DE102020200748A1 - DEVICE AND ENCRYPTION METHOD - Google Patents

Abstract

An apparatus for encrypting an input memory address to obtain an encrypted memory address is provided. The device includes an input interface for receiving the input memory address as an address of a memory. Furthermore, the device comprises an encryption module for encrypting the input memory address as a function of a cryptographic key for obtaining the encrypted memory address. The encryption module is set up to encrypt the input memory address by applying an image that maps the input memory address to the encrypted memory address, the encryption module being set up to apply the image by performing a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation is so that the mapping is bijective.

Description

The present invention relates to encryption, and in particular to a device and a method for memory address encryption.

Memory and address encryption are becoming increasingly important.

On a controller in a chip card or a similar security device, the execution of memory encryption and in particular address encryption is subject to strict current, area and timing restrictions.

It would be very beneficial if improved concepts for memory and address encryption were provided.

The object of the present invention is to provide a device for encrypting an input memory address, a device, a method for encrypting an input memory address or a computer program with improved characteristics.

This object is achieved by a device for encrypting an input memory address according to claim 1, a device according to claim 10, a method for encrypting an input memory address according to claim 11 or a computer program according to claim 14.

According to one embodiment, a device is provided for encrypting an input memory address to obtain an encrypted memory address. The device includes an input interface for receiving the input memory address as an address of a memory. Furthermore, the device comprises an encryption module for encrypting the input memory address as a function of a cryptographic key for obtaining the encrypted memory address. The encryption module is for encrypting the input memory address by applying an image representing the input memory address to the encrypted memory address, the encryption module being designed for applying the image by performing a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation, so the mapping is bijective.

According to a further embodiment, a device for encrypting an input memory address is provided to obtain an encrypted memory address. The device includes an input interface for receiving the input memory address as an address of a memory. Furthermore, the device comprises a segmentation module for segmenting the input memory address into a plurality of input memory address segments. Furthermore, the device comprises an encryption module for encrypting each input memory address segment of the plurality of input memory address segments as a function of one of a plurality of cryptographic subkeys. The encryption module is configured to encrypt this input memory address segment by applying an image representing the input memory address segment to an encrypted memory address segment, this encrypted memory address segment being one of a plurality of encrypted memory address segments, the encryption module being used to create the image by performing a multiplication and a modulo operation one of the plurality of cryptographic sub-keys and one of a plurality of divisors is set up so that the mapping is bijective. Together, the encrypted memory address segments of the plurality of encrypted memory address segments form the encrypted memory address.

According to a further embodiment, a device is provided with a memory, a central unit for processing data stored in memory addresses in memory and an address encryption unit for encrypting an input memory address of the memory in order to obtain an encrypted memory address. The address encryption unit comprises an input interface for receiving the input memory address and an encryption module for encrypting the input memory address as a function of a cryptographic key for obtaining the encrypted memory address. The encryption module is set up to encrypt the input memory address by creating an image that maps the input memory address to the encrypted memory address. The encryption module is set up to create the image by performing a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation, so that the image is bijective.

The device according to a further embodiment is provided. The device comprises a ZE for providing an original logical address, an MMU for generating a shifted logical address depending on the original logical address, an address encryption unit for encrypting the shifted logical address for obtaining a physical address, the address encryption unit one Input interface for receiving the shifted logical address and further comprises an encryption module for encrypting the shifted logical address depending on a cryptographic key to obtain the physical address, the encryption module for encrypting the shifted logical address by applying a shifted logical address to the physical Address mapping mapping is set up, wherein the encryption module is set up to create the mapping by performing a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation, so that the mapping is bijective, a data encryption / decryption unit for encryption first plain text data for obtaining first cipher text data and for decrypting second cipher text data for obtaining second clear text data, a key storage for storing d It cryptographic key and a memory, configured either to store the first ciphertext data at the physical address or to provide the second ciphertext data stored at the physical address for the data encryption / decryption module.

• - Enpfangen der Eingangsspeicheradresse als eine Adresse eines Speichers und:
• - Verschlüsseln der Eingangsspeicheradresse in Abhängigkeit von einem kryptografischen Schlüssel zum Erhalten der verschlüsselten Speicheradresse.

According to a further embodiment, a method for encrypting an input memory address to obtain an encrypted memory address is provided. The process includes:

• Receiving the input memory address as an address of a memory and:
• - Encrypting the input memory address depending on a cryptographic key to obtain the encrypted memory address.

Encrypting the input memory address includes creating an image mapping the input memory address to the encrypted memory address by performing multiplication and module operation using the cryptographic key and divisor of the modulo operation so that the image is bijective.

• - Empfangen der Eingangsspeicheradresse als eine Adresse eines Speichers,
• - Segmentieren der Eingangsspeicheradresse in eine Vielzahl von Eingangsspeicheradresssegmenten, und
• - Verschlüsseln jedes Eingangsspeicheradresssegments der Vielzahl von Eingangspeicheradresssegmenten in Abhängigkeit von einem einer Vielzahl von kryptografischen Nebenschlüsseln zum Erhalten der verschlüsselten Speicheradresse, wobei Verschlüsseln des Eingangsspeicheradresssegments Anlegen einer das Eingangsspeicheradresssegment auf ein verschlüsseltes Speicheradresssegment einer Vielzahl von verschlüsselten Speicheradresssegmenten abbildenden Abbildung durch Durchführen einer Multiplikation und einer Modulo-Operation unter Verwendung eines der Vielzahl von kryptografischen Nebenschlüsseln und eines einer Vielzahl von Divisoren umfasst, so dass die Abbildung bijektiv ist,

According to a further embodiment, a method for encrypting an input memory address to obtain an encrypted memory address is provided. The process includes:

• Receiving the input memory address as an address of a memory,
• Segmenting the input memory address into a plurality of input memory address segments, and
• Encrypting each input memory address segment of the plurality of input memory address segments in dependence on one of a multiplicity of cryptographic subkeys to obtain the encrypted memory address, wherein encrypting the input memory address segment applying a mapping the input memory address segment to an encrypted memory address segment by performing a multiplicity of encrypted memory address segments and mapping an image mapping Surgery using one of the plurality of cryptographic sub-keys and one of a plurality of divisors, so that the mapping is bijective,

Together, the encrypted memory address segments of the plurality of encrypted memory address segments form the encrypted memory address.

Before embodiments of the present invention are described in detail using the accompanying figures, it should be noted that the same or functionally identical elements are given the same reference numerals in the figures and a repeated description for elements provided with the same reference numerals is omitted. Descriptions provided for elements with the same reference numbers are therefore interchangeable.

• 1 eine Einrichtung zum Verschlüsseln einer Eingangsspeicheradresse zum Erhalten einer verschlüsselten Speicheradresse nach einer Ausführungsform,
• 2 ein Verschlüsselungsmodul 120 nach einer Ausführungsform,
• 3 eine Einrichtung zum Verschlüsseln einer Eingangsspeicheradresse zum Erhalten einer verschlüsselten Speicheradresse nach einer Ausführungsform,
• 4 eine Einrichtung mit einem Speicher 410, einer ZE 420 und einer Adressenverschlüsselungseinheit 430 nach einer Ausführungsform,
• 5 einen Ansatz für Adressenverschlüsselung,
• 6 einen weiteren Ansatz für Adressenverschlüsselung,
• 7 einen weiteren Ansatz für Adressenverschlüsselung,
• 8 die Einrichtung nach einer weiteren Ausführungsform mit einer ZE, einer MMU, einer Adressenverschlüsselungseinheit, einer Datenverschlüsselungs/Entschlüsselungseinheit, einer Schlüsselspeicherung und einem Speicher, und
• 9 die Auswirkung kombinierter Datenverschlüsselung und Adressenverschlüsselung.

Preferred exemplary embodiments of the present invention are explained in more detail below with reference to the accompanying drawings. Show it:

• 1 a device for encrypting an input memory address to obtain an encrypted memory address according to one embodiment,
• 2nd an encryption module 120 according to one embodiment,
• 3rd a device for encrypting an input memory address to obtain an encrypted memory address according to one embodiment,
• 4th a device with a memory 410 , a ZE 420 and an address encryption unit 430 according to one embodiment,
• 5 an approach to address encryption,
• 6 another approach to address encryption,
• 7 another approach to address encryption,
• 8th the device according to a further embodiment with a ZE, an MMU, an address encryption unit, a data encryption / decryption unit, a key storage and a memory, and
• 9 the impact of combined data encryption and address encryption.

Before describing the preferred embodiment in detail, some address encryption considerations are offered to help provide a better understanding of the preferred embodiments.

Address encryption can be realized as a bijective mapping f, for example a conversion of simple addresses a into encrypted addresses a '. The mapping is controlled by a key k: $$\mathbf{a}\text{'}={\mathbf{f}}_k\left(a\right).$$

For test purposes such as manufacturing tests, it may be important to have an indexed function a '= f _k (a) for which there is a label _key called k ₀ , with the property that it yields the label _mapping , i.e. a = f _k0 ( a). This means that scrambling is switched off.

Executing such a function can be critical in a microcontroller architecture for several reasons. For example, any delay in the address path from the controller to the memory (see figure: path from MMU to memory) leads to a deterioration in system performance. If the execution requires a large number of gate delays, additional clock cycles are required for memory access. Furthermore, complicated designs lead to high power consumption since memory addressing occurs frequently.

It can often be sufficient that the address encryption is not cryptographically hard, but that enough scrambling is provided to make subsequent attacks harder. For example, address scrambling makes the identification of data blocks necessary for cryptanalysis of the storage encryption of data much more difficult. Second, address scrambling makes labeling blocks of memory for subsequent error coupling attacks much more difficult.

Address encryption can be done through a first approach such as 5 can be realized where an exclusive OR of the addresses is carried out with a key: $${\mathbf{f}}_k\left(a\right)=\mathbf{a}\oplus k.$$

Advantages of this approach are minimal gate counting, minimal performance impact due to minimal circuit depth (only a gate delay is added), and an identification key. Scrambling is deactivated for k = 0. However, such an approach only realizes a linear mapping, i.e. such an approach has no cryptographic strength at all. The approach works on a bit-by-bit basis, i.e. there is no mixing of bits. It can therefore be reworked and easily broken open. This results in a low final security.

By changing the approach of 5 a related simple scramble can be performed.

Alternatively, address encryption can be done through a second approach such as 6 shown, where a block cipher BC is used for encryption: $${\mathbf{f}}_k\left(a\right)=B\mathrm{C.}\left(ScHlüssel=k,a\right).$$

An advantage of such an approach is its high cryptographic strength when a strong cipher is used. Disadvantages are a high gate count, a drastic deterioration in performance, since block ciphers are round-based and cryptographically hard block ciphers require a high round number, e.g. 16 for DES or 10 for AES-128. The critical access time to the memory is therefore increased by an enormous factor, since several additional clock cycles are required in the address phase and there is usually no (known) identification key. The labeling must be implemented by a secondary path using multiplexors.

The through 6 The approach shown can be implemented with a greatly reduced lap number, eg only one or two laps. In this case, the cryptographic strength is almost completely lost. The investment in high hardware costs therefore does not pay off at all.

ein Satz von j m-zu-m S-Boxen ist, von denen jede einen disjunkten Teilbereich des Adressraums abbildet. Dann, angenommen, dass $${\mathbf{f}}_k\left(a\right)=S\left(a\right)\oplus k$$

oder $${\mathbf{f}}_k\left(a\right)=L\left(S\left(a\right),k\right)$$

wobei L eine lineare Operation darstellt.Alternatively, address encryption can be done through a third approach such as 7 can be realized where a set of replacement boxes (S-boxes) is used. Assume that $$\mathbf{S}\left(a\right)=\left(S_1\left(a_1\right),S_{\mathrm{2nd}}\left(a_{\mathrm{2nd}}\right),...S_n\left(a_j\right)\right)$$

is a set of j m-to-m S-boxes, each of which maps a disjoint portion of the address space. Then, suppose that $${\mathbf{f}}_k\left(a\right)=S\left(a\right)\oplus k$$

or $${\mathbf{f}}_k\left(a\right)=L\left(S\left(a\right),k\right)$$

where L represents a linear operation.

Basically, this corresponds to a round of a classic block cipher (see b) with an S-box layer, a key addition step and optionally a linear diffusion layer.

An advantage of this approach is that it can be built to have an identification key. Disadvantages are, however, that even small S-boxes such as 4x4 S-boxes already have a high gate count and a high switching depth. They usually add a significant number of gate delays, which degrades memory access performance. As a result, an additional clock cycle could be needed in the address phase. Furthermore, such an approach has only a medium cryptographic strength. The through 7 shown approach lacks cryptographic strength and there is a deterioration in memory access time similar to the second approach 6 .

Preferred embodiments avoid the disadvantages of 5 , 6 and 7 approaches presented.

1 FIG. 12 shows a device for encrypting an input memory address to obtain an encrypted memory address according to an embodiment.

The facility includes an input interface 110 to record the input memory address as an address of a memory.

The device also includes an encryption module 120 to encrypt the input memory address depending on a cryptographic key 121 to get the encrypted memory address.

The encryption module 120 is set up to encrypt the input memory address by creating an image that maps the input memory address to the encrypted memory address.

The encryption module 120 is for creating the mapping by performing multiplication and modulo operation using the cryptographic key 121 and a divisor 122 the modulo operation so that the mapping is bijective.

In one embodiment, the input memory address, the encrypted memory address, the cryptographic key 121 and the divisor 122 display one polynomial each for the modulo operation. In such an embodiment, the divisor 122 display a polynomial that is an irreducible polynomial.

In some embodiments, the divisor 122 display a polynomial that is a non-reducible polynomial where all the coefficients of the non-reducible polynomial are rational. For example, with respect to polynomials where all are rational, a polynomial can be considered unreducible if it cannot be expressed as the product of two or more polynomials where all coefficients are rational so that each of these two or more polynomials where all coefficients are rational, have a lower degree than the original polynomial.

In some embodiments, however, the divisor 122 display a polynomial that is a nonreducible polynomial and wherein one, some, or all of the coefficients of the nonreducible polynomial are not rational.

eingerichtet ist. In einer solchen Ausführungsform zeigt a die Eingangsspeicheradresse an, a' zeigt die verschlüsselte Speicheradresse an, k zeigt den Verschlüsselungsschlüssel an und p zeigt den Divisor an. 2nd shows an encryption module 120 according to a specific embodiment, where the encryption module 120 to create the image by inserting the formula: $$\mathbf{a}\text{'}=ak\left(mOdp\right)$$

is set up. In such an embodiment, a indicates the input memory address, a 'indicates the encrypted memory address, k indicates the encryption key, and p indicates the divisor.

For example, consider a simplified example that: $$\mathbf{a}=1001;k=1101;p=101$$

$$\text{Polynom}\left(k\right)=1\cdot x^3+1\cdot x^2+0\cdot x^1+1\cdot x^0=x^3+x^2+1$$

$$\text{Polynom}\left(p\right)=1\cdot x^2+0\cdot x^1+1\cdot x^0=x^2+1$$

wo x² + 1 ein nichtreduzierbares Polynom über GF(2) darstellt. Then the bits of the bit sequence can represent coefficients of a polynomial over the Galois field GF (2): $$\text{polynomial}\left(a\right)=1\cdot x^{\mathrm{3rd}}+0\cdot x^{\mathrm{2nd}}+0\cdot x^1+1\cdot x^0=x^{\mathrm{3rd}}+1$$

$$\text{polynomial}\left(k\right)=1\cdot x^{\mathrm{3rd}}+1\cdot x^{\mathrm{2nd}}+0\cdot x^1+1\cdot x^0=x^{\mathrm{3rd}}+x^{\mathrm{2nd}}+1$$

$$\text{polynomial}\left(p\right)=1\cdot x^{\mathrm{2nd}}+0\cdot x^1+1\cdot x^0=x^{\mathrm{2nd}}+1$$

where x ² + 1 represents a nonreducible polynomial over GF (2).

In contrast, a polynomial x ^{2 is} a reducible polynomial since x ² = x · x.

das Polynom anzeigt: $$b_{n-1}{x}^{n-1}+b_{n-2}{x}^{n-2}+b_{n-3}{x}^{n-3}+\dots b_2{x}^2+b_{1}x+b_0.$$

For example, some implementations can apply the general rule that a bit string: $$b_{n-1}{b}_{n-\mathrm{2nd}}{b}_{n-\mathrm{3rd}}...b_{\mathrm{2nd}}{b}_1{b}_0$$

the polynomial indicates: $$b_{n-1}{x}^{n-1}+b_{n-\mathrm{2nd}}{x}^{n-\mathrm{2nd}}+b_{n-\mathrm{3rd}}{x}^{n-\mathrm{3rd}}+...b_{\mathrm{2nd}}{x}^{\mathrm{2nd}}+b_{1}x+b_0.$$

$$\left(ak\right)modp$$

bedeutet;
(z.B. zuerst Multiplikation von a und k; dann Modulo-Teilung des Ergebnisses durch p).It should also be noted that according to embodiments, for example $$ak\left(mOdp\right)$$

$$\left(ak\right)mOdp$$

means;
(eg first multiplication of a and k; then modulo division of the result by p).

According to a specific embodiment, the address a and the key k are regarded as elements of a polynomial ring, for example the extension field F _q [x] / (p), where p is a non-reducible polynomial.

In a specific embodiment, the parameter q = 2 is selected so that address bit areas can be assigned to field elements.

Then the address encryption can be described as a modular multiplication. $$a\text{'}=ak\left(mOdp\right)$$

According to other embodiments, an auxiliary key b is used so that: $$a\text{'}=ak\left(mOdp\right)+b$$

Here "+" denotes the addition in the field, e.g. exclusive-or (⊕) for q = 2.

For a fixed, e.g. The preselected value of k ≠ 0 and non-reducible p is bijective and generates an implementation of the set of original address values. Due to this property, the polynomial ring operation can be used as address encryption.

In comparison with the prior art, the embodiments provided here are particularly advantageous for effective address scrambling.

For example, the field multiplication can generally be carried out in such a way that it is carried out with only a few gate delays. This means that it can be performed on the fly within the address clock cycle (no additional clock cycle is required). For sparse polynomials p, the gate delay of the circuit is very small.

Furthermore, area and power consumption are smaller compared to solutions of the prior art.

Furthermore, the security is improved compared to the “Xor” approach of the prior art described above and is comparable to the above-described approach of the prior art “S-box layer”, but with significantly reduced area and electricity costs. A well-chosen polynomial will produce a highly non-linear mix of the address bits.

Furthermore, according to embodiments, there could be a natural identifier key k = 1, which is useful for generation verification purposes. Thus, according to some embodiments, the device for selecting a license plate key is configurable as the encryption key k, so that $$ak\left(mOdp\right)=amOdp.$$

According to embodiments, a zero key results in a '= 0. This can be used as a security countermeasure: If an attack is detected, the key can be deleted to only zero. In this case, each access to address 0 is mapped (or a fixed address b if the affine variant is used). It is advantageous that this address only contains blank data, so that the From then on, the attacker will only read blank data. Thus, according to some embodiments, the device for selecting a zero key can be configured as the encryption key k, so that $$ak\left(mOdp\right)=0.$$

eingerichtet, wobei a die Eingangsspeicheradresse anzeigt, wobei a' die verschlüsselte Speicheradresse anzeigt, wobei k den Verschlüsselungsschlüssel anzeigt, wobei p den Divisor anzeigt und wobei b einen Hilfsschlüssel anzeigt.In some embodiments, the encryption module 120 to apply the image by inserting the formula $$a\text{'}=ak\left(mOdp\right)+b$$

set up, where a indicates the input memory address, where a 'indicates the encrypted memory address, where k indicates the encryption key, where p indicates the divisor and where b indicates an auxiliary key.

In some embodiments, the means for selecting an identification key as the encryption key k is configurable so that $$ak\left(mOdp\right)+b=amOdp+b.$$

In some embodiments, the means for selecting a zero key is configurable as the encryption key k such that a k (mod p) + b = b.

Some embodiments offer versions of the concepts described above with segmented address ranges. The address scrambling method shown can also be applied to segmented address spaces. Address granularity can be introduced through the controller's memory hierarchy. For example, non-volatile memory contains a number of N _s segments (which can be erased at one time), each of which contains a number of N _b blocks (which are programmed at a time), each of which contains a number of N _w words (determined by the processor word width), each of which contains a number of N _b bytes. When using scrambling, it is only possible in practice to exchange a data unit within the same parent unit with another data unit. For example, only blocks in the same segment can be exchanged, only words in the same block can be exchanged, etc.

Accordingly shows 3rd means for encrypting an input memory address to obtain an encrypted memory address according to another embodiment.

The facility includes an input interface 310 for receiving the input memory address as an address of a memory.

The device also includes a segmentation module 315 for segmenting the input memory address into a plurality of input memory address segments.

The device also includes an encryption module 320 to encrypt each input memory address segment of the plurality of input memory address segments depending on one of a plurality of cryptographic sub-keys. The encryption module 320 is configured to encrypt the input memory address segment by applying an image depicting the input memory address segment to an encrypted memory address segment, the encrypted memory address segment being one of a plurality of encrypted memory address segments. The encryption module 320 is arranged to create the mapping by performing a multiplication and modulo operation using one of the plurality of cryptographic sub-keys and one of a plurality of divisors, so that the mapping is bijective.

Together, the encrypted memory address segments of the plurality of encrypted memory address segments form the encrypted memory address.

In one embodiment, each of the plurality of input memory address segments indicates a polynomial of a first group of polynomials, each of the plurality of encrypted memory address segments indicating a polynomial of a second group of polynomials, each of the plurality of cryptographic sub-keys indicating a third polynomial, and each of the plurality of divisors displays a fourth polynomial as an irreducible polynomial.

eingerichtet, wobei i einen Index des Eingangsspeicheradresssegments anzeigt, wobei a_i das Eingangsspeicheradresssegment anzeigt, wobei a_i' eines der Vielzahl von verschlüsselten Speicheradresssegmenten anzeigt, wobei k_i eines der Verschlüsselungsnebenschlüssel anzeigt und wobei p_i einen der Divisoren anzeigt.According to one embodiment, the encryption module 320 for encrypting each of the input memory address segments by applying the image representing the input memory address segment to one of the plurality of encrypted memory address segments by inserting the formula $$a_i\text{'}=a_i{k}_i\left(mOd{p}_i\right)$$

where i indicates an index of the input memory address segment, where a _i indicates the input memory address segment, where a _i 'is one of the plurality of encrypted Displays memory address segments, where k _i indicates one of the encryption subkeys and where p _i indicates one of the divisors.

In a specific embodiment, the (input) address is split into segments a = (a ₁ , a ₂ , ..., a _n ), for example, according to the memory hierarchy of the system, secondary keys are k ₁ , k ₂ , ..., k _n derived from a key k. For example, a secondary key derivation could be a segmentation of the key into bit areas k = (k ₁ , k ₂ , ..., k _n ). Different reduction polynomials p ₁ , p ₂ , ..., p _n can be used. Then the mapping of the scrambling operation of the entire storage system can be accomplished, for example, by $$\begin{array}{l}{a}_1\text{'}=a_1{k}_1\left(mOd{p}_1\right)\\ a_{\mathrm{2nd}}\text{'}=a_{\mathrm{2nd}}{k}_{\mathrm{2nd}}\left(mOd{p}_{\mathrm{2nd}}\right)\\ ...\\ a_n\text{'}=a_n{k}_n\left(mOd{p}_n\right)\end{array}$$

Since the operations can be performed in parallel on all hierarchical levels, there is no additional loss in performance.

According to one embodiment, the device for selecting each input memory address segment a _{i of} the input memory address segments of a label key is configurable as the encryption key k _i , so that a _i k _i (mod p _i ) = a _i (mod p _i ).

In one embodiment, the device for selecting the input memory address segments a _{i of} the input memory address segments of a zero key is configurable as the encryption key k _i , so that a _i k _i (mod p _i ) = 0.

eingerichtet, wobei i einen Index des Eingangsspeicheradresssegments anzeigt, wobei a_i das Eingangsspeicheradresssegment anzeigt, wobei a_i' das eine der Vielzahl von verschlüsselten Speicheradresssegmenten anzeigt, wobei k_i eines der Verschlüsselungsnebenschlüssel anzeigt, wobei p_i einen der Divisoren anzeigt und wobei b_i einen einer Vielzahl von Hilfsschlüsseln anzeigt.According to one embodiment, the encryption module 320 for encrypting each of the input memory address segments by applying the image representing the input memory address segment to one of the plurality of encrypted memory address segments by inserting the formula $$a_i\text{'}=a_i{k}_i\left(mOd{p}_i\right)+b_i,$$

where i indicates an index of the input memory address segment, a _i indicates the input memory address segment, a _i 'indicates one of the plurality of encrypted memory address segments, k _i indicates one of the encryption sub-keys, p _i indicates one of the divisors, and b _i indicates one displays a variety of auxiliary keys.

In one embodiment, the device is configurable to select, for each input memory address segment a _i, the input memory address segments of an identification key as the encryption key k _i , such that $$a_i{k}_i=\left(mOd{p}_i\right)+b_i=a_i\left(mOd{p}_i\right)+b_i.$$

In one embodiment, the device is configurable to select, for each input memory address segment a _i, the input memory address segments of a zero key as the encryption key k _i , so that $$a_i{k}_i=\left(mOd{p}_i\right)+b_i=b_i.$$

In certain embodiments, further diversification or scrambling of the encrypted memory address segments is provided by mapping an input memory address segment a _i to an encrypted memory address segment a _i ', using one or more bits from the input memory address other than bits of the input memory address that are being mapped. In other words, all or part of one or more other input memory address segments can be built into the map. For example, the encryption module may be configured to perform multiplication and modulo operation for each of one or more of the input memory address segments, as described above, but using one or more bits of the input memory address other than bits of the input memory address segment currently being mapped. This can be done in several different ways. For example, in some embodiments, one or more bits of the input memory address may be built in or used to modify or select the cryptographic subkey k _i , or in others may be built in or used in an auxiliary key b _i , to modify it or to select, or a combination of which can be used with still others. In any of these and other embodiments, one or more of the input memory address bits may be built into divisor p _i or used to modify or select it.

It can be seen that these approaches, where input memory address bits from portions of the input memory address other than the input memory address segment that is being encrypted, are built into the map, diversify the output from the map so that the same input memory address segment is different depending on these other bits maps encrypted input memory address segments. This makes it more difficult for an attacker to identify blocks of encrypted memory addresses that belong together because, for example, an input memory address segment containing high order bits of the input memory address that will only change occasionally as the range of memory addresses is sequentially scanned for very different ones maps encrypted memory address segments depending on the lower order bits of the input memory address.

4th shows a facility 400 with a memory 410 , a ZE 420 for processing data stored in memory addresses in memory, and an address encryption unit 430 for encrypting an input memory address of the memory to obtain an encrypted memory address according to one embodiment.

The address encryption unit 430 includes an input interface 431 to record the input memory address and an encryption module 432 to encrypt the input memory address depending on a cryptographic key to obtain the encrypted memory address.

The encryption module 432 is set up to encrypt the input memory address by applying an image depicting the input memory address to the encrypted memory address. Furthermore, the encryption module 432 to create the mapping by performing a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation so that the mapping is bijective.

In some embodiments, the address encryption unit 430 means for encrypting an input memory address to obtain an encrypted memory address according to one of the embodiments described above.

8th shows an architecture where address encryption, eg address encryption according to one of the embodiments described above, can be used.

8th shows a ZE 810 , a memory 820 , an address encryption unit 830 , a data encryption / decryption unit 840 , a key storage 850 and an MMU (Memory Management Unit) 860 .

The ZE must have data in memory 820 to save. Furthermore, the ZE 810 Data from memory 820 unload.

For transferring data from the ZE 810 to the store 820 and from memory 820 to 810 data buses are used.

The ZE 810 uses plain text data. However, data is in memory 820 saved as ciphertext (encrypted data). Therefore, if the ZE 810 (Plain text) data in memory 820 wants to save, the ZE sends 810 the plain text data to the data encryption / decryption unit 840 via a data bus. The data encryption / decryption unit 840 encrypts the plain text data to obtain cipher text data and stores the cipher text data in memory 820 . If the ZE 810 Data from memory 820 wishes to unload the encrypted data from memory 820 unloaded and into the data encryption / decryption unit 840 fed. The data encryption unit 840 decrypts the ciphertext data to obtain plaintext data and transmits the plaintext data to the ZE 810 .

The data encryption / decryption unit can be used to encrypt plain text data and to decrypt cipher text data 840 one in a certain storage area, the key storage 850 , stored (cryptographic) key.

The ZE 810 can be a logical address from in memory 820 know stored data.

ZE saves data at an original logical address 810 the original logical address to the MMU 860 further. The MMU 860 may shift the original logical address to obtain a shifted logical address and pass the shifted logical address to the address encryption module 830 further. The address encryption module 830 encrypts the moved address by inserting address encryption into a physical address. The physical address becomes a memory via an address bus 820 forwarded so that memory goes to memory 820 forwarded so the memory 820 knows where to save the data.

The address encryption unit 830 may be a device for encrypting an input memory address according to one of the embodiments described above.

ZE unloads data from an original logical address 810 again the original logical address to the MMU 860 further. The MMU 860 can move the original logical address to obtain a shifted logical address and routes the shifted logical address to the address encryption module 830 further. The address encryption module 830 encrypts the shifted logical address by inserting address encryption into a physical address. The physical address becomes a memory via an address bus 820 forwarded so the memory 820 knows where the data to be loaded is located.

The address encryption unit can be used for address encryption 830 one in a certain storage area, the key storage 850 , stored (cryptographic) key.

• - eine ZE 810 zum Bereitstellen einer ursprünglichen logischen Adresse,
• - eine MMU 860 zum Erzeugen einer verschobenen logischen Adresse in Abhängigkeit von der ursprünglichen logischen Adresse,
• - eine Adressenverschlüsselungseinheit 830 zum Verschlüsseln der verschobenen logischen Adresse zum Erhalten einer physikalischen Adresse, wobei die Adressenverschlüsselungseinheit 830 eine Eingangsschnittstelle zum Aufnehmen der verschobenen logischen Adresse umfasst und weiterhin ein Verschlüsselungsmodul zum Verschlüsseln der verschobenen logischen Adresse in Abhängigkeit von einem kryptografischen Schlüssel zum Erhalten der physikalischen Adresse umfasst, wobei das Verschlüsselungsmodul zum Verschlüsseln der verschobenen logischen Adresse durch Anlegen einer die verschobene logische Adresse abbildenden Abbildung an die physikalische Adresse eingerichtet ist, wobei das Verschlüsselungsmodul zum Anlegen der Abbildung durch Durchführen einer Multiplikation und einer Modulo-Operation unter Verwendung des kryptografischen Schlüssels und eines Divisors der Modulo-Operation eingerichtet ist, so dass die Abbildung bijektiv ist,
• - eine Datenverschlüsselungs/Entschlüsselungseinheit 840 zum Verschlüsseln erster Klartextdaten zum Erhalten erster Chiffretextdaten und zum Entschlüsseln zweiter Chiffretextdaten zum Erhalten zweiter Klartextdaten,
• - eine Schlüsselspeicherung 850 zum Speichern des kryptografischen Schlüssels,
• - und einen Speicher 820, eingerichtet entweder zum Speichern der ersten Chiffretextdaten an der physikalischen Adresse oder zum Bereitstellen der an der physikalischen Adresse gespeicherten zweiten Chiffretextdaten für das Datenverschlüsselungs/Entschlüsselungsmodul.

In particular shows 8th one embodiment of a device comprising:

• - a ZE 810 to provide an original logical address,
• - an MMU 860 to generate a shifted logical address depending on the original logical address,
• - an address encryption unit 830 for encrypting the shifted logical address to obtain a physical address, the address encryption unit 830 comprises an input interface for receiving the shifted logical address and further comprises an encryption module for encrypting the shifted logical address in dependence on a cryptographic key for obtaining the physical address, the encryption module for encrypting the shifted logical address by creating an image representing the shifted logical address to the physical address, the encryption module being set up to create the image by performing a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation, so that the image is bijective,
• - a data encryption / decryption unit 840 to encrypt first plain text data to obtain first cipher text data and to decrypt second cipher text data to obtain second clear text data,
• - a key storage 850 to save the cryptographic key,
• - and a memory 820 , set up either for storing the first ciphertext data at the physical address or for providing the second ciphertext data stored at the physical address for the data encryption / decryption module.

In this way, double protection is achieved 9 it can be seen: By encrypting the data, the plain text data is replaced by cipher text data, so that an attacker cannot read the plain text data. By encrypting the original address to obtain an encrypted address, the address is converted and the data is not stored in the storage location indicated by the original address, but instead is stored in the encrypted address. For example, an attacker does not know where the data is stored and data at subsequent logical addresses is stored in completely different physical locations in the memory, since address encryption is used.

Although some aspects have been described in connection with a device, it is clear that these aspects also represent a description of the corresponding method, where a block or device corresponds to a method step or a feature of a method step. Analogously, aspects described in the context of a method step also represent a description of a corresponding unit or a corresponding object or a corresponding feature of a corresponding device.

The decomposed signal according to the invention can be stored on a digital storage medium or can be transmitted on a transmission medium such as a wireless transmission medium or a wired transmission medium such as the Internet.

Depending on certain execution requirements, embodiments of embodiments may be implemented in hardware or in software. Execution can be performed using digital storage means such as a floppy disk, DVD, CD, ROM, PROM, EPROM, EEPROM, or FLASH memory with electronically readable control signals stored thereon that interact with a programmable computer system (or can work together) so that the respective procedure is carried out.

Some embodiments according to embodiments include a non-volatile data carrier with electronically readable control signals that can interact with a programmable computer system, so that one of the methods described here is carried out.

In general, embodiments of the present invention can be implemented as a computer program product with a program code, the program code being effective for performing one of the methods when the computer program product is running on a computer. The program code can, for example, be stored on a machine-readable medium.

Other embodiments include the computer program for performing one of the methods described herein, stored on a machine readable medium.

In other words, one embodiment of the method according to the invention is a computer program with a program code for carrying out one of the methods described here when the computer program runs on a computer.

A further embodiment of the method according to the invention is therefore a data carrier (or a digital storage medium or a computer-readable medium) which, recorded thereon, comprises the computer program for carrying out one of the methods described here.

A further embodiment of the method according to the invention is therefore a data stream or a sequence of signals representing the computer program for carrying out one of the methods described here. The data stream or the sequence of signals can, for example, be set up to be transmitted via a data communication connection, for example via the Internet.

A further embodiment comprises a processing means, for example a computer, or a programmable logic device, set up or designed to carry out one of the methods described here.

Another embodiment includes a computer with a computer program installed thereon for performing one of the methods described here.

In some embodiments, a programmable logic device (e.g., a field programmable gate array) can be used to perform some or all of the functionalities of the methods described herein. In some embodiments, a field programmable gate arrangement may cooperate with a microprocessor to perform one of the methods described herein. In general, the methods are performed by any hardware device.

While this invention has been described in terms of several advantageous embodiments, there are changes, conversions, or correspondences that fall within the scope of the present invention. It should also be noted that there are many alternative ways to carry out the methods and compositions of the present invention. The following appended claims are therefore to be interpreted as including any such changes, implementations, or correspondences that fall within the true meaning and scope of the present invention.

The embodiments described above are only exemplary of the principles of the present invention. It is understood that changes and changes in the arrangements and details described herein will be apparent to those skilled in the art. They are therefore intended to be limited only by the scope of protection of the following claims and not by the specific details shown as a description and explanation of the embodiments here.

Although each claim relates to only a single claim, the disclosure also covers every conceivable combination of claims.

Claims (14)

Encryption of an input memory address to obtain an encrypted memory address includes: an input interface configured to receive the input memory address as an address of a memory, a segmentation module configured to segment the input memory address into a plurality of input memory address segments, and one An encryption module configured to encrypt each input memory address segment of the plurality of input memory address segments in response to a respective one of a plurality of cryptographic sub-keys, the encryption module configured to encrypt the input memory address segment by mapping to an encrypted memory address segment , wherein the encrypted memory address segment is one of a plurality of encrypted memory address segments, wherein the Encryption module is configured to apply the mapping by performing a multiplication and modulo operation using one of the plurality of cryptographic sub-keys and one of a plurality of divisors, so that the mapping is bijective, wherein the encrypted memory address segments of the plurality of encrypted memory address segments together form the encrypted memory address. Establishment according to Claim 1 wherein each of the plurality of input memory address segments indicates a polynomial of a first group of polynomials, each of the plurality of encrypted memory address segments indicating a polynomial of a second group of polynomials, each of the plurality of cryptographic subkeys indicating a third polynomial, and each of the plurality of divisors displays a fourth polynomial as an irreducible polynomial. Establishment according to Claim 1 or 2nd wherein the encryption module is configured to encrypt each of the input memory address segments by applying the mapping that maps the input memory address segment to one of the plurality of encrypted memory address segments using the following formula: $${\text{a}}_{\text{i}}\text{'}={\text{a}}_{\text{i}}{\text{k}}_{\text{i}}\left({\text{mod p}}_{\text{i}}\right),$$

where i indicates an index of the input memory address segment, where a _i indicates the input memory address segment, where a _i 'indicates one of the plurality of encrypted memory address segments, where k _i indicates one of the encryption subkeys and where p _i indicates one of the divisors. Establishment according to Claim 3 , the device being configurable to select an identity key as the encryption key k _i for each input memory address segment a _{i of} the input memory address segments, so that a _i k _i (mod p _i ) = a _i (mod p _i ) applies. Establishment according to Claim 3 , wherein the device is configurable to select a zero key as the encryption key k _i for each input memory address segment a _{i of} the input memory address segments, so that a _i k _i (mod p _i ) = 0 applies. Establishment according to one of the Claims 1 to 5 wherein the encryption module is configured to encrypt each of the input memory address segments by applying the mapping that maps the input memory address segment to one of the plurality of encrypted memory address segments using the following formula: $$a_i\text{'}=a_i{k}_i\left(mOd{p}_i\right)+b_i,$$

where i indicates an index of the input memory address segment, a _i indicates the input memory address segment, a _i 'indicates one of the plurality of encrypted memory address segments, k _i indicates one of the encryption subkeys, p _i indicates one of the divisors, and b _i indicates one displays a variety of auxiliary keys. Establishment according to Claim 6 , wherein the device is configurable to select an identity key as the encryption key k _i for each input memory address segment a _{i of} the input memory address segments, so that the following applies: $$a_i{k}_i=\left(mOd{p}_i\right)+b_i=a_i\left(mOd{p}_i\right)+b_i.$$

Establishment according to Claim 6 , wherein the device is configurable to select a zero key as the encryption key k _i for each input memory address segment a _{i of} the input memory address segments, so that the following applies: $${\text{a}}_{\text{i}}{\text{k}}_{\text{i}}=\left({\text{mod p}}_{\text{i}}\right)+{\text{b}}_{\text{i}}={\text{b}}_{\text{i}}.$$

Establishment according to one of the Claims 1 to 8th , wherein the encryption module is configured to further perform the multiplication and modulo operation using one or more bits of the input memory address other than bits of the input memory address segment currently being mapped. An apparatus comprising: a microprocessor for providing an original logical address, an MMU for generating a shifted logical address depending on the original logical address, an address encryption unit for encrypting the shifted logical address to obtain a physical address, the address encryption unit having an input interface for receiving the shifted logical address, and further comprising an encryption module for encrypting the shifted logical address depending on a cryptographic key to obtain the physical address, the encryption module being configured to encrypt the shifted logical address by applying an image , which maps the shifted logical address to the physical address, wherein the encryption module is configured to the To create the mapping by performing a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation so that the mapping is bijective, a data encryption / decryption unit for encrypting first plaintext data to obtain first ciphertext data and decrypting second ciphertext data for obtaining second plain text data, a key storage for storing the cryptographic key, and a memory configured either to store the first cipher text data at the physical address or to provide the second cipher text data stored at the physical address for the data encryption / decryption module. A method of encrypting an input memory address to obtain an encrypted memory address, comprising: Taking the input memory address as an address of a memory, Segment the input memory address into a plurality of input memory address segments and Encrypting each input memory address segment of the plurality of input memory address segments depending on a respective one of a plurality of cryptographic sub-keys to obtain the encrypted memory address, wherein encrypting the input memory address segment involves applying an image comprising the input memory address segment to an encrypted memory address segment of a plurality of encrypted memory addresses by performing a multiplication and modulo operation using one of the plurality of cryptographic sub-keys and one of a plurality of divisors so that the mapping is bijective, wherein the encrypted memory address segments of the plurality of encrypted memory address segments together form the encrypted memory address. Procedure according to Claim 11 wherein each of the plurality of input memory address segments indicates a polynomial of a first group of polynomials, each of the plurality of encrypted memory address segments indicating a polynomial of a second group of polynomials, each of the plurality of cryptographic sub-keys indicating a third polynomial, and each of the plurality of divisors displays a fourth polynomial as an irreducible polynomial Procedure according to Claim 11 or 12th wherein performing the multiplication and modulo operation further uses one or more bits of the input memory address other than bits of the input memory address segment that is being mapped. Computer program for implementing the method according to Claim 11 if the same is done by a computer or signal processor.

Images