circuit.

It is a block diagram which shows the structure of the authentication system which concerns on embodiment of this invention. It is a block diagram which shows an example of a structure of the data converter which concerns on embodiment of this invention. It is a block diagram which shows an example of a structure of the finite field polynomial cube part which concerns on embodiment of this invention. It is a block diagram which shows an example of a structure of the finite field polynomial multiplication part which concerns on embodiment of this invention. It is a block diagram which shows an example of a structure of the 1st conversion part which concerns on embodiment of this invention. It is a block diagram which shows an example of a structure of the 2nd conversion part which concerns on embodiment of this invention. It is a block diagram which shows an example of a structure of the finite field multiplication part which concerns on embodiment of this invention. It is a block diagram which shows an example of a structure of the finite field doubling part which concerns on embodiment of this invention. It is a block diagram which shows an example of a system structure at the time of applying the converter of this invention to a content delivery system. It is an external view of LSI of an error correction / data conversion apparatus. It is a block diagram which shows an example of a structure of an error correction and data converter.

Explanation of symbols

1, 2, 70, 80 Data conversion device 3 Authentication device 4 Device to be authenticated 5 Random number generator 6 Data comparator 7 Content distribution device 8 Playback device 10 Finite field polynomial cube 11a, 11b, 11c, 11d, 12, 13 , 413, 513, 514, 515 Data fusion unit 14 First conversion unit 15 Second conversion unit 16, 20, 30, 111, 112, 415, 511 Data division unit 17, 21, 31, 116, 512 Data combination unit 22 , 32 Constant storage unit 71 Content encryption device 81 Content decryption device 100 Finite field polynomial multiplication unit 101 Input control unit 102, 412 Output control unit 110, 210, 310 Finite field multiplication unit 113, 114, 115 Data addition unit 410 Finite Field doubling unit 411 first input control unit 414 second input control unit

Claims (6)

A finite field multiplication means for performing multiplication on a finite field GF (2 ⁿ );
An acquisition means for acquiring a plurality of data;
Using each of the plurality of data using the finite field multiplication means, a power of a predetermined power on a polynomial remainder ring whose coefficient is a value on a finite field GF (2 ⁿ ) (n is a natural number) A power means to perform a conversion based on an operation;
Output data generating means for generating output data based on the plurality of data after being converted by the power means;
The predetermined power is 3 or more and a value other than 2 ^m (m is an integer of 1 or more);
The power means includes a finite field polynomial multiplication unit that performs multiplication on a polynomial remainder ring using a value on a finite field GF (2 ⁿ ) of the first input data and the second input data as a coefficient. For each piece of data, the data is the first input data, the first multiplication on the polynomial remainder ring is the second input data, and the second and subsequent multiplications on the polynomial remainder ring are the nearest polynomial remainder rings. Using the above multiplication result as the second input data, the finite field polynomial multiplication unit uses a polynomial remainder ring having a value on the finite field GF (2 ⁿ ) of the first input data and the second input data as a coefficient. The multiplication result obtained by repeating the multiplication of (predetermined power-1) times is used as the converted value, so that for each of the plurality of data, a finite field GF (2 ⁿ ) (n is a natural number) Polynomial remainder with above value as coefficient Perform a transformation based on a power operation with a predetermined power on the ring,
The finite field polynomial multiplying unit includes: a plurality of first divided data obtained by dividing the first input data by n bits; and a plurality of second divided data obtained by dividing the second input data by n bits. The multiplication results on the finite field GF (2 ⁿ ) obtained by using the input of the finite field multiplication means are added using an adder, and the addition results are combined, whereby the first input data and the second input data are combined. A data conversion device characterized by obtaining a result on a polynomial remainder ring having a coefficient on a value on a finite field GF (2 ⁿ ) with input data. The output data generation means includes
An adder for performing addition on the polynomial remainder ring between the plurality of data after being converted by the power means;
The data conversion apparatus according to claim 1, further comprising: a multiplication unit that performs multiplication on the addition result of the addition unit on the finite field GF (2 ⁿ ) with a predetermined constant. A data conversion method executed by a data conversion apparatus including a finite field multiplication unit, an acquisition unit, a power unit, and an output data generation unit,
The power means includes a finite field polynomial multiplier,
The data conversion method includes:
The obtaining means for obtaining a plurality of data;
The power means transforms each of the plurality of data based on a power operation by a predetermined power on a polynomial remainder ring having a value on a finite field GF (2 ⁿ ) (n is a natural number) as a coefficient. A power step to perform,
The output data generation means includes an output data generation step of generating output data based on the plurality of data after being converted in the power step;
The predetermined power is 3 or more and a value other than 2 ^m (m is an integer of 1 or more);
In the power step, the power means, said finite field polynomial multiplying unit for multiplying the polynomial residue ring to finite field GF (2 ⁿ⁾ values on the coefficient of the first input data and second input data For each of the plurality of data, the data is used as the first input data, and in the first multiplication on the polynomial remainder ring, the data is used as the second input data. Then, the multiplication result on the nearest polynomial remainder ring is used as the second input data, and the value on the finite field GF (2 ⁿ ) of the first input data and the second input data is set as a coefficient by the finite field polynomial multiplication unit. The multiplication result obtained by repeating the multiplication on the polynomial remainder ring (the predetermined power-1) times is used as the converted value, so that for each of the plurality of data, a finite field GF (2 ⁿ ) (N is a natural number ) Perform a transformation based on a power operation with a predetermined power on the polynomial remainder ring with the above values as coefficients,
The finite field polynomial multiplying unit includes: a plurality of first divided data obtained by dividing the first input data by n bits; and a plurality of second divided data obtained by dividing the second input data by n bits. the multiplication result of the finite field GF (2 ⁿ⁾ finite obtained by the input of the finite field multiplying unit for performing multiplication on GF (2 ⁿ⁾ is added with an adder, coupled to the addition result By doing so, a result on a polynomial remainder ring having a value on a finite field GF (2 ⁿ ) of the first input data and the second input data as a coefficient is obtained. The output data generation means includes an adder and a multiplier.
The output data generation step includes
An addition sub-step for performing addition on the polynomial remainder ring between the plurality of data after the addition unit is converted in the power step;
The multiplication unit, according to claim 3, characterized in that it comprises a multiplication substep on the addition result of the adding sub-step performing the finite field GF (2 ⁿ⁾ on the multiplication of the predetermined constant Data conversion method. Finite field multiplication means for performing multiplication on a finite field GF (2 ⁿ ) (n is a natural number);
An acquisition means for acquiring a plurality of data;
Using each of the plurality of data using the finite field multiplication means, a power of a predetermined power on a polynomial remainder ring whose coefficient is a value on a finite field GF (2 ⁿ ) (n is a natural number) A power means to perform a conversion based on an operation;
Output data generating means for generating output data based on the plurality of data after being converted by the power means;
The predetermined power is 3 or more and a value other than 2 ^m (m is an integer of 1 or more);
The power means includes a finite field polynomial multiplication unit that performs multiplication on a polynomial remainder ring using a value on a finite field GF (2 ⁿ ) of the first input data and the second input data as a coefficient. For each piece of data, the data is the first input data, the first multiplication on the polynomial remainder ring is the second input data, and the second and subsequent multiplications on the polynomial remainder ring are the nearest polynomial remainder rings. Using the above multiplication result as the second input data, the finite field polynomial multiplication unit uses a polynomial remainder ring having a value on the finite field GF (2 ⁿ ) of the first input data and the second input data as a coefficient. The multiplication result obtained by repeating the multiplication of (predetermined power-1) times is used as the converted value, so that for each of the plurality of data, a finite field GF (2 ⁿ ) (n is a natural number) Polynomial remainder with above value as coefficient Perform a transformation based on a power operation with a predetermined power on the ring,
The finite field polynomial multiplying unit includes: a plurality of first divided data obtained by dividing the first input data by n bits; and a plurality of second divided data obtained by dividing the second input data by n bits. The multiplication results on the finite field GF (2 ⁿ ) obtained by using the input of the finite field multiplication means are added using an adder, and the addition results are combined, whereby the first input data and the second input data are combined. An integrated circuit characterized by obtaining a result on a polynomial remainder ring whose coefficient is a value on a finite field GF (2 ⁿ ) with input data. The program for functioning a computer as a data converter of Claim 1 or Claim 2 .

Images