JP2009135813A - Encryption/decryption apparatus, and computer-readable storage medium with encryption/decryption program stored therein - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encryption/decryption apparatus, in which an encryption/decryption processing speed is accelerated further, while paying attention to the order of inputs to a device in a packet communication system or to encryption/decryption processing in one packet, in the encryption/decryption apparatus which performs encryption/decryption processing, using hardware and software, or a computer-readable storage medium with an encryption/decryption program stored thereon. <P>SOLUTION: When encryption/decryption processing is performed, by using the hardware or performing encryption/decryption processing using both the hardware and software, an encryption/decryption apparatus 1 inputs a field (payload) to be encrypted/decrypted from the CPU 10 of a software processing block to a device input/output IF 20, while taking precedence over a field (MAC header) not to be encrypted/decrypted. Thus, attention can be paid to the sequence of inputs to a device, in a packet communication system or to encryption/decryption processing in one packet, and as a result, a processing speed in encryption/decryption can be accelerated. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an encryption / decryption device that performs encryption or decryption (hereinafter referred to as encryption / decryption) of a communication packet, and in particular, encryption / decryption that performs encryption / decryption processing using hardware and software. Relates to the device.

In recent years, technology has been developed at a very high speed in the fields of communications, networks, and the like. Along with this, there is an increased possibility of leakage of information and secrets, and “high speed encryption / decryption” is desired by users in the field of security technology.
An encryption / decryption device capable of performing high-speed encryption / decryption processing has appeared in the field of communication packets in response to a request from the user for “speed-up of encryption / decryption technology”.
Here, the communication packet is a system in which data to be transmitted is divided into small pieces, and the divided data units are communicated as “packets”.
This “packet” is composed of a header and a payload. The header includes information on a transfer destination for transferring the packet itself, and the payload includes information such as application software to be transferred (excluding the header). Data itself).
In the encryption / decryption device, when there is a possibility that the packet may be leaked through a public line or the like, the packet is encrypted, and transmission / reception is performed between the devices using the encrypted packet.
If a packet received from another device is encrypted, the encrypted packet is decrypted so that the packet can be read.
During encryption / decryption processing, the encryption / decryption device inputs a header as a non-encryption target field and a payload as an encryption / decryption target field for a packet to be encrypted or a transmitted packet to be decrypted. Accept.
Accordingly, since the encryption / decryption process is performed only on the necessary encryption / decryption target field, a high-speed encryption / decryption process can be performed.

Recently, an encryption / decryption device that performs encryption / decryption processing using both hardware and software has been developed.
When encryption / decryption processing is performed by both hardware and software, depending on the length of the encryption / decryption target field in the packet, if the length of the field is short, the encryption / decryption processing is performed by software. However, when the length of the encryption / decryption target field is long, the phenomenon that the encryption / decryption processing is faster with hardware occurs.
This phenomenon occurs due to a difference in CPU (Central Processing Unit) processing speed, hardware (or device) bus speed, and the like in the course of encryption / decryption processing.
For example, in Patent Document 1 below, when performing encryption / decryption processing using hardware and software, if the packet length is shorter than the threshold value determined under each condition, the encryption / decryption processing is performed using software and is longer than the threshold value. In some cases, encryption / decryption processing is performed by hardware, and a technique for determining whether encryption / decryption processing is performed using hardware or encryption / decryption processing using software according to the packet length is disclosed. Yes.
For example, in Patent Document 2 below, a volatile memory stored in an encryption or decryption program when an open state of the cover of the apparatus main body is detected in order to prevent the encryption method from being decrypted by a third party. A technique for shutting off a backup power supply to the means is disclosed.
JP 2003-69555 A JP-A-7-141261

However, the conventional encryption / decryption device has a problem that the input order to the device is not efficient with respect to packets generated by software or transferred packets.
Further, the above-mentioned Patent Document 1 has a problem that the efficiency in the encryption / decryption processing when attention is paid to one packet and the improvement in processing speed cannot be achieved.

  Therefore, in the present invention, in an encryption / decryption device that performs encryption / decryption processing using hardware and software, attention is paid to the input order to devices in the packet communication system and encryption / decryption processing in one packet. It is an object of the present invention to provide an encryption / decryption device or a computer-readable storage medium storing an encryption / decryption program in which the encryption processing speed is further improved.

According to the first aspect of the present invention, in an encryption / decryption device that uses both encryption / decryption processing by hardware and encryption / decryption processing by software, a header that is a non-encryption target field and an encryption / decryption target field Based on a packet receiving means for receiving a packet composed of a certain payload, a field received by the packet receiving means or a field length measuring means for measuring the field length of the payload, and a field length measured by the field length measuring means Process determining means for determining whether to perform encryption / decryption processing by hardware, encryption / decryption processing by software, or encryption / decryption processing by both hardware and software. The processing determining means performs hardware encryption / decryption processing. If you decide to perform the decryption process by both hardware and software, by providing the input means for inputting the payload in preference to said header, to attain the aforementioned object.
According to a second aspect of the present invention, in the first aspect of the present invention, the processing determining means is provided on the hardware side or the software side.
According to a third aspect of the present invention, in the first or second aspect of the present invention, the apparatus further comprises threshold value accepting means for accepting a first threshold value and a second threshold value from a user, The field length measured by the length measuring means and the first threshold received by the threshold receiving means are compared, and it is determined whether to perform encryption / decryption processing by hardware or encryption / decryption processing by software Then, the field length measured by the field length measuring unit and the second threshold received by the receiving unit are compared to determine whether or not the encryption / decryption processing is performed by both hardware and software. It is characterized by that.
According to a fourth aspect of the invention, in the first or second aspect of the invention, the first threshold value is based on the processing speed in the hardware encryption / decryption process and the software encryption / decryption process. And a threshold value calculating means for calculating a second threshold value, wherein the process determining means compares the field length measured by the field length measuring means with the first threshold value calculated by the threshold value calculating means. Determining whether to perform encryption / decryption processing by hardware or software, and determining the field length measured by the field length measurement unit and the second threshold value calculated by the threshold value calculation unit And determining whether to perform encryption / decryption processing by both hardware and software.
According to a fifth aspect of the present invention, in the invention according to any one of the first to fourth aspects, the hardware encryption / decryption processing, the software encryption / decryption processing, or the hardware and software Encryption / decryption data storage means for storing a payload obtained by performing encryption / decryption on the payload that is the encryption / decryption target field, and non-encryption / decryption storing the header that is the non-encryption / decryption target field. And a data storage means.
According to a sixth aspect of the present invention, in the fifth aspect of the present invention, an encryption / decryption payload stored in the encryption / decryption data storage means and a header stored in the non-encryption / decryption data storage means are used as a pair. And a packet detecting means for detecting the packet.
According to a seventh aspect of the invention, there is provided the storage device according to any one of the first to sixth aspects, further comprising storage destination setting means for setting a header and a storage destination address of the payload, wherein the input The means is characterized in that the storage destination setting means sets the payload storage destination prior to the header, and inputs the payload prior to the header.
The invention according to claim 8 is the invention according to claim 2, wherein the processing determination unit is provided on a hardware side, and the encryption / decryption processing is performed in both the hardware and software by the processing determination unit. It further comprises transfer means for transferring the field to be converted to the software side.
The invention according to claim 9 is the invention according to any one of claims 1 to 8, wherein the packet receiving means receives a packet by using an external input / output interface.
According to a tenth aspect of the present invention, in the invention according to any one of the first to ninth aspects, the processing determining means performs decoding by hardware based on the field length measured by the field length measuring means. It is characterized in that it is determined whether to perform a decryption process, to perform a decryption process by software, or to perform a decryption process by both hardware and software.
The invention according to an eleventh aspect is characterized in that in the invention according to any one of the first to tenth aspects, the software inputs to the hardware.
According to a twelfth aspect of the invention, in the sixth aspect of the invention, there is further provided a packet generation means for generating a packet by combining a header and a payload, which are paired packets, detected by the packet detection means. It is characterized by having.
In the invention according to claim 13, in the invention according to any one of claims 1 to 12, when it is determined that the encryption / decryption processing by both hardware and software is performed by the processing determination unit, It is further characterized by further comprising payload combining means for combining the payload subjected to encryption / decryption processing by hardware and the payload subjected to encryption / decryption processing by software.
According to the fourteenth aspect of the present invention, in an encryption / decryption device using both encryption / decryption processing by hardware and encryption / decryption processing by software, a header that is a non-encryption target field and an encryption / decryption target field Based on the packet reception function for receiving a packet composed of a certain payload, the field length measurement function for measuring the packet length received by the packet reception function or the field length of the payload, and the field length measured by the field length measurement function And a process determination function for determining whether to perform encryption / decryption processing by hardware, encryption / decryption processing by software, or encryption / decryption processing by both hardware and software. In the processing determination function, hardware encryption / decryption processing is performed. Other If you decide to perform the decryption process by both hardware and software, by executing an input function of inputting the payload in preference to said header, to attain the aforementioned object.

According to the present invention, since the input order of the packet fields in the encryption / decryption process is rearranged, the encryption / decryption process can be speeded up, and the entire encryption / decryption process is made faster by increasing the start time. Can do.
Also, the encryption / decryption processing of hardware and software can be performed at high speed by properly using the encryption / decryption processing of the hardware and software depending on the field length.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to FIGS. 1 to 11.
(1) Configuration of Encryption / Decryption Device 1 that Performs Encryption Processing FIG. 1 is a block diagram illustrating a configuration of an encryption / decryption device 1 that performs encryption processing according to the present embodiment.
The encryption / decryption device 1 that performs encryption processing includes a CPU 10 of a software processing block, a device input / output IF (Interface) 20, a protocol processing block 30, an encryption / non-encryption field classification unit 40, an encryption block 50, encrypted data RAM (Random Access Memory) 60, unencrypted data RAM 70, encrypted / unencrypted field reading means 80, counter 90, combined data RAM 100, FCS (Frame Check Sequence) block 110, MAC-PHYIF (Media Access Control) (Physical layer Interface) 120 and encryption key RAM 130.
Further, the CPU 10 of the software processing block includes an encryption threshold determination block 11, a Mac header generation block 12, a payload generation block 13, and an encryption block 14.

Note that the software that performs the encryption processing of the present embodiment is configured by a CPU 10 (encryption threshold value determination block 11, mac header generation block 12, payload generation block 13, and encryption block 14) of a software processing block.
The hardware that performs the encryption processing of the present embodiment includes a device input / output IF 20, a protocol processing block 30, an encryption / non-decryption field classification unit 40, an encryption block 50, an encrypted data RAM 60, and an unencrypted data use. The description will be made assuming that the RAM 70, the encrypted / unencrypted field reading means 80, the counter 90, the combined data RAM 100, the FCS block 110, the MAC-PHY IF 120, and the encryption key RAM 130 are included.

FIG. 11 is a conceptual diagram showing a WUSB (Wireless Universal Serial Bus) packet.
The WUSB packet is composed of a Mac header (corresponding to the header) and a payload. In the Mac header, information on a transfer destination for transferring data, information on the application software to be transferred (Mac) is transferred in the payload. Data itself excluding the header).
The payload is set as an encryption target field, and the Mac header is set as a non-encryption target field.
In the present embodiment, as shown in FIG. 11, the payload is configured to include a WUSB header (the WUSB header indicates information on a transfer destination in WUSB).

Returning to FIG. 1, the Mac header generation block 12 generates a Mac header that is transmission destination information. In the payload generation block 13, a payload that is information such as application software to be transferred (data excluding the header itself) is generated.
FIG. 4 is a diagram showing a determination example in which the threshold is calculated by the encryption threshold determination block 11 and the field length is determined based on the threshold.
First, the encryption threshold value determination block 11 acquires the MAC header and payload in the packet generated by the MAC header generation block 12 and the payload generation block 13, and measures the respective field lengths.
The encryption threshold value determination block 11 is configured to measure the field length of the payload because the field length of the Mac header may be set in advance in some cases.
Next, the encryption threshold value determination block 11 calculates a first threshold value and a second threshold value.
Here, for the calculation method of the first threshold value and the second threshold value, for example, CPU clock frequency, device clock frequency, device bus bit width, transfer speed, hardware, software encryption / decryption processing time, There is a method of calculating based on information related to processing speed such as the length of an encryption target field in a packet.
Then, the encryption threshold value determination block 11 compares the measured field length with the calculated first threshold value or second threshold value.
In the configuration of this embodiment, the encryption threshold value determination block 11 calculates the first threshold value and the second threshold value. However, the encryption threshold value determination block 11 is provided with a register (not shown), and the register is stored in the register. It can also be configured to accept a threshold setting from the user.

The encryption threshold value determination block 11 determines whether or not the measured field length is less than or greater than the first threshold value. If it is less, the encryption block 14 (software) performs encryption processing. If it exceeds, processing decision information indicating that encryption processing is performed by the encryption block 50 (hardware) is added to the payload.
Further, it is determined whether or not the measured field length is less than or greater than the second threshold value. If the measured field length is greater than the second threshold value, the encryption block 14 (software) and the encryption block 50 (hardware) Processing determination information indicating that encryption processing is performed by both parties is added to the payload.
If the processing decision information is to be processed by software, the encryption block 14 performs payload encryption processing.
When the processing determination information is to process by hardware, the CPU 10 of the software processing block inputs to the hardware device input / output IF 20 via the bus line.
The CPU 10 of the software processing block inputs the mac header as a non-encryption target field and the payload as an encryption target field to the hardware device input / output IF 20 via the bus lines.
At this time, the input order to the device input / output IF 20 on the hardware side is performed by giving priority to the input of the payload, and when the input of the payload is completed, the input of the Mac header is started.
Further, the CPU 10 of the software processing block sets an address as a payload and a storage destination of the header, and sets an address of a payload storage destination before the header.

The device input / output IF 20 receives input of the payload and the mac header from the block CPU 10 via the bus line.
Then, the device input / output IF 20 transfers the received Mac header and payload to the protocol processing block 30 via the bus line.
The protocol processing block 30 performs predetermined processing relating to the MAC header and payload protocol (data transmission method) transferred from the device input / output IF 20.
Then, the protocol processing block 30 transfers the MAC header and the payload to the encrypted / unencrypted field classification unit 40.

The encryption / non-encryption field classification unit 40 is configured to connect the encryption block 50, the encryption data RAM 60, or the non-connection, which are connected via the bus line, in accordance with the MAC header and payload transferred from the protocol processing block 30. The data is classified into the encryption data RAM 70 and stored in the RAM or transferred.
For example, when the data transferred from the protocol processing block 30 is a mac head, the encryption / non-encryption field classification unit 40 recognizes the data as non-encrypted data, transfers it to the non-encrypted data RAM 70, and The mac head is stored in the encryption data RAM 70.

  Also, the encryption / non-encryption field classification means 40, when the data transferred from the protocol processing block 30 is a payload having processing decision information indicating that the encryption processing is performed by hardware, the data is encrypted block 14 is recognized as an encrypted payload, transferred to the encryption data RAM 60, the encrypted payload is stored in the encryption data RAM 60, and the payload is transferred to the encryption block 50.

In the encryption block 50, encryption processing is performed on the payload transferred from the encryption / non-encryption field classification unit 40.
The encryption block 50 encrypts the payload by appropriately referring to the encryption key stored in the encryption key RAM 130 during the encryption process.
Then, the encryption block 50 transfers the payload after the encryption processing to the encryption data RAM 60 via the bus line, and stores the encrypted payload in the encryption data RAM 60.

The counter 90 is connected to the non-encrypted data RAM 70 and the encrypted data RAM 60 via a bus line, and periodically transmits a read enable signal.
The counter 90 acquires the data count and field length information of each data stored in the non-encrypted data RAM 70 and the encrypted data RAM 60, and detects a pair of packets.
When a pair of packets is detected, the counter 90 transmits a request signal to the encrypted / unencrypted field reading unit 80.
When the encryption / non-encryption field reading means 80 receives the requested cipher, the encryption / non-encryption field reading means 80 reads the encrypted payload stored in the encryption data RAM 60, and loads the mac head corresponding to the payload from the non-encryption data RAM 70. Reading and transferring the payload and the mac head to the counter 90 connected via the bus line.
The counter 90 combines the mac head and the encrypted payload to generate an encrypted WUSB packet.
The counter 90 stores the generated and encrypted WUSB packet in the combined data RAM 100.

The FCS block 110 adds an FCS field to the WUSB packet stored in the combined data RAM 100.
As shown in FIG. 11, an FCS field is added to the WUSB packet, and a checksum code is added to the FCS field in order to detect data errors in the communication protocol.
As a result, between the computers that transmit and receive frames, the checksum code can be recalculated with each specified algorithm to determine whether or not the data transmission and reception is normal.

Returning to FIG. 1, the FCS block 110 transfers the WUSB packet to which the FCS field is added to the MAC-PHY IF 120 via the bus line.
Then, the MAC-PHY IF 120 outputs the WUSB packet transferred from the FCS block 110 to the WiMedia PHY, and performs data transmission with other devices.

(2) Configuration of Encryption / Decryption Device 1 that Performs Decoding Processing FIG. 3 is a block diagram illustrating a configuration of the encryption / decryption device 1 that performs the decoding processing of the present embodiment.
The encryption / decryption device 1 that performs the decoding process includes the MAC-PHY IF 135, the FCS block 140, the decoding determination block 150, the first decoding / non-decoding field classification unit 160, the decoding threshold determination block 170, the second Decryption / non-decryption field classifying means 175, decryption block 180, decryption key RAM 190, non-decryption data RAM 200, decryption data RAM 210, decryption / non-decryption field reading means 220, counter 230, combined data RAM 240 , A protocol processing block 250, a device input / output IF 260, and a software processing block CPU 270.
Further, the CPU 270 of the software processing block includes a packet combining block 271 and a decoding block 272.

Note that the software that performs the decryption processing of the present embodiment is configured by a CPU 270 (packet combining block 271 and decryption block 272) of the software processing block.
The hardware that performs the decoding process according to the present embodiment includes a MAC-PHY IF 135, an FCS block 140, a decoding determination block 150, a first decoding / non-decoding field classification unit 160, a decoding threshold determination block 170, Second decryption / non-decryption field classification means 175, decryption block 180, decryption key RAM 190, non-decryption data RAM 200, decryption data RAM 210, decryption / non-decryption field reading means 220, counter 230, combination A description will be given assuming that the data RAM 240, the protocol processing block 250, and the device input / output IF 260 are configured.

The MAC-PHY IF 135 receives the encrypted WUSB packet from another device or the like via the WiMedia PHY, and transfers the encrypted WUSB packet to the FCS block 140.
The FCS block 140 calculates a checksum code of the FCS field added to the WUSB packet and performs data error detection.
If there is no data error, the FCS block 140 transfers the encrypted WUSB packet to the decryption determination block 150 connected via the bus line.

The decryption determination block 150 determines whether or not the WUSB packet transferred from the FCS block 140 is an encrypted packet.
Then, when the transferred packet is an encrypted packet, the decryption determination block 150 sends the forwarded packet to the decryption threshold value determination block 170 for the first decryption / non-decryption field classification unit 160. Forward through.
In addition, when the transferred packet is not an encrypted packet, the decryption determination block 150 uses the first decryption / non-decryption field classification unit 160 to transmit the forwarded packet to the non-decryption data. It is stored in the RAM 200.

FIG. 4 is a diagram illustrating a determination example in which a threshold is calculated by the decoding threshold determination block 170 and the field length is determined based on the threshold.
First, the decoding threshold value determination block 170 acquires the packet transferred from the first decoding / non-decoding field classification unit 160, and measures each field length in the header and payload of the acquired packet.
Note that the decoding threshold value determination block 170 is configured to measure the field length of the payload because the field length of the Mac header may be set in advance in some cases.
Next, the decoding threshold value determination block 170 calculates a first threshold value and a second threshold value.
The calculation method of the first threshold value and the second threshold value includes, for example, CPU clock frequency, device clock frequency, device bus bit width, transfer speed, hardware, software encryption / decryption processing time, There is a calculation method based on information related to processing speed such as the length of a field to be decoded.
Then, the decoding threshold value determination block 170 compares the measured field length with the calculated first threshold value and the second threshold value.
Note that the second threshold is set to exceed the first threshold.
In the configuration of the present embodiment, the first threshold value and the second threshold value are calculated in the decoding threshold value determination block 170. However, a register (not shown) is provided in the decoding threshold value determination block 170, and the register is set in the register. It can also be configured to accept a threshold setting from the user.

The decoding threshold value determination block 170 determines whether or not the measured field length is less than or exceeds the first threshold value. If it is less, the decoding block 272 (software) performs a decoding process. If it exceeds, processing determination information indicating that the decoding process is performed in the decoding block 180 (hardware) is added to the payload.
Further, it is determined whether or not the measured field length exceeds the second threshold value. If the measured field length exceeds the second threshold value, the encryption process is performed in both the decryption block 272 (software) and the decryption block 180 (hardware). Processing decision information indicating that the process is performed is added to the payload.
Then, the decoding threshold value determination block 170 attaches the processing determination information to the payload and transfers it to the second decoding / non-decoding field classification unit 175 via the bus line.
The second decoding / non-decoding field classification unit 175 recognizes the processing decision information given to the payload. Then, as a result of the recognition, when the payload processing determination information is information indicating that the processing is performed by hardware, the second decoding / non-decoding field classification unit 175 transfers the processing to the decoding block 180 and performs processing. If the decision information is to be processed by software, it is transferred to the device input / output IF 260.
If the processing determination information is to perform decoding processing by both hardware and software, the payload is divided by the decoding threshold determination block 170, and each of them is decoded by a decoding block 180 (processed by hardware). , And the device input / output IF 260 (processed by software).
Also, the decryption threshold value determination block 170 inputs the mac header as a non-encryption target field and the payload as an encryption target field, respectively, to the decryption block 180 via the bus line.
At this time, the input order to the decoding block 180 is performed with priority on the input of the payload, and when the input of the payload is completed, the input of the Mac header is started.
Also, the decoding threshold value determination block 170 sets an address that becomes a storage location of the payload and the header, and sets an address of the payload storage location before the header.

The decryption block 180 performs decryption processing on the payload transferred by the decryption threshold determination block 170.
At this time, the decryption block 180 refers to the decryption key stored in the decryption key RAM 190 as appropriate during the decryption process, and performs the decryption process on the payload.
Then, the decryption block 180 transfers the payload after the decryption process to the decrypted data RAM 210 via the bus line, and stores the decrypted payload in the decrypted data RAM 210.

The counter 230 is connected to the non-decoded data RAM 200 and the decoded data RAM 210 via a bus line, and periodically transmits a read enable signal.
The counter 230 acquires the data count and field length information of each data stored in the non-decoded data RAM 200 and the decoded data RAM 210, and detects a pair of packets.
When a pair of packets is detected, the counter 230 transmits a request signal to the decoding / non-decoding field reading unit 220.
When receiving the request signal, the decoding / non-decoding field reading unit 220 reads the decoded payload stored in the decoded data RAM 210, and reads the mac head corresponding to the payload from the non-decoded data RAM 200. The reading / decoding / non-decoding field reading means 220 transfers the payload and the mac head to the counter 230 connected via the bus line.
The counter 230 receives the mac head and the decrypted payload corresponding to the mac head from the decoding / non-decoding field reading means 220.
The counter 230 combines the mac head and the decoded payload to generate a WUSB packet.
The counter 230 stores the generated WUSB packet in the combined data RAM 240.

In the protocol processing block 250, the WUSB packet stored in the combined data RAM 240 is read, and a predetermined process related to the protocol (communication method) is performed.
Then, the protocol processing block 250 inputs the WUSB packet to the device input / output IF 260 via the bus line.
The device input / output IF 260 includes a WUSB packet transferred from the protocol processing block 250 or a payload transferred from the second decoding / non-decoding field classifying unit 175 (processing determination information indicating that processing is performed by software). ).
The device input / output IF 260 performs a decoding process on the payload transferred from the second decoding / non-decoding field classification unit 175 by the decoding block 272.
The packet combining block 271 combines the payload decoded by the decoding block 272 and the MAC header to generate a decoded WUSB packet.

(3) Procedure of Encryption / Decryption Device 1 that Performs Encryption Process FIG. 5 is a flowchart showing the process of the encryption process by hardware in this embodiment.
First, upon receiving a data transfer request or the like related to application software from a user, the CPU 10 of the software processing block generates a WUSB packet including a mac header and a payload (step 500).
The encryption threshold value determination block 11 acquires a Mac header and a payload in the generated packet, and measures each field length.
The encryption threshold value determination block 11 is configured to measure the field length of the payload because the field length of the Mac header may be set in advance in some cases.
Here, the encryption threshold value determination block 11 includes, for example, a CPU clock frequency, a device clock frequency, a device bus bit width, a transfer speed, hardware, software encryption / decryption processing time, an encryption target field length in a packet, and the like. The first threshold value and the second threshold value are calculated based on the information related to the processing speed (step 502).
When the first threshold value and the second threshold value are calculated in the encryption threshold value determination block 11 (step 502; Y), the encryption threshold value determination block 11 uses the calculated first threshold value, And compare to a second threshold.
When the measured field length exceeds the first threshold value and falls below the second threshold value, the encryption threshold value determination block 11 gives processing determination information indicating that the encryption processing is performed by hardware to the payload ( Step 503).
The CPU 10 of the software processing block inputs the payload (encryption target field) to the device input / output IF 20 on the hardware side (step 504).
Here, the processing process of the Mac header will be described in Steps 506 to 508, and the processing process of the payload will be described in Steps 510 to 512.

The CPU 10 of the software processing block determines whether or not the input of the encryption target field (payload) has been completed in step 504 (step 506).
When the input of the payload is completed (Step 506; Y), the Mac header is subsequently input.
The device input / output IF 20 transfers the MAC header via the protocol processing block 30 and the encryption / decryption / non-encryption field classification means 40 and stores it in the non-encrypted data RAM 70 (step 508).

In step 504, the encryption target field (payload) input to the device input / output IF 20 is transferred to the encryption block 50 via the protocol processing block 30 and the encryption / decryption / non-encryption field classification means 40. The
In the encryption block 50, encryption processing is performed on the transferred payload (step 510).
At this time, the encryption block 50 performs encryption processing on the payload (encryption target field) by appropriately referring to the encryption key stored in the encryption key RAM 130 at the time of encryption.
Then, the encryption block 50 transfers the payload for which the encryption processing has been completed to the encryption data RAM 60 via the bus line and stores it (step 512).

The counter 90 is connected to the non-encrypted data RAM 70 and the encrypted data RAM 60 via a bus line, and periodically transmits a read enable signal.
Then, the data count and field length information of each data stored in the non-encrypted data RAM 70 and the encrypted data RAM 60 are acquired.
Thereby, the counter 90 detects whether or not WUSB packets are prepared in the non-encrypted data RAM 70 and the encrypted data RAM 60 (step 514).
If the WUSB packets are prepared as a result of the detection (step 514; Y), based on the detection, the encrypted / unencrypted field reading means 80 reads the mac head and the payload and transfers them to the counter 90.
The counter 90 combines the transferred MAC head and payload, generates an encrypted WUSB packet, and stores it in the combined data RAM 100 (step 516).

The FCS block 110 adds an FCS field to the WUSB packet stored in the combined data RAM 100 and transfers it to the MAC-PHY IF 120 via the bus line.
Then, the MAC-PHY IF 120 performs data transmission of the WUSB packet added with the FCS field transferred from the FCS block 110 to another device via the WiMedia PHY (step 518).

In step 504, the CPU 10 of the software processing block determines whether or not the input of the encryption target field (payload) has been completed (step 506). If the input has been completed (step 506; Y), the Mac head Is input to the hardware side.
As a result, since the payload is first encrypted in step 504, the time for the data in step 514 can be achieved earlier, and as a result, a higher-speed cryptographic processor can be obtained.

FIG. 6 is a flowchart showing a process of encryption processing by software and hardware in this embodiment.
First, upon receiving a request for transferring application software from the user, the CPU 10 of the software processing block generates a WUSB packet composed of a MAC header and a payload (step 600).
Next, the encryption threshold value determination block 11 acquires a Mac header and a payload in the generated packet, and measures each field length.
The encryption threshold value determination block 11 is based on, for example, the CPU clock frequency, device clock frequency, device bus bit width, transfer speed, hardware, software encryption / decryption processing time, and encryption target field length in the packet. The first threshold value and the second threshold value are calculated (or determined) (step 602).
When the threshold value is calculated (or determined) (step 602; Y), the encryption threshold value determination block 11 compares the measured field length with the calculated first threshold value and the calculated second threshold value.
Then, the encryption threshold value determination block 11 displays processing determination information indicating that the encryption process is performed by hardware and software when the measured field length exceeds the first threshold value and exceeds the second threshold value. A payload is added (step 603).
The CPU 10 of the software processing block uses the payload as an encryption target field, and inputs the payload and the mac head to the hardware device input / output IF 20.
Then, the CPU 10 of the software processing block inputs the mac header and payload (or encrypted payload) to the device input / output IF 20 on the hardware side via the bus lines (step 608).
If the processing decision information is to perform cryptographic processing by both hardware and software, the CPU 10 of the software processing block divides the payload, and each payload having a field length equal to or less than the threshold is encrypted. The encryption block 50 (processed by hardware) performs encryption processing, and the payload having a field length equal to or greater than the threshold is encrypted by the encryption block 14 (processed by software).

Here, the cryptographic process in software will be described in steps 604 to 606. Also, the cryptographic process in hardware will be described in steps 610 to 616.
In particular, the Mac header processing process will be described in Steps 610 to 612, and the payload processing process will be described in Steps 614 to 616.

First, the CPU 10 of the software processing block encrypts the payload having a field length equal to or greater than the first threshold value or the second threshold value in the encryption block 14 (step 604), and the encrypted payload is transmitted to the device input / output IF 20. To enter.
The encrypted payload is stored in the encrypted data RAM 60 via the device input / output IF 20, the protocol processing block 30, and the encrypted / unencrypted field classifying means 40 (step 606).

The CPU 10 of the software processing block determines whether or not the input of the encryption target field (payload) is completed in step 608 (step 610).
When the input of the payload is completed (Step 610; Y), the Mac header is subsequently input (Step 610; Y).
The device input / output IF 20 transfers the MAC header via the protocol processing block 30 and the encryption / decryption / non-encryption field classification means 40 and stores it in the non-encrypted data RAM 70 (step 612).

In step 608, the encryption target field (payload) input to the device input / output IF 20 is transferred to the encryption block 50 via the protocol processing block 30 and the encryption / non-encryption field classification means 40.
In the encryption block 50, encryption processing is performed on the transferred payload (step 614).
At this time, the encryption block 50 performs encryption processing on the payload (encryption target field) by appropriately referring to the encryption key stored in the encryption key RAM 130 at the time of encryption.
Then, the encryption block 50 transfers the payload after the encryption processing to the encryption data RAM 60 via the bus line, and stores the encrypted payload in the encryption data RAM 60 (step 616).

The counter 90 is connected to the non-encrypted data RAM 70 and the encrypted data RAM 60 via a bus line, and periodically transmits a read enable signal.
The data count and field length information (mac head) of each data stored in the non-encrypted data RAM 70 and the encrypted data RAM 60 are acquired.
The counter 90 detects whether or not a pair of WUSB packets are prepared in the non-encrypted data RAM 70 and the encrypted data RAM 60 (step 618).
When the paired WUSB packet is detected (step 618; Y), the encrypted / unencrypted field reading means 80 transfers the mac head and the encrypted payload to the counter 90.
The counter 90 combines the Mac head and the encrypted payload to generate a WUSB packet.
The counter 90 stores the encrypted WUSB packet in the combined data RAM 100 (step 620).

The FCS block 110 adds an FCS field to the WUSB packet stored in the combined data RAM 100 and transfers it to the MAC-PHY IF 120 via the bus line.
Then, the MAC-PHY IF 120 performs data transmission of the WUSB packet added with the FCS field transferred from the FCS block 110 via the WiMedia PHY (step 622).

FIG. 7 is a flowchart showing a process of encryption processing by software in the present embodiment.
First, upon receiving a request for transferring application software from the user, the CPU 10 of the software processing block generates a WUSB packet including a mac header and a payload (step 700).
Next, the encryption threshold value determination block 11 acquires a Mac header and a payload in the generated packet, and measures each field length.
The encryption threshold value determination block 11 is configured to measure the field length of the payload because the field length of the Mac header may be set in advance in some cases.
The encryption threshold value determination block 11 is based on, for example, the CPU clock frequency, device clock frequency, device bus bit width, transfer speed, hardware, software encryption / decryption processing time, and encryption target field length in the packet. The first threshold value and the second threshold value are calculated (or determined) (step 702).
When the threshold is calculated (or determined) (step 702; Y), the encryption threshold determination block 11 compares the measured field length with the calculated first threshold and the second threshold.
When the measured field length falls below the first threshold value and the second threshold value, processing determination information indicating that the encryption processing is performed by hardware is added to the payload (step 703).

  Here, the processing process of the Mac header will be described in step 704, and the processing process of the payload will be described in steps 706 to 708.

The device input / output IF 20 transfers the MAC header via the protocol processing block 30 and the encrypted / non-encrypted field classification means 40 and stores it in the non-encrypted data RAM 70 (step 704).
Next, the CPU 10 of the software processing block encrypts the payload having a field length below the first threshold or the second threshold in the encryption block 14 (step 706), and the encrypted payload is input / output to the device. Input to IF20.
The device input / output IF 20 then stores the encrypted payload in the encrypted data RAM 60 via the protocol processing block 30 and the encrypted / unencrypted field classifying means 40 (step 708).

The counter 90 is connected to the non-encrypted data RAM 70 and the encrypted data RAM 60 via a bus line, and periodically transmits a read enable signal.
The data count and field length information (mac head) of each data stored in the non-encrypted data RAM 70 and the encrypted data RAM 60 are acquired.
The counter 90 detects whether or not a pair of WUSB packets are prepared in the non-encrypted data RAM 70 and the encrypted data RAM 60 (step 710).
When a paired WUSB packet is detected (step 710; Y), the encrypted / unencrypted field reading means 80 transfers the mac head and the encrypted payload.
The counter 90 combines the MAC head and the encrypted payload to generate a WUSB packet and stores it in the combined data RAM 100 (step 712).

The FCS block 110 adds an FCS field to the WUSB packet stored in the combined data RAM 100 and transfers it to the MAC-PHY IF 120 via the bus line.
Then, the MAC-PHY IF 120 performs data transmission of the WUSB packet added with the FCS field transferred from the FCS block 110 via the WiMedia PHY (step 714).

(4) Procedure of Encryption / Decryption Device 1 that Performs Decoding Processing FIG. 8 is a flowchart showing a process of decoding processing by hardware in the present embodiment.
First, the MAC-PHY IF 135 receives the encrypted WUSB packet from another device via the WiMedia PHY (step 800).
Then, the encrypted WUSB packet is transferred to the FCS block 140.
The FCS block 140 calculates a checksum code from the FCS field added to the WUSB packet and performs data error detection (step 802).
If there is no data error (step 802; Y), the FCS block 140 transfers the encrypted WUSB packet to the decryption determination block 150 connected via the bus line.
If there is a data error (step 802; N), the packet is discarded and a data retransmission request is made to another device (step 804).

The decryption determination block 150 determines whether or not the transferred WUSB packet is encrypted (step 806).
Then, since the decryption is necessary if it is encrypted, the decryption determination block 150 uses the payload (decryption target field) of the WUSB packet and the first decryption / non-decryption field classification of the WUSB packet. Transfer to the means 160 (step 806; Y).
The decoding threshold value determination block 170 acquires the Mac header and the payload in the transferred packet, and measures each acquired field length.
Then, the decoding threshold value determination block 170 calculates (or determines) the first threshold value and the second threshold value (step 808).
Here, the first threshold value and the second threshold value calculation method include, for example, CPU clock frequency, device clock frequency, device bus bit width, transfer speed, hardware, software encryption / decryption processing time, and There is a method of calculating based on information related to processing speed such as the length of a decoding target field in a packet.
When the threshold is determined in the decoding threshold determination block 170 (step 808; Y), the decoding threshold determination block 170 includes the measured field length, the calculated first threshold, and the second threshold. Compare

Then, it is determined whether or not the measured field length is less than the first threshold value. If the measured field length is less than the first threshold value, processing determination information indicating that the decoding process is performed by hardware is added to the payload (step 809).
In order to perform the decoding process by hardware, the payload is set as a decoding target field, and the decoding target field is transferred to the second decoding / non-decoding field classifying unit 175 via the bus line.
The second decoding / non-decoding field classification unit 175 transfers the decoding target field to the decoding block 180 based on whether or not the payload is the decoding target field.
Here, the Mac header processing process will be described in Steps 810 to 812, and the payload processing process will be described in Steps 814 to 816.

The device input / output IF 260 determines whether or not the input of the payload (decoding target field) is completed (step 810), and when the input is completed, the input of the mac head is subsequently performed (step 810; Y).
Then, the mac head is transferred to the non-decoded data RAM 210 and stored (step 812).

The decoding block 180 performs a decoding process on the payload transferred from the second decoding / non-decoding field classification unit 175 (step 814).
At this time, in the decryption, the decryption block 180 appropriately refers to the decryption key stored in the decryption key RAM 190 and performs the decryption process on the decryption target field.
Then, the decryption block 180 transfers the decryption target field, which has been decrypted, to the decrypted data RAM 210 via the bus line, and stores the decrypted payload (step 816).

The counter 230 is connected to the non-decoded data RAM 200 and the decoded data RAM 210 via a bus line, and periodically transmits a read enable signal.
The counter 230 acquires the data count and field length information of each data stored in the non-decoded data RAM 200 and the decoded data RAM 210.
The counter 230 detects whether or not WUSB packets are prepared in the non-decoded data RAM 200 and the decoded data RAM 210 (step 818).
When the decrypted WUSB packets are ready (step 818; Y), the decryption / non-decryption field reading means 220 transfers the mac head and the encrypted payload corresponding to the mac head to the counter 230. The counter 230 combines the transferred mac head and the payload to generate a decoded WUSB packet.
The counter 230 stores the decoded WUSB packet in the combined data RAM 240 (step 820).
The protocol processing block 250 transfers the WUSB packet stored in the combined data RAM 240 to the device input / output IF 260.
The device input / output IF 260 then receives the decrypted WUSB packet and inputs it to the CPU 270 of the software processing block (step 822).

  On the other hand, when the WUSB packet is not encrypted in step 806, the decryption determination block 150 inputs the WUSB packet to the CPU 270 of the software processing block via the device input / output IF 260 (step 806; N). .

FIG. 9 is a flowchart showing a process of decoding processing by software and hardware in the present embodiment.
First, the MAC-PHY IF 135 receives an encrypted WUSB packet from another device via the WiMedia PHY (step 900).
Then, the encrypted WUSB packet is transferred to the FCS block 140.
The FCS block 140 calculates a checksum code from the FCS field added to the WUSB packet and performs data error detection (step 902).
If there is no data error (step 902; Y), the FCS block 140 transfers the encrypted WUSB packet to the decryption determination block 150 connected via the bus line.
If there is a data error (step 902; N), the packet is discarded and a data retransmission request is made to another device (step 904).

The decryption determination block 150 determines whether or not the transferred WUSB packet is encrypted (step 906).
If it is encrypted (step 906; Y), since decryption is necessary, the decryption determination block 150 performs the first decryption / non-decryption on the WUSB packet including the payload (field to be decrypted). Transfer to the decryption field classification means 160.
The decoding threshold value determination block 170 acquires the Mac header and the payload in the transferred packet, and measures each acquired field length.
Then, the decoding threshold value determination block 170 calculates (or determines) the first threshold value and the second threshold value (step 908).
Here, the first threshold value and the second threshold value calculation method include, for example, CPU clock frequency, device clock frequency, device bus bit width, transfer speed, hardware, software encryption / decryption processing time, and There is a calculation method based on information related to processing speed such as the length of a decoding target field in a packet.
When the threshold is determined in the decoding threshold determination block 170 (step 908; Y), the decoding threshold determination block 170 includes the measured field length, the calculated first threshold, and the second threshold. Compare

Then, it is determined whether or not the measured field length exceeds the first threshold value and the second threshold value, and if so, processing determination information indicating that decoding processing is performed by hardware and software is included in the payload. (Step 909).
Then, in order to perform decoding processing by hardware and software, the payload (decoding target field) is transferred to the second decoding / non-decoding field classification means 175 via the bus line.
Then, the decoding threshold value determination block 170 attaches the processing determination information to the payload and transfers it to the second decoding / non-decoding field classification unit 175 via the bus line.
The second decoding / non-decoding field classification unit 175 recognizes the processing decision information given to the payload. As a result of recognition, when the processing determination information of the payload is information indicating that it is processed by hardware, it is transferred to the decoding block 180, and when the processing determination information is information indicating that it is processed by software , Transfer to the device input / output IF 260.
If the processing determination information is to be decoded by both hardware and software, the payload is divided at the decoding threshold determination block 170, and for each payload having a field length equal to or less than the threshold, The payload is decrypted by the decryption block 180 (processed by hardware), and the payload having a field length equal to or larger than the threshold is decrypted by the encryption block 272 (processed by software) (step 910). .

  Here, the decoding process in software will be described in step 912. Also, the decoding process in hardware will be described in steps 914 to 920. In particular, the Mac header processing process will be described in steps 914 to 916, and the payload processing process will be described in steps 918 to 920.

The CPU 270 of the software processing block decodes the payload having a field length from the device input / output IF 260 of the first threshold value or the second threshold value (step 912).
On the other hand, the device input / output IF 200 determines whether or not the input of the payload (decoding target field) is completed (step 914). When the input is completed (step 914; Y), the mac head is used for non-decoded data. The data is transferred to the RAM 200 and stored (step 916).

The decryption block 180 decrypts the transferred payload (decoding target field) (step 918).
At this time, at the time of decryption, the decryption block 180 appropriately decrypts the payload (decryption target field) with reference to the decryption key stored in the decryption key RAM 190 as appropriate.
Then, the decryption block 180 transfers the payload (decryption target field) that has been decrypted to the encrypted data RAM 210 via the bus line and stores it (step 920).

The counter 230 is connected to the non-decoded data RAM 200 and the decoded data RAM 210 via a bus line, and periodically transmits a read enable signal.
The counter 230 acquires the data count and field length information of each data stored in the non-decoded data RAM 200 and the decoded data RAM 210.
The counter 230 detects whether or not WUSB packets are prepared in the non-decoded data RAM 200 and the decoded data RAM 210 (step 922).
When the encrypted WUSB packets are ready (step 922; Y), the decryption / non-decryption field reading unit 220 sends the mac head and the encrypted payload corresponding to the mac head to the counter 230. The counter 230 combines the transferred mac head and the payload to generate a decoded WUSB packet.
The counter 230 stores the decrypted WUSB packet in the combined data RAM 240 (step 924).
The protocol processing block 250 transfers the WUSB packet stored in the combined data RAM 240 to the device input / output IF 260.
The device input / output IF 260 receives the decrypted WUSB packet and inputs it to the CPU 270 of the software processing block.
The CPU 270 of the software processing block combines the hardware-decoded payload and the software-decoded payload, and further combines a Mac header with the combined packet to generate a WUSB packet ( Step 926).

  On the other hand, if the WUSB packet is not encrypted (not decrypted) in step 906 (step 906; N), the decryption determination block 150 determines that the WUSB packet is not decrypted via the device input / output IF 260. To the CPU 270 of the software processing block (step 928).

FIG. 10 is a flowchart showing the process of decryption processing by software in this embodiment.
First, the MAC-PHY IF 135 receives an encrypted WUSB packet from another device via the WiMedia PHY (step 1000).
Then, the encrypted WUSB packet is transferred to the FCS block 140.
The FCS block 140 calculates a checksum code from the FCS field added to the WUSB packet and performs data error detection (step 1002).
If there is no data error (step 1002; Y), the FCS block 140 transfers the encrypted WUSB packet to the decryption determination block 150 connected via the bus line.
If there is a data error (step 1002; N), the packet is discarded and a data retransmission request is made to another device (step 1004).

The decryption determination block 150 determines whether or not the transferred WUSB packet is encrypted (step 1006).
If it is encrypted (step 1006; Y), since decryption is necessary, the decryption determination block 150 transfers the WUSB packet to the first decryption / non-decryption field classification unit 160.
The decoding threshold value determination block 170 acquires the Mac header and the payload in the transferred packet, and measures each acquired field length.
Then, the decoding threshold value determination block 170 calculates (or determines) the first threshold value and the second threshold value (step 1008).
Here, the first threshold value and the second threshold value calculation method include, for example, CPU clock frequency, device clock frequency, device bus bit width, transfer speed, hardware, software encryption / decryption processing time, and There is a calculation method based on information related to processing speed such as the length of a field to be decoded in a packet.
When the threshold value is determined by the decoding threshold value determination block 170 (step 1008; Y), the decoding threshold value determination block 170 includes the measured field length, the calculated first threshold value, and the second threshold value. Compare

It is determined whether or not the measured field length is less than the first threshold value. If the measured field length is less than the first threshold value, processing determination information indicating that the decoding process is performed by software is added to the payload (step 1009).
In order to perform the decoding process by software, the payload (decoding target field) is transferred to the second decoding / non-decoding field classifying unit 175 via the bus line.
The decoding threshold value determination block 170 attaches the processing determination information to the payload, and transfers it to the second decoding / non-decoding field classification unit 175 via the bus line.
The second decoding / non-decoding field classification unit 175 recognizes the processing decision information given to the payload. As a result of the recognition, if the payload processing decision information is information indicating that processing is performed by hardware, the payload is transferred to the decoding block 180.

  The CPU 270 of the software processing block decodes a payload having a field length that is less than the first threshold value or the second threshold value from the device input / output IF 260 (step 1009).

As described above, in the present embodiment, it is possible to perform processing by using both encryption processing and decryption processing.
Then, in the encryption / decryption processing in the present embodiment, when the first threshold value and the second threshold value are calculated and the measured field length is less than the first threshold value as a result of comparison between the threshold value and the field length, It is configured to perform encryption / decryption processing on the software side, and when it exceeds, it is configured to perform processing on the hardware side.
Moreover, when exceeding a 2nd threshold value, it is comprised so that an encryption / decryption process may be performed using both software and hardware.

In the present embodiment, when performing encryption / decryption processing by hardware, or when performing encryption / decryption processing by both hardware and software, the encryption / decryption target field (payload) is changed to the non-encryption / decryption target field (Mac header). Enter with higher priority.
Thereby, attention can be paid to the order of input to devices in the packet communication system and the encryption / decryption processing of one packet, and as a result, the processing speed in encryption / decryption can be improved.

In the present embodiment, the encryption / decryption device 1 is a device connected to a wireless communication system (WUSB). However, the device and application of the present invention are not limited thereto, and the IEEE 802.11 wireless LAN, The present invention can also be implemented in other wired communication systems.
In addition, the header is not limited to only the Mac header but can be set variously by changing the communication method.

(5) Modified Example FIG. 2 is a block diagram showing the configuration of the encryption / decryption device 1 that performs the encryption process in the modified example of the present embodiment.
In the description of each embodiment described below, the same parts as those in the present embodiment are denoted by the same reference numerals, and different parts are denoted by different reference numerals. The description of the same part will be omitted as appropriate.

In the modification of this embodiment, the encryption threshold value determination block 11 is mounted on the hardware side.
That is, the software in the modification of the present embodiment is configured by the CPU 10 (Mac header generation block 12, payload generation block 13, and encryption block 14) of the software processing block, and the hardware in the modification of the present embodiment is Encryption threshold determination block 11, device input / output IF 20, protocol processing block 30, encryption / non-encryption field classification means 40, encryption block 50, encryption data RAM 60, non-encryption data RAM 70, encryption / non-encryption The description will be made assuming that the field reading means 80, the counter 90, the combined data RAM 100, the FCS block 110, the MAC-PHY IF 120, and the encryption key RAM 130 are included.

  In the modification of the present embodiment, when the encryption threshold determination block 11 requires encryption processing by software, only the target field to be encrypted by software is extracted and re-transferred from hardware to software. can do.

It is the block diagram which showed the structure of the encryption / decryption apparatus which performs the encryption process of this embodiment. It is the block diagram which showed the structure of the encryption / decryption apparatus which performs the encryption process in the modification of this embodiment. It is the block diagram which showed the structure of the encryption / decryption apparatus which performs the decoding process of this embodiment. FIG. 10 is a diagram illustrating a determination example in which a threshold is calculated by a decoding threshold determination block, and a field length is determined based on the threshold. It is the flowchart which showed the process of the encryption process by the hardware in this embodiment. It is the flowchart which showed the process of the encryption process by the hardware in this embodiment, and software. It is the flowchart which showed the process of the encryption process by the software in this embodiment. It is the flowchart which showed the process of the decoding process by the hardware in this embodiment. It is the flowchart which showed the process of the decoding process by the software and hardware in this embodiment. It is the flowchart which showed the process of the decoding process by the software in this embodiment. It is the conceptual diagram which showed the WUSB packet.

Explanation of symbols

1 Encryption / Decryption Device 10 Software Processing Block CPU
11 Encryption threshold determination block 12 Mac header generation block 13 Payload generation block 14 Encryption block 20 Device input / output IF
30 Protocol processing block 40 Encrypted / non-encrypted field classification means 50 Encrypted block 60 Encrypted data RAM
70 RAM for non-encrypted data
80 Encrypted / non-encrypted field reading means 90 Counter 100 Combined data RAM
110 FCS block 120 MAC-PHYIF
130 Encryption key RAM
135 MAC-PHYIF
140 FCS block 150 Decryption judgment block 160 First decryption / non-decryption field classification means 170 Decoding threshold determination block 175 Second decryption / non-decryption field classification means 180 Decryption block 190 Decryption key RAM
200 RAM for non-decoded data
210 Decoded data RAM
220 Decoding / non-decoding field reading means 230 Counter 240 Combined data RAM
250 Protocol processing block 260 Device input / output IF
270 CPU of software processing block
271 Packet Combining Block 272 Decoding Block

Claims (14)

In an encryption / decryption device that uses both encryption / decryption processing by hardware and encryption / decryption processing by software,
A packet receiving means for receiving a packet including a header that is a non-encryption target field and a payload that is an encryption target field;
A field length measuring means for measuring a field length of a packet received by the packet receiving means or a payload;
Based on the field length measured by the field length measuring means, hardware encryption / decryption processing is performed, software encryption / decryption processing is performed, or both hardware / software encryption / decryption processing is performed. Or a process determining means for determining
In the processing determining means, when it is determined to perform encryption / decryption processing by hardware or to perform encryption / decryption processing by both hardware and software, input means for inputting the payload in preference to the header; ,
An encryption / decryption device comprising:   2. The encryption / decryption device according to claim 1, wherein the processing determining means is provided on a hardware side or a software side. A threshold receiving means for receiving the first threshold and the second threshold from the user;
The processing determining unit compares the field length measured by the field length measuring unit with the first threshold received by the threshold receiving unit, and performs encryption / decryption processing by hardware, or by software. It is determined whether to perform the decoding process, and the field length measured by the field length measuring unit is compared with the second threshold value received by the receiving unit, and the encryption / decryption process is performed by both hardware and software. 3. The encryption / decryption device according to claim 1, wherein it is determined whether or not to perform. Threshold calculation means for calculating a first threshold and a second threshold based on the processing speed in the hardware encryption / decryption processing and the software encryption / decryption processing,
The processing determining means compares the field length measured by the field length measuring means with the first threshold value calculated by the threshold value calculating means, and performs encryption / decryption processing by hardware, or encryption / decryption by software The field length measured by the field length measuring unit is compared with the second threshold value calculated by the threshold value calculating unit, and the encryption / decryption process is performed by both hardware and software. 3. The encryption / decryption device according to claim 1, wherein whether to perform the determination is determined. Stores a payload obtained by performing encryption / decryption on the payload as the encryption / decryption target field by the encryption / decryption processing by the hardware, the encryption / decryption processing by the software, or the encryption / decryption processing by both the hardware and software. Encryption / decryption data storage means for
5. The encryption / decryption device according to claim 1, further comprising non-encrypted data storage means for storing a header that is the non-encrypted field to be decoded.   A packet detection unit for detecting a pair of packets from the encrypted / decrypted payload stored in the encrypted / decrypted data storage unit and the header stored in the non-encrypted / decrypted data storage unit; 6. The encryption / decryption device according to claim 5, wherein: A storage destination setting means for setting a header and a storage destination address of the payload;
The input means inputs the payload in preference to the header by setting the storage destination of the payload prior to the header by the storage destination setting means. The encryption / decryption device according to any one of the above.   The processing determining means is provided on the hardware side, and further includes a transferring means for transferring the encryption / decryption target field to the software side when the processing determining means performs encryption / decryption processing in both hardware and software. The encryption / decryption device according to claim 2.   The encryption / decryption device according to any one of claims 1 to 8, wherein the packet receiving unit receives a packet using an external input / output interface.   The process determining means performs hardware decoding, software decoding, or both hardware and software decoding based on the field length measured by the field length measuring means. 10. The encryption / decryption apparatus according to claim 1, wherein whether to perform the process is determined.   The encryption / decryption device according to claim 1, wherein the input unit inputs the software to the hardware.   7. The encryption / decryption apparatus according to claim 6, further comprising packet generation means for generating a packet by combining a header and a payload which are paired packets detected by the packet detection means. .   When it is determined that the encryption / decryption processing by both hardware and software is performed by the processing determination means, the payload subjected to encryption / decryption processing by hardware and the payload combined with the payload subjected to encryption / decryption processing by software 13. The encryption / decryption device according to claim 1, further comprising a combining unit. In an encryption / decryption device that uses both encryption / decryption processing by hardware and encryption / decryption processing by software,
A packet receiving function for receiving a packet composed of a header that is a non-encryption target field and a payload that is an encryption target field;
A field length measuring function for measuring the field length of the packet received by the packet receiving function or the payload;
Based on the field length measured by the field length measurement function, hardware encryption / decryption processing, software encryption / decryption processing, or both hardware / software encryption / decryption processing is performed. And a process determination function for determining
In the processing determination function, when it is determined to perform encryption / decryption processing by hardware, or to perform encryption / decryption processing by both hardware and software, an input function that inputs the payload in preference to the header; ,
A computer-readable storage medium in which an encryption / decryption program for executing is stored.

Images