JPS6373289A - Cryptographer - Google Patents

Abstract

(57) [Abstract] This bulletin contains application data before electronic filing, so abstract data is not recorded.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a cryptographic device, and particularly to a cryptographic device suitable for high-speed transfer of encrypted data and decrypted data to and from a host device.

[Conventional technology]

In conventional cryptographic devices, as a block data encryption method, a DES method CBC mode is known, in which an input data block is combined with a previously encrypted output data block to encrypt the data blocks in a chain manner. Such an encryption method is described in Japanese Patent Laid-Open No. 130505/1983.

Further, Japanese Patent Laid-Open No. 55-31377 describes an encryption device that improves processing speed by performing encryption processing in parallel in time using a plurality of encryption units.

[Problem that the invention seeks to solve]

However, the former publication does not consider the transfer capability when receiving a data block from a higher-level device and further transmitting an encrypted data block to the higher-level device. In addition, the method disclosed in the latter publication is a method in which one data block stream is divided into multiple data block streams and then encrypted or decrypted, so one data block stream cannot be decrypted or encrypted as is. The problem is that it cannot be used in combination with a cryptographic device that uses

The purpose of the present invention is to perform data block stream transmission/reception and data block encryption/decryption between the host device and the data block stream to be encrypted or decrypted and transferred to the host device. An object of the present invention is to provide a cryptographic device that improves processing speed by executing the above functions in parallel in time.

[Means for solving problems]

The present invention has an input buffer for storing data transmitted from a host device and an output buffer for storing data to be transferred to the host device. During periods other than the above, the input buffer is set to write mode and data transmitted from the host device is stored.

Also, the output buffer is set to write mode and data is written only during the period when data needs to be retrieved from the encryption circuit, and when the amount of encrypted data reaches a certain amount and the output buffer is not in the write mode, the output buffer is set to read mode and the upper Read the data to be transferred to the device.

[Effect]

In this way, data transmission/reception with the host device and data encryption/decryption are executed in parallel in time, thereby realizing an improvement in processing speed.

The present invention is effective when the processing speed of the encryption circuit is slower than the data transfer speed with the host device.

〔Example〕

An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 shows a configuration diagram of an embodiment of the present invention. Encryption device 1
is connected to a host device via an input/output control circuit 2. The input buffer 3 is a booter address switching circuit 5 for a write input address register 7 and a read input address register 8.
The six-output buffer 4 receives the data as an address signal 16 via the host device, stores the data received from the host device via the input/output control circuit 2, or supplies the read data to the encryption circuit 11. Receives the data in the write output register 10 as an address signal 17 via the address switching circuit 6, stores the data output from the encryption circuit 11, or transmits the read data to the host device via the input/output control circuit 2. do. B# circuit 11 supplies address update signals 18 and 19 to read input address register 8 and write output address register 10, respectively. The input/output control circuit 2 has a write input address register 7
, address update signal 1 to read output address register 9
4.15 respectively, and a switching signal 13 is supplied to the address switching circuits 5 and 6. The channel input bus 20 is a data line for storing data from the host device into the input buffer 3 via the input/output control circuit 2, the encryption input bus 21 is a data line for supplying data from the input buffer 3 to the encryption circuit 11, The encryption output bus 22 is a data line for supplying the data encrypted by the encryption circuit 11 to the output buffer 4, and the channel output bus 23 is a data line for sending the data in the output buffer 4 to the host device via the input/output control circuit 2. It is a data line.

The read permission circuit 24 receives the address update signal 18 from the encryption circuit 11 and sends the read permission signal 25 to the output buffer 4 when the number of times the address update signal 18 has been received exceeds a certain value.
give.

The following description will be made assuming that the data transfer speed between the host device and the encryption device is twice the processing speed of the encryption circuit.

FIG. 2-a is a schematic time chart showing the total processing time in the conventional method, and FIG. 2-b is a schematic time chart showing the total processing time in the present invention. FIG. 3 is a detailed time chart of one embodiment of the present invention shown in FIG.

In the conventional method, as shown in Figure 2-a, encryption processing is started after all data from the host device is stored in the input buffer 3, and each time the encryption processing result is output to the encryption output bus 22, it is output to the host device. Data is transferred. Therefore, in the conventional system, if the data transfer time from the host device to the encryption device 1 is T, the encryption processing time is 2T, and the total processing time is 3T.

On the other hand, as shown in Fig. 2-b, according to the present invention, the process of storing data from the host device in the input buffer 3 and the encryption process, and the encryption process and data transfer from the output buffer 4 to the host device are performed in parallel. The total processing time is 2.
It becomes T.

The operation of an embodiment of the present invention will be described below with reference to FIGS. 1 and 3, assuming that the amount of data transferred between the host device and the encryption device is 8 bytes.

Before starting data transfer from the host device to the cryptographic device 1, the write/read input address registers 7.8 and the read/write output address registers 9.1o are set to their initial values, that is, the beginning of the input/output buffer 3.4. Set it to the address.

When the input/output control circuit 2 becomes ready to receive data from the host device, it periodically inverts the switching signal 13, and further transfers the first byte of data from the host device to the channel input bus 2.
0 and gives a write signal to the input buffer 3 when the switching signal 13 is at the 1' level. As a result, the first byte of data (M(1)) is written to the start address (W(1)) of the input buffer 3. Note that when the switching signal 13 is 11 lbels, the address signal 16 contains the address information set in the address register 7, and the switching signal 13 is 10j.
When the level is 0, the address information set in the address register 8 is supplied.The input/output control circuit 2 sends the address update signal 14 to the address register 7 when the switching signal 13 becomes '0 level. , updates the contents of address register 7. The contents of address register 7 now change from W(1)I to W(2)I. Thereafter, similar operations are repeated until the 8th byte from the host device is written into the input buffer 3.

On the other hand, the encryption circuit 3 receives the even numbered 101 of the switching signal 13.
When the level is high, the data on the cryptographic input bus 21 is stored, and then the address update signal 18 is sent out to update the contents of the address register 8. The contents of address register 8 now change from R(1)I to R(2)H. Here W(
i)I and R(i)I (i=1 to 8) indicate the same address.

Next, a method for writing and reading data into the output buffer 4 will be explained. The output data of the cryptographic circuit 11 is determined after a certain period of time after input data is supplied to the cryptographic circuit 11, and the time is determined by the processing capacity of the cryptographic circuit 11. It is now assumed that the first output data is determined when the (i+1)th input data is set in the encryption circuit 11.

The cryptographic circuit 11 sends the second input data to the cryptographic input bus 2.
At the same timing as setting from 1, the first output data is placed on the encryption output bus 22 and a write signal is sent to the output buffer 4. As a result, the first output data (C(1)) of the cryptographic circuit 11 is written to the start address (W(Ode)) of the output buffer 4.The address signal 17 has a switching signal 13 of 10 lbs. When the switching signal 13 is at level 1, the address information set in the address register 10 is supplied.

Next, the encryption circuit 11 converts the address update signal 19 into the switching signal 1
When 3 becomes 11 lbel, it is sent to the address register 10 and the contents of the address register 10 are updated. The contents of address register 10 now change from W(1)() to W(2E]:.

Thereafter, similar operations are repeated until the eighth output data is written from the encryption circuit 11 to the output buffer 4.

Next, the operation after data transfer from the host device is completed will be explained. When the data transfer from the higher-level device is completed, the cryptographic device 1 uses the input/output control circuit 2 to report the completion of data transfer to the higher-level device. When the host device receives the completion report, it subsequently issues a command to the encryption device 1 to request transfer of the encrypted data to the host device. The cryptographic device 1 analyzes the command and transfers the cryptographic data stored in the output buffer 4 to the host device via the input/output control circuit 2. In this embodiment, it is assumed that the encryption processing time is twice the data transfer time with the host device, so it is only necessary to start encrypted data transfer to the host device after 1/2 of the total encryption output processing has elapsed. , this starting point is when the read permission signal of the read permission circuit 24 is output to the output buffer 4. The operation of the read permission circuit 24 will be described later.・From the address indicated by register 9 to output buffer 4
data, that is, the first encrypted output data, is read out and transferred to the host device via the input/output control circuit 2. Thereafter, when the switching signal 13 changes to the IO1 level, the input/output control circuit 2 sends out the address update signal 15 to update the contents of the address register 9. As a result, the contents of address register 9 are updated from R(0)61- to R(1)0. Thereafter, the 8th data is read from the output buffer 4 to the host device and the same operation is repeated until the transfer is completed. Note that W(i)e and R(i)e (i = 1 to 8)
indicate the same address.

Next, the operation of the read permission circuit 24 will be explained using FIG. 4. The read permission circuit 24 has a counter 26 and a flip
It is composed of a flop 27.

The counter 26 contains initial value data and an address update signal 18.
is input, and its output becomes the set input signal of the flip-flop 27. The output signal of the flip-flop 27 becomes the read permission signal 25.

In this embodiment, the counter 26 is set to (05) as initial value data before reading data from the input buffer 3. The counter 26 is internally stored every time the address update signal 18 is input. Subtract the value that is
When the value becomes (00), the output signal is sent to the flip-flop 27. The flip-flop 27 is set to a set state by the output signal of the counter 26 and sends a read permission signal 25 to the output buffer 4.

Generally, assuming that the encryption processing time is n times the data transfer time between the host device and the encryption device (n > 2), and that m bytes are processed in - times of processing, the counter 26 of this embodiment has As initial value data.

It is sufficient to set (m-m/n)+1.

According to this embodiment, the data transfer between the host device and the encryption device 1 and the cryptographic processing by the encryption circuit 11 can be executed in parallel, so the time that the host device occupies the encryption device 1 is reduced to 2/3 of that of the conventional method. effective.

In the explanation of this example, data encryption was cited, but
Data decryption, that is, the process of receiving ciphertext human-powered data from a higher-level device and transmitting plaintext output data obtained by decrypting the ciphertext human-powered data to the higher-level device, is also the same as data decryption by the encryption circuit 11. The same is true.

〔Effect of the invention〕

According to the present invention, the data transfer process with the host device and the encryption/decryption process can be executed in parallel in time, so when the data transfer process time is T and the encryption process time is nT (n>1). , the cryptographic processing time including data transfer seen from the host device is (1) when 1<n≦2 -2T (2) when n>2...nT Furthermore, when n>2, the cryptographic processing time is nT data transfer time 2T and time without parallel processing, i.e. (n-2)
If you add a means to disconnect the logical connection between the upper-level device and the encryption device, the time T will be reduced to 2T,
This has the effect of shortening the time.

[Brief explanation of the drawing]

Fig. 1 is a block diagram of an embodiment of the present invention, Fig. 2-a is a schematic time chart showing the total processing time of the conventional method, and Fig. 2-b is a schematic time chart showing the total processing time of the conventional method.
The figure is a schematic time chart showing the total processing time in the present invention,
FIG. 3 is a detailed time chart of FIG. 1. FIG. 4 shows an example of the configuration of the read permission circuit 24 shown in FIG. 1. 1... Encryption device, 2... Encryption circuit, 3... Input buffer, 4... Output buffer, 7, 8, 9.10...
-Address register, 24...read permission circuit. 1. 40 2-α 2-F)■ Topic Ginshōre

Claims (1)

[Claims] 1. A function to encrypt data given from a host device according to an encryption key and an encryption algorithm, and to transfer the encrypted data to a host device, and to decrypt encrypted data given from a host device according to a decryption key and a decryption algorithm, In an encryption device having a function of transferring decrypted data to a host device, an input buffer capable of storing input data transmitted from the host device and reading out the input data supplied to an encryption or decryption circuit in a time-sharing manner; An output buffer capable of storing output data encrypted or decrypted by an encryption or decryption circuit and reading out the output data to be transferred to a host device in a time-sharing manner; 1. A cryptographic device comprising a circuit that allows reading of an output buffer at times.