JPH0719124B2 - Cryptographic device - Google Patents

Description

The present invention relates to a cryptographic device, and more particularly to a cryptographic device suitable for high-speed transfer of encrypted data and decrypted data with a host device.

[Conventional technology]

In the conventional encryption device, a DES CBC mode is known as a block data encryption method in which an input data block is combined with a previous encrypted output data block to sequentially encrypt the data blocks. Such a cryptosystem is described in JP-A-52-130505.
Further, Japanese Patent Application Laid-Open No. 55-31377 describes an encryption device which improves the processing speed by performing encryption processing in parallel in time by a plurality of encryption units.

[Problems to be solved by the invention]

However, the former publication does not consider the transfer capability when receiving a data block from a higher-level device and transmitting an encrypted data block to the higher-level device. Further, since the method of the latter publication is a method of dividing one data block stream into a plurality of data block streams for encryption or decryption, one data block stream is directly decrypted or encrypted. There is a problem that it cannot be used in combination with the encryption device.

An object of the present invention is to transmit / receive a data block stream with a host device and to encrypt / decrypt a data block stream transmitted from a host device and transfer the data block stream to the host device. It is to provide a cryptographic device with improved processing speed by executing the above in parallel in time.

[Means for solving problems]

In order to achieve the above object, a function of encrypting data given from a host device according to an encryption key and an encryption algorithm and transferring the encrypted data to the host device, and a function of decrypting the encrypted data given from the host device with a decryption key and In an encryption device having a function of decrypting according to a decryption algorithm and transferring decrypted data to a host device, an input buffer for storing input data transmitted from the host device and reading the input data supplied to an encryption or decryption circuit ( 3), an output buffer (4) for storing the output data encrypted or decrypted by the encryption or decryption circuit and reading the output data to be transferred to the host device, and the input data transmitted from the host device. Periodically "1" until the encrypted or decrypted output data is transferred to the host device
The switching signal (13) that repeats the level and the "0" level, and the output buffer (13) when the number of times of reading from the input buffer (3) for supplying data to the encryption or decryption circuit exceeds the preset number. 4) is provided with a permission signal generation circuit (24) for permitting the data to be read out and transferred to the host device, and when the switching signal (13) is "1", the input data transmitted from the host device is input buffer. The data read from the input buffer (3) stored in (3) and supplied to the encryption or decryption circuit when the switching signal is "0" is output by the encryption or decryption circuit. When the signal is "0", it is stored in the output buffer (4), and when the switching signal is "1" and the permission signal is output, the transfer from the output buffer (4) to the upper device is started. Feature It The present invention particularly relates to a switching signal (“1” level and “0” level) which is periodically repeated until the output data obtained by encrypting or decrypting the input data transmitted from the higher-level device is transferred to the higher-level device ( 13) and
Allow data to be read from the output buffer (4) and transferred to a higher-level device when the number of times of reading from the input buffer (3) for supplying data to the encryption or decryption circuit exceeds a preset number. A permission signal generation circuit (24) for outputting a permission signal is provided, and when the switching signal (13) is "1", the input data transmitted from the host device is stored in the input buffer (3). Is "0", the data read from the input buffer (3) is supplied to the encryption or decryption circuit, and the output data encrypted or decrypted by the encryption or decryption circuit is output when the switching signal is "0". 4), and when the switching signal is “1” and the permission signal is output, the transfer from the output buffer to the higher-level device is started. Chromatography can be performed temporally in parallel the encryption or decryption of data, it is possible to achieve a significant improvement in processing speed.

[Action]

In this way, the data transmission / reception with the host device and the data encryption / decryption are executed in parallel in time, and the processing speed is improved.

The present invention is effective when the processing speed of the encryption circuit is slower than the data transfer speed with the host device.

〔Example〕

An embodiment of the present invention will be described below with reference to the drawings. FIG. 1 shows a block diagram of an embodiment of the present invention. The encryption device 1 is connected to a host device via the input / output control circuit 2. The input buffer 3 receives the data of the write input address register 7 and the read input address register 8 as the address signal 16 via the address switching circuit 5, and stores the data received from the host device via the input / output control circuit 2. Or supplies the read data to the encryption circuit 11. The output buffer 4 receives the data of the read output address register 9 and the write output register 10 as the address signal 17 via the address switching circuit 6, stores the data output from the encryption circuit 11, or inputs the read data. It is transmitted to the host device via the output control circuit 2. The encryption circuit 11 is a read input address
Address update signals 18 and 19 are supplied to the register 8 and the write output address register 10, respectively. The input / output control circuit 2 supplies address update signals 14 and 15 to the write input address register 7 and the read output address register 9, respectively, and also supplies the switching signal 13 to the address switching circuits 5 and 6. The channel input bus 20 is a data line for storing data from the host device in the input buffer 3 via the input / output control circuit 2, and the cipher input bus 21 is a data line for supplying data from the input buffer 3 to the cipher circuit 11. The cipher output bus 22 is a data line for supplying the data encrypted by the cipher circuit 11 to the output buffer 4, and the channel output bus 23 is for transmitting the data of the output buffer 4 to the host device via the input / output control circuit 2. It is a data line.

The read permission circuit 24 receives the address update signal 18 from the encryption circuit 11 and gives a read permission signal 25 to the output buffer 4 when the number of times the address update signal 18 is received exceeds a certain value.

In the following description, it is assumed that the data transfer speed between the host device and the encryption device is twice the processing speed of the encryption circuit.

FIG. 2-a is a schematic time chart showing the total processing time in the conventional method, and FIG. 2-b is a schematic time chart showing the total processing time in the present invention. FIG. 3 is a detailed time chart of the embodiment of the present invention shown in FIG.

In the conventional method, as shown in FIG. 2-a, the encryption process is started after all the data from the host device is stored in the input buffer 3, and the result of the encryption process is output to the host device each time it is output to the encryption output bus 22. Data is transferred. Therefore, in the conventional method, assuming that the data transfer time from the host device to the encryption device 1 is T, the encryption processing time is 2T and the total processing time is 3T.
Becomes

On the other hand, as shown in FIG. 2-b, according to the present invention, the process of storing the data from the host device in the input buffer 3 and the encryption process, and the encryption process and the data transfer from the output buffer 4 to the host device are performed in parallel. The total processing time is 2T.
Becomes

The operation of one embodiment of the present invention will be described below with reference to FIGS. 1 and 3 assuming that the data transfer amount between the host device and the encryption device is 8 bytes.

Before starting the data transfer from the host device to the encryption device 1, the write / read input address registers 7 and 8 and the read / write output address registers 9 and 10 are set to their initial values, that is, the input / output buffers 3 and 4, respectively. Set to the start address.

The input / output control circuit 2 periodically inverts the switching signal 13 when it becomes ready to receive data from the host device, and further puts the first byte of data from the host device on the channel input bus 20. A write signal is given to the input buffer 3 when the level is ". As a result, the first byte of data (M (1)) is transferred to the start address (W
(1) Written in I). The address signal 16 contains the address information set in the address register 7 when the switching signal 13 is at "1" level, and the address information set in the address register 8 when the switching signal 13 is at "0" level. Supplied. Next, the input / output control circuit 2 outputs the address update signal 14
Is sent to the address register 7 when the switching signal 13 becomes "0" level, and the contents of the address register 7 are updated. This changes the contents of the address register 7 from W (1) I to W (2) I. After that, the same operation is repeated until the eighth byte from the host device is written in the input buffer 3.

On the other hand, the cryptographic circuit 3 stores the data of the cryptographic input bus 21 when the switching signal 13 is at the "0" level of the even number of times, and then sends the address update signal 18 to update the contents of the address register 8. The contents of address register 8 are now R
Change from (1) I to R (2) I. Where W (i) I
And R (i) I (i = 1 to 8) indicate the same address.

Next, a method of writing and reading data to and from the output buffer 4 will be described. The output data of the encryption circuit 11 is fixed after a certain time from supplying the input data to the encryption circuit 11, and the time is determined by the processing capacity of the encryption circuit 11. Now i th
It is assumed that the (i + 1) th input data is fixed when the (i + 1) th input data is set in the encryption circuit 11. The cryptographic circuit 11 puts the first output data on the cryptographic output bus 22 at the same timing as when the second input data is set from the cryptographic input bus 21, and sends a write signal to the output buffer 4. As a result, the first output data (C (1)) of the encryption circuit 11 becomes the start address of the output buffer 4. Written in. The address signal 17 has the address information set in the address register 10 when the switching signal 13 is at "0" level, and the address information set in the address register 9 when the switching signal 13 is at "1" level. Is supplied. Next, the encryption circuit 11 switches the address update signal 19 to the switching signal 13
When it goes to "1" level, it is sent to the address register 10 and the contents of the address register 10 are updated. The contents of address register 10 are now Changes to. After that, the same operation is repeated until the eighth output data from the encryption circuit 11 is written in the output buffer 4.

Next, the operation after the data transfer from the host device is completed will be described. When the data transfer from the host device is completed, the encryption device 1 reports the data transfer completion to the host device by the input / output control circuit 2. When the upper device receives the end report, it continues to issue a command to the encryption device 1 to indicate the transfer request of the encrypted data to the upper device. The encryption device 1 analyzes the command and transfers the encrypted data stored in the output buffer 4 to the host device via the input / output control circuit 2. In the present embodiment, the cryptographic processing time is assumed to be twice as long as the data transfer time with the higher-level device, so that the encrypted data transfer to the higher-level device may be started after half the total cryptographic output process has elapsed. . This start time is when the read enable signal of the read enable circuit 24 is output to the output buffer 4. The read enable circuit 24
The operation of will be described later. In this embodiment, when the second switching signal 13 during the processing of the fourth output data is at the "1" level under the condition that the read enable signal is output, the output buffer is changed from the address indicated by the address register 9. The data of No. 4, that is, the first encrypted output data is read and transferred to the higher-level device via the input / output control circuit 2. After that, when the switching signal 13 changes to "0" level, the input / output control circuit 2 sends out the address update signal 15 to update the contents of the address register 9. As a result, the contents of address register 9 are Will be updated. After that, the same operation is repeated until the eighth device reads the eighth data from the output buffer 4 and the transfer is completed. Note that Indicates the same address.

Next, the operation of the read permission circuit 24 will be described with reference to FIG. The read enable circuit 24 comprises a counter 26 and a flip-flop 27. The initial value data and the address update signal 18 are input to the counter 26, and the output thereof becomes the set input signal of the flip-flop 27. flip flop
The output signal of 27 becomes the read enable signal 25. In this embodiment, (05) is set in the counter 26 as initial value data before reading data from the input buffer 3. The counter 26 subtracts the value stored therein each time the address update signal 18 is input, and sends an output signal to the flip-flop 27 when the value becomes (00). The flip-flop 27 is set by the output signal of the counter 26 and sends the read enable signal 25 to the output buffer 4.

In general, the encryption processing time is n times (n> 2) the data transfer time between the higher-level device and the encryption device, and m
Assuming that byte processing is performed, (m-m / n) +1 may be set in the counter 26 of this embodiment as initial value data.

According to the present embodiment, the data transfer between the higher-level device and the encryption device 1 and the encryption processing by the encryption circuit 11 can be executed in parallel.
It has the effect of shortening to 2/3.

Although the data encryption is quoted in the description of this embodiment,
Data decryption, that is, the process of receiving ciphertext input data from a higher-level device and transmitting the plaintext output data obtained by decrypting the ciphertext input data to the higher-level device, except that the process by the encryption circuit 11 is data decryption. Is the same.

〔The invention's effect〕

According to the present invention, since the data transfer process and the encryption / decryption process with the higher-level device can be executed in parallel in time, when the data transfer process time is T and the encryption process time is nT (n> 1). , The encryption processing time including data transfer seen from the host device is (1) when 1 <n ≦ 2 ... 2T (2) when n> 2 ... nT Further, when n> 2, the data during the encryption processing time nT The transfer time 2T and the time without parallel processing, that is, (n-2) T time, can be reduced to 2T by allocating the upper device of the cryptographic device by adding means for disconnecting the logical connection between the higher device and the cryptographic device There is an effect that can be done.

[Brief description of drawings]

FIG. 1 is a block diagram of an embodiment of the present invention, FIG. 2-a is a schematic time chart showing the total processing time of the conventional method, and FIG.
The figure is a schematic time chart showing the total processing time in the present invention,
FIG. 3 is a detailed time chart of FIG. FIG. 4 shows an example of the configuration of the read permission circuit 24 shown in FIG. 1 ... Cryptographic device, 2 ... Cryptographic circuit, 3 ... Input buffer, 4 ...
Output buffer, 7,8,9,10 ... Address register, 24 ... Read enable circuit.

Claims (1)

[Claims] 1. A function of encrypting data supplied from a host device according to an encryption key and an encryption algorithm and transferring the encrypted data to the host device, and a function of encrypting data supplied from the host device according to a decryption key and a decoding algorithm. In an encryption device having a function of decrypting and transferring the decrypted data to a higher-level device, an input buffer for storing input data transmitted from the higher-level device and reading the input data supplied to the encryption or decryption circuit; The output buffer stores the output data encrypted or decrypted by the decryption circuit and reads the output data to be transferred to the host device, and the output data obtained by encrypting or decrypting the input data transmitted from the host device. A switching signal that periodically repeats "1" level and "0" level until transfer to the host device, and encryption Alternatively, when the number of times of reading from the input buffer for supplying data to the decoding circuit exceeds a preset number, permission to output a permission signal that permits data to be read from the output buffer and transferred to the host device A signal generation circuit is provided, and the switching signal is "1".
In the case of, the input data transmitted from the host device is stored in the input buffer, and when the switching signal is “0”, the data read from the input buffer is supplied to the encryption or decryption circuit and encrypted or decrypted by the encryption or decryption circuit. The decoded output data is stored in the output buffer when the switching signal is "0", and when the switching signal is "1" and the permission signal is output, the transfer from the output buffer to the host device is started. A cryptographic device characterized in that