JP2008048271A - Data processing apparatus and data transfer system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To efficiently encrypt data flowing on a PCI bus without complicating processing and deteriorating performance, and to keep encryption strength. <P>SOLUTION: Upon receiving access from a PCI master device 1, a burst detecting section 14 of a PCI target device 10 detects whether or not the access is burst access. If it is burst write access, a selector 15 selects an output of a 128-bit decrypting section 13, and if it is a single write access, the selector 15 selects an output of a 32-bit decrypting section 12. Similarly, if it is burst read access, a selector 20 selects an output of a 128-bit encrypting section 19, and if it is single read access, the selector 20 select an output of a 32-bit encrypting section 18. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a data processing apparatus and a data transfer system that perform predetermined processing on data transferred via a PCI bus.

  Various functions for data processing are built in the multifunction peripheral, and data exchange between the functions is performed via the PCI bus. A large amount of data such as image data may flow on the PCI bus, and data in units of bytes such as PCI device setting information may also flow. In general, if the encryption unit is large, the encryption strength becomes strong. However, if the encryption unit is large, there is a problem that data in byte units cannot be encrypted.

  By the way, conventionally, in order to improve the security level in the information communication processing, a plurality of encryption / decryption means are used according to some rule set by the user, for example, a rule such as switching the encryption method for each session. A technique for selecting an encryption means from an encryption method table in which the above is tabulated has been proposed (see, for example, Patent Document 1).

JP-A-9-149023

  The present invention provides a data processing apparatus capable of efficiently encrypting data flowing on the PCI bus and maintaining the encryption strength without increasing the complexity of processing and degrading performance. And it aims at providing a data transfer system.

  To achieve the above object, a data processing apparatus according to the first aspect of the present invention is a data processing apparatus that transfers data via a PCI bus, and includes a plurality of encryption units each having a different encryption method, A data access method determining unit for determining a data access method from another data device connected via the PCI bus; and the plurality of encryptions based on the data access method determined by the data access method determining unit. Selecting means for selecting an encryption means to be used for encrypting data from the means, and the encryption means selected by the selection means is based on its own encryption method, the other means Data to be transferred to the data device is encrypted.

  According to a second aspect of the present invention, in the data processing device according to the first aspect, the plurality of decoding means each having a different decoding method and the selecting means are the data access determined by the data access method determining means. Based on the method, the decryption unit used for decrypting the encrypted data is selected from the plurality of decryption units, and the decryption unit selected by the selection unit is based on its own decryption method. The encrypted data transferred from the other data device is decrypted.

  According to a third aspect of the present invention, in the data processing device according to the second aspect, the data processing device further includes a data size determining unit that determines a data size of data to be transferred to the other data device, and the selecting unit includes the data Based on the data size determined by the size determination means, an encryption means used for encrypting data is selected from the plurality of encryption means.

  According to a fourth aspect of the present invention, in the data processing apparatus according to the third aspect, the plurality of encryption units include at least a burst unit encryption unit and a one-word unit encryption unit, and the selection unit includes: When the data size determined by the data size determining means is less than a predetermined size, the encryption means used for encrypting the data from the plurality of encryption means in units of one word It is characterized by selecting as.

  According to a fifth aspect of the present invention, in the data processing apparatus according to the second aspect, the plurality of encryption units include at least one-word unit encryption units, and the data access method determined by the data access method determination unit However, at the time of read access, the data is encrypted using the one-word unit encryption means.

  According to a sixth aspect of the present invention, in the data processing device according to the second aspect, at least one of the data access methods is associated with a non-encryption method, and the data access method determined by the data access method determination unit is the data access method. When it corresponds to a non-encryption system, it is characterized by transferring unencrypted data as it is.

  According to a seventh aspect of the present invention, in the data processing device according to the first aspect, it is possible to set whether or not to use the plurality of encryption means for data encryption.

  In order to achieve the above object, a data processing apparatus according to an eighth aspect of the present invention is a data processing apparatus for transferring data via a PCI bus, each of which has a plurality of encryption units each having a different encryption method, Data to be transferred from the plurality of encryption means to the other data processing device based on a plurality of decryption means corresponding to the encryption method and a data size to be transferred to the other data processing device An encryption method selection means for selecting an encryption means for encrypting the data, and the other data processing apparatus from among the plurality of decryption means based on a data size to be received from the other data processing apparatus And a decryption method selection means for selecting a decryption means for decrypting the encrypted data.

  According to a ninth aspect of the present invention, in the data processing device according to the eighth aspect, the plurality of decoding means include at least a burst unit decoding unit and a one-word unit decoding unit, and the other data A disconnect detection unit configured to detect that the access from the processing device has been interrupted, and the decoding method selection unit, when the disconnect detection unit detects that the access has been terminated, The decryption means is selected from the decryption means in order to decrypt the encrypted data from the other data processing device.

  In order to achieve the above object, a data transfer system according to claim 10 is a transfer system for transferring data between a master device and a target device via a PCI bus, and the master devices are different from each other. Based on a plurality of first encryption means having an encryption method, a plurality of first decryption means corresponding to the encryption method, and a data size to be transferred to the target device, the plurality of first encryption means First selecting means for selecting a first encryption means for encrypting data to be transferred to the target device, and a data size to be received from the target device. A first decryption means for decrypting encrypted data from the target device among the plurality of first decryption means. And the target device includes a plurality of second encryption means each having a different encryption method, and a plurality of second decryption means corresponding to the encryption method. And a data access method determining means for determining a data access method from the master device, and based on the data access method determined by the data access method determining means, among the plurality of second decoding means, Based on the third selection means for selecting the second decryption means for decrypting the encrypted data transferred from the master device, and the data access method determined by the data access method determination means, the plural The second encryption means for encrypting data to be transferred to the master device is selected from the second encryption means. Characterized by comprising a fourth selection means.

  According to the present invention, the data access method discriminating means discriminates the data access method from another data device connected via the PCI bus, and the selecting means discriminates a plurality of data access methods based on the discriminated data access method. The encryption means used for encrypting the data is selected from the encryption means, and the selected encryption means should transfer the data to another data device based on its encryption method. Since the data is encrypted, the data flowing on the PCI bus can be efficiently encrypted and the encryption strength is maintained without increasing the complexity of processing and degrading the performance. The advantage that it can be obtained.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
A. First embodiment A-1. Configuration of First Embodiment FIG. 1 is a block diagram showing a configuration of a PCI device using a data processing apparatus according to a first embodiment of the present invention. In the figure, the PCI master device 1 and the PCI target device 10 encrypt data when transferring data. The PCI master device 1 includes a 32-bit encryption unit 2, a 128-bit encryption unit 3, a selector 4, a PCI I / F unit 5, a 32-bit decryption unit 6, a 128-bit decryption unit 7, and a selector 8. . Of course, a data processing system is also provided, but is omitted for the sake of simplicity.

  When transferring a small amount of data (word access) from the PCI master device 1 to the PCI target device 10, the 32-bit encryption unit 2 encrypts the data and outputs the data to the selector 4. When transferring a large amount of data (burst access) such as image data from the PCI master device 1 to the PCI target device 2, the 128-bit encryption unit 3 encrypts the data by 128-bit and selects the selector 4 Output to.

  The selector 4 selectively selects either the output of the 32-bit encryption unit 2, that is, the 32-bit encryption data, or the output of the 128-bit encryption unit 3, that is, the 128-bit encryption data, according to the data size to be transferred. Are output to the PCI I / F unit 5. More specifically, when the data size is 32-bit length, the 32-bit encrypted data output from the 32-bit encryption unit 2 is output to the PCI I / F unit 5 and the data size is 128-bit length. In this case, the 128-bit encrypted data that is output from the 128-bit encryption unit 3 is output to the PCI I / F unit 5.

  When data is transferred from the PCI master device 1 to the PCI target device 10 (write access), the PCI I / F unit 5 outputs the selector 4, that is, either 32-bit encrypted data or 128-bit encrypted data. One of them is output to the PCI target device 10. Also, the PCI I / F unit 5 determines whether the encrypted data from the PCI target device 10, in this case, 32-bit encrypted data, when transferring data from the PCI target device 10 to the PCI master device 1 (read access). , 128-bit encrypted data is output to the 32-bit decryption unit 6 and the 128-bit decryption unit 7. Which data length is specified at the time of read access from the PCI master device 1 to the PCI target device 2 is known on the PCI master device 1 side.

  The 32-bit decryption unit 6 decrypts the 32-bit encrypted data from the PCI master device 1 and outputs it to the selector 8. The 128-bit decryption unit 7 decrypts the 128-bit encrypted data from the PCI master device 1 and outputs it to the selector 8. The selector 8 selects either the output of the 32-bit decoding unit 6, that is, the 32-bit decoded data or the output of the 128-bit decoding unit 7, that is, the 128-bit decoded data according to the decoded data size. Is output to a circuit (not shown). More specifically, when the data size is 32-bit length, the 32-bit decoded data output from the 32-bit decoding unit 6 is output, and when the data size is 128-bit length, 128-bit decoding is performed. The 128-bit decoded data output from the unit 7 is output.

  The PCI master device 1 described above performs single write access (32-bit encrypted data) and performs large-capacity data such as image data when write-accessing a small-capacity data to the PCI target device 10. When write access is performed, burst write access (128-bit encrypted data) is performed. The same applies to read access.

  Next, the PCI target device 10 includes a PCI I / F unit 11, a 32-bit decoding unit 12, a 128-bit decoding unit 13, a burst detection unit 14, a selector 15, an output side I / F unit 16, an input side I / F. An F unit 17, a 32-bit encryption unit 18, a 128-bit encryption unit 19, and a selector 20 are provided.

  When data is transferred from the PCI master device 1 to the PCI target device 10 (write access as viewed from the master side), the PCI I / F unit 11 encrypts data from the PCI master device 1, in this case, 32 Either the bit encryption data or the 128-bit encryption data is output to the 32-bit decryption unit 12 and the 128-bit decryption unit 13. When the PCI I / F unit 11 transfers data from the PCI target device 10 to the PCI master device 1 (read access as viewed from the master side), the PCI I / F unit 11 outputs the selector 19, that is, 32-bit encrypted data. , 128-bit encrypted data is output to the PCI target device 10. Which data length is specified when the PCI master device 1 performs read access to the PCI target device 2.

  The 32-bit decryption unit 12 decrypts the 32-bit encrypted data supplied from the PCI I / F unit 11 from the PCI master device 1 and outputs the decrypted data to the selector 15. The 128-bit decryption unit 13 decrypts the 128-bit encrypted data supplied from the PCI I / F unit 11 from the PCI master device 1 and outputs the decrypted data to the selector 15. The burst detection unit 14 monitors the state of the control line of the PCI bus, detects whether the transferred data is a single access of 32 bits or a burst access of 128 bits, and detects the detection result. Output to selectors 15 and 20. Although details will be described later, the state of the FRAM signal (asserted or negated) indicating the start of one cycle when the IRDY signal indicating that the master side will transmit valid data is asserted is single access. Or whether it is a burst access.

  The selector 15 selects either the 32-bit decoded data decoded by the 32-bit decoding unit 12 or the 128-bit decoded data decoded by the 128-bit decoding unit 13 according to the detection result from the burst detection unit 14. Are selectively output to the output-side I / F unit 16. Specifically, in the case of single write access, the 32-bit decoded data output from the 32-bit decoding unit 12 is selected, and in the case of burst write access, the output of the 128-bit decoding unit 13 is selected. Certain 128-bit decoded data is selected.

  Next, the output side I / F unit 16 is connected to the network and outputs the encrypted data from the selector 15 to the network. The input-side I / F unit 17 is connected to the network, receives data from other devices on the network, and outputs the data to the 32-bit encryption unit 18 and the 128-bit encryption unit 19.

  The 32-bit encryption unit 18 performs 32-bit encryption on the data supplied from the input side I / F unit 17 and outputs the encrypted data to the selector 20. The 128-bit encryption unit 19 encrypts the data supplied from the input-side I / F unit 17 with 128 bits and outputs the encrypted data to the selector 20. According to the detection result from the burst detector 14, the selector 20 is either 32-bit encrypted data encrypted by the 32-bit encryption unit 18 or 128-bit encrypted data encrypted by the 128-bit encryption unit 19. Is selectively output to the PCI I / F unit 11. Specifically, in the case of single read access, the 32-bit encryption data encrypted by the 32-bit encryption unit 18 is selected, and in the case of burst read access, the encryption is performed by the 128-bit encryption unit 19. 128-bit encrypted data is selected.

A-2. Operation of the First Embodiment Next, the operation of the first embodiment will be described.

(1) Single Write Access FIG. 2 is a timing chart for explaining the operation (single write access) of the data processing apparatus according to the first embodiment. In the figure, CLK is a clock, AD is an address data and data signal, CBE is a command byte enable signal, FRAME is a frame signal, IRDY is an initiator ready signal, TRDY is a target ready signal, STOP is a stop signal, and PCI_DEVSEL is a device select signal. is there. In the figure, each signal is shown as active low. Therefore, it is asserted (valid) at a low level and negated (invalid) at a high level. Note that each signal conforms to signal transmission in a PCI device and is well known, and thus description thereof is omitted.

  The 32-bit data is encrypted and output from the PCI master device 1 side. At this time, since the PCI master device 1 side knows the size of the data to be sent out, it is encrypted by the 32-bit encryption unit 2 and output as 32-bit encrypted data via the selector 4 and the PCI I / F unit 5. . At this time, in the control line output from the PCI master device 1, FRAME is negated and IRDY is asserted at the first word access (timing A).

  On the PCI target device 10 side, since the burst detection unit 11 detects that FRAME is negated and IRDY is asserted at the timing A, it is recognized that single access is performed, and the selector 15 Thus, it is instructed to select the output of the 32-bit decoding unit 12.

  Next, when encrypted data from the PCI master device 1, in this case, 32-bit encrypted data is transferred (DAT in the figure), the PCI target device 10 side passes through the PCI I / F unit 11. The data is supplied to the 32-bit decoding unit 12 and the 128-bit decoding unit 13. In this case, since it is 32-bit encrypted data, the 32-bit decryption unit 12 decrypts the 32-bit encrypted data and outputs it to the selector 15. In the selector 15, the 32-bit decoded data that is the output of the 32-bit decoding unit 12 is selected according to the detection result from the burst detection unit 14 and is output to the output-side I / F unit 16. The output side I / F unit 16 outputs the 32-bit decoded data on the network.

(2) Burst Write Access FIG. 3 is a timing chart for explaining the operation (burst write access) of the data processing apparatus according to the first embodiment. In the figure, each signal is as described above. 128-bit data is encrypted and output from the PCI master device 1 side. At this time, since the PCI master device 1 side knows the size of the data to be sent out, it is encrypted by the 128-bit encryption unit 3 and output as 128-bit encrypted data via the selector 4 and the PCI I / F unit 5. . At this time, in the control line output from the PCI master device 1, FRAME is asserted and IRDY is asserted in the first word access (timing B).

  On the PCI target device 10 side, since the burst detection unit 11 detects that FRAME is asserted and IRDY is asserted at the timing B, it is recognized that the burst access is made, and the selector 15 is notified. Thus, it is instructed to select the output of the 128-bit decoding unit 13.

  Next, when encrypted data, in this case 128-bit encrypted data, is transferred from the PCI master device 1, the PCI target device 10 side receives a 32-bit decryption unit via the PCI I / F unit 11. This is supplied to the 12 and 128 bit decoder 13. In this case, since it is 128-bit encryption data, the 128-bit decryption unit 13 decrypts the 128-bit encryption data and outputs it to the selector 15. In the selector 15, the 128-bit decoded data that is the output of the 128-bit decoding unit 13 is selected according to the detection result from the burst detection unit 14 and is output to the output side I / F unit 16. The output side I / F unit 16 outputs the 128-bit decoded data on the network.

(3) Single Read Access FIG. 4 is a timing chart for explaining the operation (single read access) of the data processing apparatus according to the first embodiment. In the figure, each signal is as described above. In order to read-access 32-bit data, the PCI master device 1 negates FRAME by accessing the control line at the first word (timing C), and outputs IRDY by asserting.

  On the PCI target device 10 side, the burst detection unit 11 detects that FRAME is negated and IRDY is asserted at the timing A, so that it is recognized as single read access, and the selector 20 On the other hand, it is instructed to select the output of the 32-bit encryption unit 18.

  On the other hand, on the PCI target device 10 side, data from the input-side I / F unit 17, in this case, 32-bit data, is supplied to the 32-bit encryption unit 18 and the 128-bit encryption unit 19. In this case, since the data is 32-bit data, the 32-bit encryption unit 18 encrypts the 32-bit data and outputs it to the selector 20. In the selector 20, 32-bit encrypted data that is the output of the 32-bit encryption unit 18 is selected according to the detection result from the burst detection unit 14, and is output to the PCI I / F unit 11. The PCI I / F unit 11 transmits the 32-bit encrypted data to the PC master device 1 via the PCI bus.

  In the PC master device 1, the 32-bit encrypted data is received by the PCI I / F unit 5 and output to the 32-bit decryption unit 6 and the 128-bit decryption unit 7. In this case, since it is 32-bit encrypted data, it is decrypted by the 32-bit decryption unit 6 and selectively output to a circuit (not shown) by the selector 8.

(4) Burst Read Access FIG. 5 is a timing chart for explaining the operation (burst read access) of the data processing apparatus according to the first embodiment. In the figure, each signal is as described above. In order to read-access 128-bit data, the PCI master device 1 asserts FRAME and outputs IRDY by asserting the control line at the first word access (timing D).

  On the PCI target device 10 side, since the burst detection unit 11 detects that FRAME is asserted and IRDY is asserted at the timing A, it is recognized as burst read access, and the selector 20 On the other hand, it is instructed to select the output of the 128-bit encryption unit 19.

  On the other hand, on the PCI target device 10 side, data from the input-side I / F unit 17, in this case, 128-bit data, is supplied to the 32-bit encryption unit 18 and the 128-bit encryption unit 19. In this case, since it is 128-bit data, the 128-bit encryption unit 19 encrypts the 128-bit data and outputs it to the selector 20. In the selector 20, the 128-bit encrypted data that is the output of the 128-bit encryption unit 19 is selected according to the detection result from the burst detection unit 14 and is output to the PCI I / F unit 11. The PCI I / F unit 11 transmits the 128-bit encrypted data to the PC master device 1 via the PCI bus.

  In the PC master device 1, the 128-bit encrypted data is received by the PCI I / F unit 5 and output to the 32-bit decryption unit 6 and the 128-bit decryption unit 7. In this case, since it is 128-bit encrypted data, it is decrypted by the 128-bit decryption unit 7 and selectively output to a circuit (not shown) by the selector 8.

  According to the first embodiment described above, the encryption method for data flowing on the PCI bus is automatically switched according to the data size (single access or burst access) of one access unit. Data flowing on the PCI bus can be efficiently encrypted and the encryption strength can be maintained without increasing complexity and performance degradation.

B. Second Embodiment Next, a second embodiment of the present invention will be described.
In the first embodiment described above, the encryption method is switched according to the access method designated by the PCI master device 1 side. However, in the case of read access, the PCI master device 1 does not necessarily request the PCI target device 10 side. It is not necessarily compatible with the coming access method. For example, when the PCI master device 1 performs a 4-word burst access, there is only one word of data that the PCI target device 10 can output. Therefore, in the second embodiment, the PCI target device 10 side selects the encryption method according to the data size, not the encryption method based on the burst detection result.

B-1. Configuration of Second Embodiment Here, FIG. 6 is a block diagram showing a configuration of a PCI device using the data processing apparatus according to the second embodiment. It should be noted that portions corresponding to those in FIG. In the figure, in the PCI target device 10, the data size determination unit 21 determines the data size of data to be transmitted to the PCI master device 1 side at the time of read access, and outputs the determination result to the selector 20. The selector 20 automatically selects 32-bit encryption when the data size is less than 128 bits. The PCI master device 1 responds by a disconnection to the burst access. Further, in the PCI master device 1, the disconnect detection unit 9 detects the presence / absence of disconnection depending on whether or not the STOP signal during burst access is asserted. When disconnection is detected, the selector 8 is switched so that the 32-bit decoding unit 6 is selected.

B-2. Operation of the Second Embodiment Next, the operation of the second embodiment described above will be described. Since single write access and burst write access are the same as those in the first embodiment described above, description thereof will be omitted, and only single read access and burst read access will be described.

(1) Single Read Access The PCI master device 1 negates FRAME and asserts IRDY by accessing the control line with the first word access (timing C) to read-access 32-bit data.

  On the PCI target device 10 side, since the burst detection unit 11 detects that FRAME is negated and IRDY is asserted at the timing A, it is recognized that it is a single read access. On the other hand, 32-bit data from the input-side I / F unit 17 is supplied to the 32-bit encryption unit 18 and the 128-bit encryption unit 19. In this case, since the data is 32-bit data, the 32-bit encryption unit 18 encrypts the 32-bit data and outputs it to the selector 20. In the selector 20, the output of the 32-bit encryption unit 18 is selected, and 32-bit encrypted data is output to the PCI I / F unit 11. The PCI I / F unit 11 transmits the 32-bit encrypted data to the PC master device 1 via the PCI bus.

  In the PC master device 1, the 32-bit encrypted data is received by the PCI I / F unit 5 and output to the 32-bit decryption unit 6 and the 128-bit decryption unit 7. In this case, since the disconnect detection unit 9 does not detect a disconnect, the selector 8 selects the 32-bit decoded data decoded by the 32-bit decoding unit 6 and outputs it to a circuit (not shown).

(2) Burst read access The PCI master device 1 asserts FRAME and outputs IRDY by asserting the control line at the first word access (timing D) in order to read-access 128-bit data.

  On the PCI target device 10 side, since the burst detection unit 11 detects that FRAME is asserted and IRDY is asserted at the timing A, it is recognized that it is burst read access.

  Since it is burst read access, 128-bit data is supplied from the input-side I / F unit 17 to the 32-bit encryption unit 18 and the 128-bit encryption unit 19. In this case, since it is 128-bit data, the 128-bit encryption unit 19 encrypts the 128-bit data and outputs it to the selector 20. In the selector 20, since the data size is 32 bits, the output of the 32-bit encryption unit 18 is selected, and 32-bit encrypted data is output to the PCI I / F unit 11. The PCI I / F unit 11 transmits the 32-bit encrypted data to the PC master device 1 via the PCI bus.

  In the above data transfer, when the data size determination unit 21 determines that the data that can be output by the PCI target device 10 side is only one word, the STOP signal is asserted for the burst access by the PCI master device 1 and disconnection is performed. Reply with. In this case, the selector 20 automatically selects the output of the 32-bit encryption unit 18 and outputs the 32-bit encrypted data to the PCI I / F unit 11. The PCI I / F unit 11 transmits the 32-bit encrypted data to the PC master device 1 via the PCI bus.

  In the PCI master device 1, the disconnect detection unit 9 asserts the STOP signal during burst access and detects disconnection, so the selector 8 is switched to select the 32-bit decoding unit 6. As a result, the selector 8 selects the 32-bit decoded data decoded by the 32-bit decoding unit 6 and outputs it to a circuit (not shown).

  According to the second embodiment described above, even if the PCI target device 10 side is not necessarily compatible with the access method requested by the PCI master device 1, the encryption method is selected according to the data size. The data flowing on the PCI bus can be efficiently encrypted and the encryption strength can be maintained without increasing the complexity of processing and degrading the performance.

C. Third Embodiment Next, a third embodiment of the present invention will be described.
The third embodiment provides a configuration that greatly simplifies the circuit configuration, although the cryptographic strength is reduced only during read access as compared to the second embodiment described above. In the case of read access from the PCI master device 1, it is assumed that depending on the state of the PCI target device 10, it cannot respond to burst access. For example, when the processing speed of the PCI target device 10 is not in time for the request of the PCI master device 1, or when the data size is a fraction. Therefore, in the third embodiment, in consideration of the above, the 32-bit encryption is fixed only at the time of read access.

C-1. Configuration of Third Embodiment FIG. 7 is a block diagram showing a configuration of a PCI device using the data processing apparatus according to the third embodiment. It should be noted that portions corresponding to those in FIG. In the figure, the PCI master device 1 has a configuration in which the 128-bit decoding unit 7 and the selector 8 are removed. On the other hand, on the PCI target device 10 side, the 128-bit encryption unit 19 and the selector 20 are removed.

C-2. Operation of Third Embodiment Next, the operation of the third embodiment described above will be described. Since single write access and burst write access are the same as those in the first embodiment described above, description thereof will be omitted, and only single read access and burst read access will be described.

(1) Single Read Access and Burst Read Access When performing single read access, the PCI master device 1 negates FRAME and outputs IRDY by asserting the control line with the first word access. When burst read access is performed, FRAME is asserted and IRDY is output by asserting the control line at the first word access (timing D).

  In either case, on the PCI target device 10 side, the burst detection unit 11 negates FRAME and asserts IRDY, or asserts FRAME and asserts IRDY. It is recognized that the access is a read access or a burst read access. As a result, the 32-bit data from the input-side I / F unit 17 is encrypted by the 32-bit encryption unit 18 and output to the PCI I / F unit 11 as 32-bit encrypted data. The PCI I / F unit 11 transmits the 32-bit encrypted data to the PC master device 1 via the PCI bus.

  In the PC master device 1, the 32-bit encrypted data received by the PCI I / F unit 5 is decrypted by the 32-bit decrypting unit 6 and output as 32-bit decrypted data to a circuit (not shown).

  According to the third embodiment described above, since the encryption is fixed to 32-bit encryption only at the time of read access, although the encryption strength at the time of read access is reduced, the circuit configuration is greatly simplified. it can.

D. Fourth Embodiment Next, a third embodiment of the present invention will be described.
In the fourth embodiment, the encryption method is set in advance according to the data size. That is, when the data size is an integer multiple of 128 bits, the 128-bit encryption method may be used, and otherwise, the 32-bit encryption method may be used.

  According to the first to fourth embodiments described above, it is possible to efficiently encrypt data flowing on the PCI bus without increasing the complexity of processing and degrading the performance, and encryption. The strength can also be maintained.

Note that, as a modified example other than the first to fourth embodiments described above, whether to perform encryption may be switched by a data access method. That is, 128-bit encryption may be used for data transfer during burst access, and raw data may be transferred without encryption during single access.
As another modification, whether or not to use the encryption method may be set by the user according to the use of the system.

It is a block diagram which shows the structure of the PCI device using the data processor by 1st Embodiment of this invention. 6 is a timing chart for explaining the operation (single write access) of the data processing apparatus according to the first embodiment; 6 is a timing chart for explaining the operation (burst write access) of the data processing apparatus according to the first embodiment; 6 is a timing chart for explaining an operation (single read access) of the data processing apparatus according to the first embodiment; 6 is a timing chart for explaining the operation (burst read access) of the data processing apparatus according to the first embodiment; It is a block diagram which shows the structure of the PCI device using the data processor by this 2nd Embodiment. It is a block diagram which shows the structure of the PCI device using the data processor by this 3rd Embodiment.

Explanation of symbols

1 PCI master device 2 32-bit encryption unit (multiple encryption means, multiple first encryption means)
3 128-bit encryption unit (multiple encryption means, multiple first encryption means)
4 selector (encryption method selection means, first selection means)
5 PCI I / F unit 6 32-bit decoding unit (multiple decoding means, multiple first decoding means)
7 128-bit decoding unit (multiple decoding means, multiple first decoding means)
8 selector (decoding method selection means, second selection means)
9 Disconnect detection section (disconnect detection means)
10 PCI target device 11 PCI I / F unit 12 32-bit decoding unit (a plurality of decoding units, a plurality of second decoding units)
13 128-bit decoding unit (a plurality of decoding means, a plurality of second decoding means)
14 Burst detection unit (data access method discrimination means)
15 selector (selection means, third selection means)
16 output-side I / F unit 17 input-side I / F unit 18 32-bit encryption unit (multiple encryption units, one-word unit encryption units, multiple second encryption units)
19 128-bit encryption unit (multiple encryption means, multiple second encryption means)
20 selector (selection means, fourth selection means)
21 Data size discrimination unit (data size discrimination means)

Claims (10)

A data processing device for transferring data via a PCI bus,
A plurality of encryption means each having a different encryption method;
Data access method discrimination means for discriminating a data access method from another data device connected via the PCI bus;
Selecting means for selecting an encryption means to be used for encrypting data from the plurality of encryption means based on the data access method determined by the data access method determination means;
The data processing apparatus characterized in that the encryption means selected by the selection means encrypts data to be transferred to the other data device based on its own encryption method. A plurality of decoding means each having a different decoding scheme;
The selection means selects a decryption means used for decrypting encrypted data from the plurality of decryption means based on the data access method determined by the data access method determination means;
2. The data processing apparatus according to claim 1, wherein the decryption means selected by the selection means decrypts the encrypted data transferred from the other data device based on its own decryption method. Comprising data size determining means for determining the data size of data to be transferred to the other data device;
The selection unit selects an encryption unit to be used for encrypting data from the plurality of encryption units based on the data size determined by the data size determination unit. Item 3. A data processing apparatus according to Item 2. The plurality of encryption means comprises at least a burst unit encryption unit and a one-word unit encryption unit,
When the data size determined by the data size determination unit is less than a predetermined size, the selection unit is configured to encrypt the data in units of one word from the plurality of encryption units. 4. The data processing apparatus according to claim 3, wherein the data processing apparatus is selected as an encryption unit to be used. The plurality of encryption means comprises at least one word unit encryption means,
3. The data processing apparatus according to claim 2, wherein when the data access method determined by the data access method determining means is read access, the data is encrypted using the one-word unit encryption means. At least one of the data access methods is associated with a non-encryption method,
3. The data processing apparatus according to claim 2, wherein when the data access method determined by the data access method determination unit corresponds to the non-encryption method, the unencrypted data is transferred as it is.   2. The data processing apparatus according to claim 1, wherein whether or not to use the plurality of encryption means for data encryption can be set. A data processing device for transferring data via a PCI bus,
A plurality of encryption means each having a different encryption method;
A plurality of decryption means corresponding to the encryption method;
An encryption method for selecting an encryption unit for encrypting data to be transferred to the other data processing device from the plurality of encryption units based on a data size to be transferred to the other data processing device A selection means;
Decryption method selection for selecting a decryption means for decrypting encrypted data from the other data processing apparatus from among the plurality of decryption means based on the data size to be received from the other data processing apparatus And a data processing apparatus. The plurality of decoding means comprises at least a burst unit decoding unit and a one word unit decoding unit,
A disconnect detection means for detecting that access from the other data processing device was interrupted in the middle;
The decryption method selection means is configured to decrypt the encrypted data from the other data processing device from the plurality of decryption means when the disconnect detection means detects that the access is terminated. 9. The data processing apparatus according to claim 8, wherein the one word unit decoding means is selected. A transfer system for transferring data between a master device and a target device via a PCI bus,
The master device is
A plurality of first encryption means each having a different encryption scheme;
A plurality of first decryption means corresponding to the encryption method;
A first encryption unit for encrypting data to be transferred to the target device is selected from the plurality of first encryption units based on a data size to be transferred to the target device. 1 selection means;
Selecting a first decryption means for decrypting encrypted data from the target device from among the plurality of first decryption means based on a data size to be received from the target device; Selecting means,
The target device is
A plurality of second encryption means each having a different encryption method;
A plurality of second decryption means corresponding to the encryption method;
Data access method determining means for determining a data access method from the master device;
Second decryption for decrypting encrypted data transferred from the master device from among the plurality of second decryption means based on the data access system determined by the data access system determination means A third selection means for selecting means;
Second encryption means for encrypting data to be transferred to the master device from among the plurality of second encryption means based on the data access method determined by the data access method determination means A data transfer system comprising: a fourth selection means for selecting

Images