JP2006171598A - Parallel encrypting and decoding device for aes - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a parallel encrypting and decoding device which can make encrypting and decoding at the same time at high speed by using the AES system. <P>SOLUTION: This encrypting and decoding device has an operation data storage 501 for holding the operation data; a key data storage 502 to store the key data constructed to attach a flag to the common key when encrypting, and to the last of the expansion key when decoding; and as many input controllers 600 as the operation channels to control the data input. Further, it has an input channel selector 511 to choose the channel to perform operations; a flag judging section 521 to perform flag judging of the key data; an operation section 531 to perform the AES operation; a flag attaching section 551 to attach a flag to the key data; an operation control unit 611 to issue instructions to the operation section 531; an output channel selector 541 to chooses the channel to output the data, and a channel controller 601 to issue instructions of the selected channel. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention is an encryption / decryption process for performing encryption or decryption processing on a plurality of streams in a time-sharing manner using an AES encryption method selected as a next-generation common key encryption instead of the current US standard DES. Relates to the device.

  In recent years, the digitization of TV broadcasts and the provision of content using storage media such as CDs and DVDs and networks have rapidly spread. However, from the viewpoint of protecting the copyright of the provided content, the confidentiality of data has been reduced. There is a demand for a data encryption method for securing the data.

  In addition, in order to realize an encryption method, not only security but also high speed encryption processing and simple implementation are required.

  In a general configuration of such an encryption method, data to be encrypted is divided into fixed-size blocks, and each block is subjected to data disturbance processing based on a predetermined encryption key to generate a ciphertext. .

  One such encryption method is an AES (Advanced Encryption Standard) cipher established as the next generation standard cipher in the United States.

  AES is a block cipher in which one operation unit is 128 bits. FIG. 9 shows the encryption algorithm.

  As shown in FIG. 9, the AES encryption algorithm is composed of a part 000 for repeatedly performing round operations 001 and EXOR002 and a part for performing the extended key schedule 100.

  In round operation 001 performed Nr times, data randomization processing is performed. In EXOR002 performed Nr + 1 times before and after round operation 001, EXOR processing with the expanded key created in expanded key schedule 100 is performed.

  In the extended key schedule 100, extended keys W (0) to W (4 × Nr + 3) are created based on the common key.

  Each extended key is 32 bits, W (0) to W (Nk-1) are obtained by dividing the common key by 32 bits, and W (Nk) and thereafter are calculated in order.

  For example, when obtaining W (x + Nk), calculation is performed using W (x + Nk-1) and W (x) (see FIG. 11).

  Further, the expanded key can be operated in the reverse direction. For example, W (x−Nk) is obtained by performing an operation using W (x) and W (x−1) (see FIG. 12). reference).

  FIG. 10 shows the values of Nr and Nk.

  For example, if Nk extended keys from W (x + 1) to W (x + Nk) are known, after W (x + Nk + 1), W (x + Nk + 1) is obtained from W (x + 1) and W (x + Nk), and W (x + 2) And W (x + Nk + 1) is obtained from W (x + Nk + 1), and so on.

  On the other hand, before W (x), W (x) is obtained from W (x + Nk-1) and W (x + Nk), and W (x-1) is obtained from W (x + Nk-2) and W (x + Nk-1). You can ask for it.

  From the above, if there are Nk consecutive extended keys, all the extended keys can be obtained from those extended keys.

  As shown in FIG. 12, a combination of Nk from the back of the expanded key is called a decryption key.

  The number of bits of the decryption key is always the same as that of the common key.

  FIG. 13 is a block diagram illustrating an example of an encryption circuit that performs AES encryption / decryption (see, for example, Patent Document 1).

  In FIG. 13, the encryption circuit includes 200 blocks that perform round operation and EXOR, 300 blocks that perform an extended key schedule, and a control unit 400.

  In the block of 200, the following processing is performed.

  First, the operation data is selected by the selector unit 201, and the EXOR unit 202 performs the first EXOR with the expanded key and holds it in the intermediate value holding unit 203.

  Next, the value held in the intermediate value holding unit 203 is rounded by the round calculating unit 205, selected by the selector unit 201, EXORed with the expanded key by the EXOR unit 202, and again the intermediate value holding unit 203. Is held Nr times.

  Finally, the calculation result held in the intermediate value holding unit 203 is output as output data.

  In parallel with the processing of 200 blocks, the extended key schedule is performed with 300 blocks.

  60 extended keys are required when the key length is 256 bits and 48 even when the key length is 128 bits. If all of these keys are held, the circuit scale becomes large.

  Therefore, only Nk extended keys are held at one time, and the extended keys necessary for the EXOR unit 202 are calculated in order.

  At the time of encryption, the following processing is performed in 300 blocks.

  First, a common key is selected by the selector unit 301 and held in the extended key holding unit 303.

  Next, in order to create an extended key necessary for the 200 blocks, the value held in the extended key holding unit 303 is calculated by the extended key calculating unit 305 and selected by the selector unit 301 as necessary. Then, it is held in the expanded key holding unit 303 again.

  At the time of decryption, basically the same processing as at the time of encryption is performed, but first, it is necessary to calculate the decryption key from the common key.

  It uses the expanded keys in the order of W (0) to W (3) and then W (4) to W (7) at the time of encryption, whereas W (4 This is because the expanded keys are used in the reverse order of the ciphers of × Nr) to W (4 × Nr + 3) and then W (4 × Nr−4) to W (4 × Nr−1).

  At the time of decryption, first, a common key is selected by the selector unit 301 and held in the extended key holding unit 303.

  Next, the process of calculating the value held in the extended key holding unit 303 by the extended key calculating unit 305, selecting it by the selector unit 301, and holding it again in the extended key holding unit 303 is repeated until the extended key is reached. To obtain a decryption key.

  The decryption key obtained by the calculation is held in the decryption key holding unit 304, and the value held in the decryption key holding unit 304 first is loaded into the extended key holding unit 303 from the next calculation. Thereby, the process of calculating the decryption key from the common key at the beginning of the calculation can be omitted.

  After the decryption key is held in the extended key holding unit 303, as in the case of encryption, the value held in the extended key holding unit 303 is calculated by the extended key calculation unit 305 as necessary, and the selector unit 301 A process of selecting and holding the expanded key holding unit 303 again is performed. However, the calculation in the expanded key calculation unit 305 is reverse to the encryption.

  The control unit 400 determines whether to perform encryption or decryption based on the encryption mode instruction signal, receives an operation command signal, starts operation, and sends a control signal to the 200 and 300 blocks.

  In Patent Document 1, in order to reduce the circuit scale, the round calculation unit 205 and the extended key calculation unit 305 perform calculations by 32 bits, or the calculation of the round calculation unit 205 is performed in two cycles. is doing.

In Patent Document 1, the number of cycles for a 128-bit operation is as shown in FIG.
JP 2003-15522 A

  However, conventionally, there has been no apparatus that performs AES encryption / decryption processing in a time division manner on a plurality of streams.

  Even if encryption / decryption is not performed in a time-sharing manner, it is possible to perform encryption / decryption of a plurality of streams by placing the encryption circuit of FIG. 13 as many as the number of streams, but this increases the circuit scale too much.

  In order to reduce the circuit scale, it is necessary to perform encryption / decryption on a plurality of streams in a time-sharing manner using a single encryption circuit. For this reason, a mechanism for smoothly switching between streams for encryption / decryption is required.

  In the encryption circuit of FIG. 13, the decryption key must be calculated every time the common key is changed during decryption. For this reason, when the stream to be operated is frequently switched in a time division manner, the decryption key must be frequently calculated, so that there is a problem that the calculation performance is greatly reduced (except when only encryption is performed). .

  In order to solve the above problems, the encryption / decryption processing device of the present invention performs ch0 to chN-1 corresponding to N streams in order to perform encryption or decryption processing on N streams in a time-sharing manner. A calculation data holding unit that holds calculation data that is data of the stream that has N channels and is input for each calculation unit, and a key that holds key data set to perform encryption or decryption of the stream A data holding unit, an input control unit for controlling data input to the calculation data holding unit and the key data holding unit for each channel, the calculation data held in the calculation data holding unit, and the key data holding unit The input channel selection unit that selects the channel data corresponding to the stream to be encrypted / decrypted from the key data held in the The encryption / decryption process is performed using the flag determination unit that determines the flag information included in the key data, the calculation data selected by the input channel selection unit, and the determination result of the flag determination unit. A calculation unit to perform, a flag adding unit for adding a flag to the output key data output from the calculation unit, using a result of determination by the flag determination unit, and output at the end of the calculation by the calculation unit An output channel selection unit that outputs the output data and the output key data to which the flag output from the flag addition unit is assigned by selecting the same channel as the channel selected by the input channel selection unit; and the input channel A channel control unit that sends an instruction of the selected channel to the selection unit and the output channel selection unit.

  The key data held in the key data holding unit is assumed to have a flag indicating encryption processing added to a common key when performing encryption, and a decryption key (after the extended key created from the common key) when performing decryption. Nk is defined as a decryption key (the value of Nk is determined so that the number of bits of the common key and the decryption key is the same) and a flag for indicating the decryption process is given.

  The calculation unit performs encryption or decryption using the result of determining the flag in the key data and the data excluding the flag, that is, the common key for encryption and the decryption key for decryption.

  As described above, according to the present invention, encryption or decryption processing can be performed on a plurality of streams in a time division manner using a single encryption circuit.

  Further, since the decryption key is given to the encryption circuit at the time of decryption, the computation performance is not deteriorated for the decryption key computation, and the decryption key is held in the encryption circuit with the decryption key holding unit 304 as shown in FIG. Therefore, the circuit scale can be reduced by that much.

(Embodiment 1)
FIG. 1 is a block diagram of an encryption / decryption processing apparatus according to Embodiment 1 of the present invention.

  FIG. 2 is a configuration example using the encryption / decryption processing apparatus shown in FIG.

  First, how to use the encryption / decryption processing apparatus will be described with reference to FIG.

  In FIG. 2, the stream for performing the encryption / decryption process is given via the network through the communication control device 30 or given from the HDD 50.

  These streams are once placed in the buffer 10 and input to the encryption / decryption processing device 02 in order of 128 bits.

  Data that has been encrypted or decrypted by the encryption / decryption processing device 02 is placed in the buffer 10 again.

  The encrypted / decrypted stream data placed in the buffer 10 is output to the TV 70 through the decoder 60, output to the HDD 50, or transmitted to the network through the communication control device 30.

  The processor 20 performs control of data transferred on the internal bus 01 and control of the encryption / decryption processing device 02 (processing such as key setting).

  In the configuration of FIG. 2, for example, when the content transmitted via the network and the content stored in the HDD (both encrypted with the AES cipher) are simultaneously reproduced, the encryption / decryption processing device 02 generates two streams. On the other hand, decoding is performed in a time division manner.

  Next, details of the encryption / decryption processing device 02 will be described with reference to FIG.

  The encryption / decryption processing device 02 includes eight units: an input control unit 600, a channel control unit 601, an operation control unit 611, an input channel selection unit 511, a flag determination unit 521, an operation unit 531, a flag assignment unit 551, and an output channel selection unit 541. Consists of

  In the encryption / decryption processing device 02, as shown in FIG. 3, a key used for encryption / decryption is assigned a common key for encryption and a decryption key with a flag indicating whether encryption / decryption is performed.

  Therefore, the following key operations are performed.

  As explained in the background section, all the expanded keys are obtained once during the encryption process.

  Therefore, a decryption key can be obtained in the middle of performing the encryption process using the common key, and a common key can be obtained in the middle of performing the decryption process using the decryption key.

  Utilizing this, the ciphertext has a key with a decryption flag added to the decryption key obtained when performing the encryption processing, and conversely, the plaintext that is not encrypted indicates the cipher in the common key An operation is performed in which a key with a flag is given.

  The input control unit 600 has a calculation data holding unit 501 that holds calculation data and a key data holding unit 502 that holds key data, and there are N same ones (N is the time-division processing by the encryption / decryption processing device 02). The upper limit of the number of streams that can perform encryption / decryption processing is an integer of 2 or more.

  In FIG. 1, the input controller for ch0 is 600a and the input controller for ch1 is 600b, which are the same.

  Here, the operation data is data obtained by dividing the stream by 128 bits, which is an encryption / decryption unit, and is sequentially set every time encryption / decryption processing is performed.

  Further, as shown in FIG. 3, the key data is obtained by adding a flag indicating which encryption / decryption is performed to the common key during encryption and to the decryption key during decryption.

  This key data is set only once before performing the encryption / decryption processing (set by the processor in the example of FIG. 2), and thereafter held in the key data holding unit 502 until the encryption / decryption of the stream is completed.

  The input control unit 600 exchanges signals with the channel control unit 601.

  The signal output from the input control unit 600 is an operation request signal, and this signal is output when both operation data and key data are set and the operation is ready.

  The signal output from the channel control unit 601 is a data use signal. This signal is used when the calculation data is used (when calculation data is input to the calculation unit 531), to the input control unit 600 of the channel using the calculation data. Is output.

  The channel control unit 601 controls a channel for performing encryption / decryption processing.

  For this purpose, a selection signal for selecting a computation channel is output to the input channel selection unit 511 and the output channel selection unit 541.

  In addition, when there is a channel that can be calculated, a calculation request signal is output to the calculation control unit 611, and the calculation control unit 611 outputs a calculation start signal and a calculation end signal, respectively, when the calculation starts and ends at the calculation unit 531. Receive.

  The input channel selection unit 511 selects calculation data and key data of a specific channel from the calculation data and key data of each channel output from the input control unit 600, and the calculation data is calculated. The key data is output to the flag determination unit 521 in the unit 531.

  The flag determination unit 521 determines whether to perform encryption or decryption from the flag value in the key data, and outputs an encryption mode instruction signal for instructing the arithmetic unit 531 to perform encryption or decryption.

  Further, the key data excluding the flag is output to the calculation unit 531.

  The calculation control unit 611 receives the calculation request signal from the channel control unit 601, issues a calculation command signal to the calculation unit 531, and instructs the calculation.

  The arithmetic unit 531 executes the encryption / decryption process, and outputs the result to the output channel selection unit 541 as output data.

  FIG. 4 is a block diagram showing the calculation unit 531.

  Although the configuration is almost the same as that in FIG. 13, the major difference is that there is no decryption key holding unit 304 in FIG. 13 and that the key data input to the block 300 is a decryption key at the time of decryption.

  In FIG. 4, the encryption circuit includes 200 blocks that perform round operation and EXOR, 300 blocks that perform an extended key schedule, and a control unit 500.

  In the block of 200, the following processing is performed.

  First, the operation data is selected by the selector unit 201, and the EXOR unit 202 performs the first EXOR with the expanded key and holds it in the intermediate value holding unit 203.

  Next, the value held in the intermediate value holding unit 203 is rounded by the round calculating unit 205, selected by the selector unit 201, EXORed with the expanded key by the EXOR unit 202, and again the intermediate value holding unit 203. Is held Nr times.

  Finally, the calculation result held in the intermediate value holding unit 203 is output as output data.

  In the block of 300, the following processing is performed.

  First, key data is selected by the selector unit 301 and held in the expanded key holding unit 303.

  Next, in order to create an extended key necessary for the 200 blocks, the value held in the extended key holding unit 303 is calculated by the extended key calculating unit 305 and selected by the selector unit 301 as necessary. Then, it is held in the expanded key holding unit 303 again.

  The control unit 500 determines whether to perform encryption or decryption based on the encryption mode instruction signal, receives an operation command signal, starts operation, and sends a control signal to the blocks 200 and 300.

  In the blocks 200 and 300, the same processing is performed during encryption and decryption, but the calculations in the round calculation unit 205 and the extended key calculation unit 305 are reversed.

  At the time of encryption, the common key is first held in the extended key holding unit 303, the extended key calculation is executed in order, and finally the decryption key is held.

  At the time of decryption, the common key is held last.

  This data is output together with the output data as output key data.

  The flag assigning unit 551 receives the output key data from the computing unit 531 and assigns a flag thereto.

  At this time, if the encryption / decryption mode instruction signal is encryption, a decryption key is received as output key data, so that a flag indicating decryption is given. If the encryption / decryption mode instruction signal is decryption, a flag indicating encryption is assigned.

  The output key data to which the flag is added is output to the output channel selection unit 541.

  The output channel selection unit 541 outputs output data and output key data from a specific channel using the selection signal.

  In the first embodiment of the present invention, the encryption / decryption processing of the stream is performed in the following flow.

  First, a key is set in the input control unit 600 of the channel that performs encryption / decryption processing.

  Next, the operation data of the stream to be processed is input 128 bits at a time from the head to the input control unit 600 of the channel that performs the encryption / decryption process.

  When the calculation data input to the input control unit 600 is used for the encryption / decryption processing by the calculation unit 531, a data use signal is sent from the channel control unit 601, and when the signal is received, 128-bit calculation data is again received. Is input to the input control unit 600.

  This process is repeated until there is no more data to calculate.

  The calculation data and key data input to the input control unit 600 are selected by the input channel selection unit 511 and sent to the calculation unit 531 and the flag determination unit 521, respectively.

  The flag determination unit 521 generates an encryption mode instruction signal from the flag in the key data and sends it to the calculation unit 531.

  Further, the key data excluding the flag is also sent to the calculation unit 531.

  Upon receiving the calculation command signal from the calculation control unit 611, the calculation unit 531 performs a calculation using the sent calculation data, encryption mode instruction signal, and key data (except for the flag), and uses the result as output data. The data is sent to the output channel selection unit 541.

  The computing unit 531 also outputs output key data together with the output data.

  The output key data is given a flag by the flag assigning unit 551 and sent to the output channel selecting unit 541.

  The output channel selection unit 541 outputs output data and output key data from the channel selected by the input channel selection unit 511 based on the selection signal sent from the channel control unit 601.

  Since the output key data is the same data every time, it may be received once at the beginning or end of the encryption / decryption process.

  In the first embodiment of the present invention, the encryption / decryption process is controlled by the input control unit 600, the channel control unit 601, and the arithmetic control unit 611. 5 to 7 show flowcharts of the respective control units.

  FIG. 5 shows a flowchart of processing performed by the input control unit 600.

  The input control unit 600 is provided for each channel, and each performs the following processing independently.

  First, as shown in step S100, the process waits for a key to be set in the key data holding unit 502 by a processor or the like.

  Next, as shown in step S <b> 110, the process waits for calculation data to be input to the calculation data holding unit 501.

  When the calculation data is input, the processes shown in step S120 and step S130 are performed.

  That is, the next computation data input prohibition process is performed, and a computation request signal is sent to the channel controller 601.

  Then, as shown in step S140, it waits for a data use signal to be sent from the channel controller 601.

  When the data use signal is sent, as shown in step S150, the input prohibition of the operation data is canceled, and as shown in step S160, if there is no operation data for performing the encryption / decryption process, the process is terminated. If it remains, it returns to step S110 and repeats the said process.

  FIG. 6 shows a flowchart of processing performed by the channel control unit 601.

  First, as shown in step S200, it waits for an operation request signal to be issued from the input control unit 600 of any channel.

  Next, as shown in step S210, it is determined whether there are a plurality of channels for which calculation request signals are output. If there are a plurality of channels, the channels for which calculation request signals are output in the priority determination processing in step S220. The channel with the highest priority is determined.

  The priority is determined by, for example, a method of increasing the channel for which the calculation request signal has been sent earlier.

  Next, as shown in step S230, the input channel selection unit 511 and the output channel selection unit 541 are selected so as to select the channel (the channel determined in step S220 when there are multiple channels) from which the calculation request signal is issued. Give a signal.

  Next, the process of step S240 for outputting the calculation request signal to the calculation control unit 611 is performed, and the process waits for a calculation start signal sent from the calculation control unit 611 as shown in step S250.

  Next, the process of step S260 for outputting a data use signal is performed to the input control unit 600 of the channel selected in step S230, and the process waits for an operation end signal to be sent from the operation control unit 611.

  When the calculation end signal is sent, the process returns to step S200 and the above processing is repeated.

  FIG. 7 shows a flowchart of processing performed by the arithmetic control unit 611.

  First, as shown in step S300, it waits for an operation request signal to be issued from the channel control unit 601.

  Next, the processes shown in step S310 and step S320 are performed.

  That is, a calculation command signal is sent to the calculation unit 531 and a calculation start signal is sent to the channel control unit 601.

  Next, as shown in step S330, the process waits for the calculation cycle of the calculation unit 531 and performs a process of sending a calculation end signal to the channel control unit 601 in step S340.

  Then, the process returns to step 300 and the above processing is repeated.

  FIG. 8 shows an example of control in each control unit described above.

  In FIG. 8, encryption / decryption processing is performed on two channels, ch0 and ch1, and operation data is input to ch0 at timing 900 and to ch1 at timing 901.

  The control flow shown in FIG. 8 is shown below.

  First, at 900, operation data is input to ch0.

  Upon receiving the operation data input at 900, the ch0 input control unit 600a sends an operation request signal to the channel control unit 601 (step S130 in FIG. 5).

  Upon receiving the calculation request signal in 910, the channel control unit 601 sends the calculation request signal to the calculation control unit 611 (step S240 in FIG. 6).

  Upon receiving the calculation request signal in 920, the calculation control unit 611 sends a calculation command signal to the calculation unit 531 and a calculation start signal to the channel control unit 601, and waits until the calculation cycle of the calculation unit 531 ends (step S310 in FIG. 7). 320).

  Receiving the calculation command signal in 930, the calculation unit 531 starts calculation of ch0.

  Further, the channel control unit 601 that has received the calculation start signal in 940 sends a data use signal to the input control unit 600a of ch0 (step S260 in FIG. 6).

  Receiving the data use signal at 950, the ch0 input control unit 600a returns to the state of waiting for the calculation data input again (step S110 in FIG. 5).

  The computation control unit 611 that has completed the computation cycle waiting process in 960 sends a computation end signal to the channel control unit 601 (step S340 in FIG. 7).

  The computing unit 531 that has finished computation in 970 outputs output data.

  This completes the processing for the data input to ch0 in 900.

  In FIG. 8, operation data is also input to ch1 in 901.

  In response to the calculation data input in 901, the ch1 input control unit 600b sends a calculation request signal to the channel control unit 601 (step S130 in FIG. 5).

  The channel control unit 601 that has received the calculation request signal in 980 is in a state of waiting for the calculation end signal being sent from the calculation control unit 611. Therefore, after waiting for the calculation end signal in 990, the calculation control unit An operation request signal is sent to 611 (step S240 in FIG. 6).

  After that, the control for the calculation of ch1 is performed in the same manner as ch0.

  As described above, the encryption / decryption processing apparatus according to Embodiment 1 uses the input control unit 600, the channel control unit 601, and the calculation control unit 611 to perform encryption or decryption of a stream of a plurality of channels in a time division manner.

  Also, operate the key so that the ciphertext has a decryption key + decryption flag, and the unencrypted plaintext has a common key + encryption flag, and determine the encryption mode from the key flag value. By having a flag determination unit 521 for performing encryption and a calculation unit 531 that uses a common key for encryption and a decryption key for decryption, processing can be performed without degrading performance even when a channel for encryption or decryption frequently changes. Is possible.

  According to the encryption / decryption processing apparatus of the present invention, encryption or decryption can be performed simultaneously and at high speed on a plurality of streams.

  The AES encryption method is an encryption method that is expected to become popular in the future, and performs processing such as playback and recording of data encrypted / decrypted with AES, transfer to HDDs, optical discs and other smart media, and transmission / reception via a network. The present invention is useful when done simultaneously.

The block diagram of the encryption / decryption processing apparatus in Embodiment 1 of this invention The figure which shows an example of the block diagram using the encryption / decryption processing apparatus in Embodiment 1 of this invention. The figure which shows the structure of the key data in Embodiment 1 of this invention The block diagram of the calculating part in Embodiment 1 of this invention The flowchart of the input control part in Embodiment 1 of this invention Flowchart of channel control unit in Embodiment 1 of the present invention Flowchart of calculation control unit in Embodiment 1 of the present invention The figure which shows an example of control of each control part in Embodiment 1 of this invention Diagram showing AES encryption algorithm The figure which shows the value of Nr and Nk in an AES encryption system Diagram showing how to obtain an expanded key Diagram showing how to find extended keys in reverse order The figure which shows the conventional AES encryption circuit The figure which shows the calculation cycle of patent document 1

Explanation of symbols

DESCRIPTION OF SYMBOLS 201 Selector part 202 EXOR part 203 Intermediate value holding | maintenance part 205 Round calculating part 301 Selector part 303 Extended key holding part 304 Decryption key holding part 305 Extended key calculating part 400 Control part 501a Calculation data holding part (ch0)
502a Key data holding unit (ch0)
511 Input channel selection unit 521 Flag determination unit 531 Operation unit 541 Output channel selection unit 551 Flag assignment unit 600a Input control unit (ch0)
600b Input control unit (ch1)
600c Input control unit (ch2)
601 Channel control unit 611 Operation control unit

Claims (9)

An encryption / decryption processing device that performs encryption or decryption processing in a time-sharing manner on N (N is an arbitrary integer greater than or equal to 2) streams,
It has N channels of ch0 to chN-1 corresponding to N streams,
A calculation data holding unit that holds calculation data that is data of the stream input by one calculation unit;
A key data holding unit that holds key data set to perform encryption or decryption of the stream;
An input control unit for controlling data input to the calculation data holding unit and the key data holding unit for each channel;
An input channel selection unit that selects data of a channel corresponding to a stream to be encrypted / decrypted from among the calculation data held in the calculation data holding unit and the key data held in the key data holding unit;
A flag determination unit for determining flag information included in the key data selected by the input channel selection unit;
A calculation unit that performs encryption or decryption using the calculation data selected by the input channel selection unit and the result of determination by the flag determination unit;
A flag assigning unit that assigns a flag to the output key data output from the arithmetic unit using a result of the determination performed by the flag determining unit;
Select the same channel as the channel selected by the input channel selection unit and output the output data output at the end of the calculation by the calculation unit and the output key data to which the flag output from the flag addition unit is output. An output channel selector to perform,
A channel controller that sends an instruction of a selected channel to the input channel selector and the output channel selector;
An encryption / decryption processing apparatus comprising: The input control unit further includes:
Calculation state identifying means for identifying whether the calculation data is held in the calculation data holding unit and the key data is set in the key data holding unit and is in an operable state;
2. The encryption / decryption processing apparatus according to claim 1, further comprising calculation data input determination means for determining whether calculation data can be input to the calculation data holding unit. The channel control unit further includes:
Channel priority determining means for determining the priority of each channel;
2. A channel selection unit that selects a channel to perform a next calculation using the channel priority determination unit each time the calculation process in the calculation unit is completed once. Item 3. The encryption / decryption processing device according to Item 2. When Nk pieces (Nk is the same number of bits as the common key) from the back of the extended key created from the common key are defined as decryption keys,
The key data held in the key data holding unit is
When performing encryption, it is assumed that a flag indicating encryption processing is added to the common key,
When decrypting, use the decryption key
The encryption / decryption processing apparatus according to any one of claims 1 to 3, wherein a flag indicating a decoding process is added. From the key data,
Key data dividing means for dividing the flag and the common key or the decryption key;
Flag determining means for determining whether to perform encryption or decryption from the flag divided by the key data dividing means;
The encryption / decryption processing apparatus according to claim 4, further comprising: The computing unit is
Based on the information determined by the flag determination means,
Performing encryption or decryption using the common key or decryption key divided by the key data dividing means,
When performing encryption using a common key,
6. The encryption / decryption processing apparatus according to claim 5, wherein when the decryption is performed using the decryption key, the encryption key is output together with the operation result. The encryption / decryption method of the stream is:
6. The encryption / decryption processing apparatus according to claim 5, wherein the key length is 128 bits, 192 bits, or 256 bits of AES encryption. An encryption / decryption processing method for performing encryption or decryption processing in a time-sharing manner on N (N is an arbitrary integer greater than or equal to 2) streams,
It has N channels of ch0 to chN-1 corresponding to N streams,
A calculation data holding step for holding calculation data that is data of the stream input by one calculation unit;
A key data holding step for holding key data set to perform encryption or decryption of the stream;
An input channel selection step of selecting data of a channel corresponding to a stream to be encrypted / decrypted from among the calculation data held in the calculation data holding step and the key data held in the key data holding step;
A flag determination step for determining flag information included in the key data selected in the input channel selection step;
A calculation step of performing encryption or decryption using the calculation data selected in the input channel selection step and the result of determination in the flag determination step;
A flag granting step for giving a flag to the output key data created in the calculation step using the result of the judgment in the flag judgment step;
The output data created at the end of the computation in the computation step and the output key data with the flag created from the flag assignment step are selected by selecting the same channel as the channel selected in the input channel selection step. An encryption / decryption processing method comprising: an output channel selection step to perform. A program for causing a computer to execute encryption or decryption processing in a time-sharing manner for N (N is an arbitrary integer of 2 or more) streams,
It has N channels of ch0 to chN-1 corresponding to N streams,
A calculation data holding procedure for holding calculation data that is data of the stream input by one calculation unit;
A key data holding procedure for holding key data set to perform encryption or decryption of the stream;
An input channel selection procedure for selecting data of a channel corresponding to a stream on which encryption / decryption processing is performed, from among the computation data retained in the computation data retention procedure and the key data retained in the key data retention procedure;
A flag determination procedure for determining flag information included in the key data selected in the input channel selection procedure;
A calculation procedure for performing encryption or decryption using the calculation data selected in the input channel selection procedure and the result of determination in the flag determination procedure;
A flag assignment procedure for assigning a flag to the output key data created by the calculation procedure using the result of the determination in the flag determination procedure;
Select the output channel created at the end of computation in the computation procedure and the output key data attached with the flag created from the flag assignment procedure by selecting the same channel as the channel selected in the input channel selection procedure. The output channel selection procedure to be performed,
An encryption / decryption processing program.

Images