KR100416235B1 - Cryptography processing apparatus for a high speed radio network switch - Google Patents

Abstract

The present invention relates to an encryption processing apparatus for a high-speed radio network switch, comprising: a memory storage unit for storing input / output protocol packets or extracting data and instructions from the packets; and data extracted from the packets and packets, control signals and instructions. A shared memory storage unit for storing data, a memory control unit for performing synchronization with the input / output control of the memory storage unit and the shared memory storage unit, a cryptographic processing unit for processing confidentiality and integrity verification encryption algorithms, and external input / output An external input / output controller for controlling the packet, an external network interface block for performing packet analysis on packets received from an external network connection network, and transmitting the analyzed packet to the encryption processing unit, the memory storage unit, or the shared memory storage unit; , It includes a central processing unit that performs basic protocol analysis, packet processing, memory management, shared memory management, and cryptographic processor control, and provides a cryptographic processor structure with high throughput, small response time, input / output memory structure, and scheduler structure.

Description

Cryptographic processing unit for high-speed radio network switch {CRYPTOGRAPHY PROCESSING APPARATUS FOR A HIGH SPEED RADIO NETWORK SWITCH}

The present invention for handling as, more particularly, air-tightness (Confidentiality) processing and integrity (Integrity) verification cipher algorithm in high-speed radio network switch of the 3GPP (3 ^rd Generation Partnership Project) system according to the encryption processing device for high-speed radio network switch A cryptographic processing apparatus for a high speed radio network switch.

In general, a high speed radio network controller (RNC) system requires a high speed packet encryptor because a plurality of subscriber channels of a 3GPP system having a bandwidth of up to 2 Mbps must be processed.

Cryptographic algorithms defined in the 3GPP system include the authentication section, including f0, a random number generation algorithm, f1 algorithm for network authentication, f1 * algorithm for resynchronization message authentication, f2 algorithm for subscriber authentication, and wireless section encryption key. The f3 algorithm for generation, the f4 algorithm for generating the wireless interval integrity key, the f5 algorithm for generating the subscriber anonymity key, and the f5 * algorithms for generating the resynchronization anonymous key are defined.

In addition, 3GPP has recently recognized the necessity of encryption in the RNC system and has defined the f8 algorithm for wireless section user data encryption and f9, which is a wireless section user traffic integrity verification algorithm, in the TS33.102 v3.7.0 standard document.

On the other hand, general RNC system processes RLC, RRC and MAC protocols using general-purpose or digital signal processing processor such as PowerPC 750, StrongARM processor and TMS320 processor, and performs various call processing, call connection, packet processing, etc. do.

However, since the confidentiality algorithm f8 and the integrity algorithm f9 are used in RNC equipment requiring high speed and wide bandwidth, they must have high throughput and small response time.

However, using a conventional general-purpose or digital signal processing processor to handle cryptography requires high costs, such as additional processors or additional boards, and it is difficult to satisfy cryptographic performance. There is a problem.

The present invention has been proposed to solve the above-mentioned conventional problems, and its object is to have a high throughput and a small response time so that a large amount of data can be processed at the same time and small for data having a small size. The present invention provides a cryptographic processing device for a high-speed radio network switch that can be processed quickly with delay.

In systems that require high-speed processing of large amounts of input data, such as RNC, the performance of each of these components is also important.However, interface matching and structure such as its interface structure, memory configuration method, operation method, and connection structure with surrounding blocks are very important. It is important.

Therefore, the present invention has an independent controller, a scheduler, and a multi-buffer controller, and the encryption processing unit using the central processing system using a multi-processor structure or a parallel processing structure using a pipelined technique capable of processing a plurality of inputs simultaneously. By reducing the load on the device, it has a high throughput for multiple input data and ensures fast response time for each input data.

Having a DMA processor, the cryptographic processing unit can perform the operation of importing data to be processed from the memory device or writing the processed data to the memory device independently of the central processing unit, causing almost no load on the central processing unit of the system. This does not improve the overall system performance.

In addition, it provides an input / output structure, a controller structure, a network structure, a scheduler structure, and an input / output memory structure when constructing a cryptographic processing system using multiple cryptographic processing units. to provide.

The present invention for realizing the above object is a cryptographic processing apparatus for a high speed radio network switch for processing confidentiality processing and integrity verification cryptographic algorithm in a high speed radio network switch, the data input and output protocol packet is stored or extracted from the packet A memory storage unit for storing instructions and control signals, a shared memory storage unit for storing packets and data extracted from the packets, control signals and commands, and input / output control and synchronization of the memory storage unit and the shared memory storage unit; Performs a packet analysis operation on a memory controller to perform, a cryptographic processing unit processing a confidentiality and integrity verification encryption algorithm, an external input / output control unit controlling external input / output, and a packet received from an external network connection network, Prize An external network interface block to be transmitted to the existing cryptographic processing unit, the memory storage unit or the shared memory storage unit, and a central processing unit for performing basic protocol analysis and packet processing, memory management, shared memory management, and cryptographic processor control. .

1 is a block diagram of an encryption processing apparatus for a high speed radio network switch according to the present invention;

2 is a detailed configuration diagram of a cryptographic processing unit according to an embodiment of the present invention;

3 is a detailed configuration diagram of a cryptographic processing unit according to another embodiment of the present invention;

4 is a flowchart illustrating an encryption processing by the encryption processing apparatus for a high speed radio network switch according to the present invention;

5 is a detailed block diagram of an external network interface block for the encryption processing apparatus for a high speed radio network switch according to the present invention.

<Explanation of symbols for the main parts of the drawings>

100: central processing unit 101: memory storage unit

102: shared memory storage unit 103: system bus

104: bus bridge 105: memory control unit

106: input and output bus 107: encryption processing unit

108: external input / output control unit 109: external network interface block

110: external network connection network 200: DMA controller

201: switch controller 202: password processing controller

203: Memory Pointer 204: Scheduler

205: state storage unit 206: input selector

207: switch 208: input / output memory

209: multiple password processing unit 210: output unit

There may be a plurality of embodiments of the present invention. Hereinafter, preferred embodiments will be described in detail with reference to the accompanying drawings. This embodiment allows for a better understanding of the objects, features and advantages of the present invention.

The encryption processing apparatus for a high-speed radio network switch according to the present invention, as shown in the configuration diagram of Fig. 1, the central processing unit 100, memory storage unit 101, shared memory storage unit 102, system bus 103, the input / output bus 106, the bus bridge 104 connecting the system bus and the input / output bus, the memory control unit 105, the cryptographic processing unit 107, the external input / output control unit 108, the external network interface block 109, an external network connection network 110.

The central processing unit 100 performs basic protocol analysis and packet processing, memory management, shared memory management, cryptographic processor control of the RNC system, and controls the cryptographic processing unit 107 or the cryptographic processing unit 107. ), A job for inputting necessary data, a job for reading a result processed by the password processing device unit 107, and the like, for controlling encryption processing. Since the central processing unit 100 takes a considerable load due to a large number of processing demands, this may cause a failure in the non-cryptographic operation processing of the entire RNC system, and thus the structure of the encryption processing unit 107 in the direction of reducing the load as much as possible. You need to design a bus interface structure or shared memory structure for this.

The memory storage unit 101 stores an input / output protocol packet in a high speed radio network switch or stores data, commands, and control signals extracted from the packet, and is used as a communication means between blocks constituting the network switch. The memory storage unit 101 is connected to the system bus 103 and to the central processing unit 100 and the peripheral block. Bus bridge 104 circuit connecting the system bus 103 to the input / output bus 106 in order to communicate with peripheral blocks connected to the input / output bus 106 such as the encryption processing unit 107 or the external input / output control unit 108. Must pass through

The shared memory storage unit 102 is a storage device for efficiently communicating data and commands with the central processing unit 100 and the peripheral blocks 107 and 112 in a high speed radio network switch system. Extracted data can be saved and control signals and commands can be saved. The shared memory storage unit 102 is a memory space in which the components of the system can be viewed at the same address. The shared memory storage unit 102 can freely read the space, but it is difficult to set access authority, set priority, and maintain consistency in order to write. need. This operation is performed by the memory controller 105.

The system bus 103 connects the central processing unit 100 with the memory storage unit 101, the shared memory storage unit 102, the memory control unit 105, and the bus bridge 104 to communicate high speed data therebetween. To make it possible.

The bus bridge 104 connects the system bus 103 and the input / output bus 106. For example, in the case of using a PCI bus as an input / output bus, the bus bridge 104 may be a PCI bridge circuit and connect blocks having a plurality of PCI interfaces.

The memory control unit 105 is a part for performing input / output control and synchronization of the memory storage unit 101 and the shared memory storage unit 102, and is connected to the system bus 103.

The input / output bus 106 is a bus connecting the cryptographic system and the external input / output control unit 108, for example, a PCI bus. I / O buses use highly scalable ones.

The encryption processing unit 107 is hardware for processing confidentiality and integrity verification encryption algorithms in a high speed radio network system, and performs the KASUMI, f8, and f9 encryption algorithms at high speed.

The external input / output control unit 112 controls external input / output of the confidentiality and integrity verification cryptographic system for a high-speed radio network switch. An RNC system requires an Ethernet interface, a core network interface, and an ATM interface.

The external network interface block 113 is an interface that interfaces with the external network connection network 114. The external network interface block 113 performs packet analysis in hardware on packets received from the external network, and the analyzed packets are located in the external network interface block 109. If encryption is required immediately after being stored in the shared memory for input / output, it is transmitted to the encryption processing unit 107, and when the central processing unit 100 requires further processing, the memory storage unit 101 or shared memory in the system. Is transferred to the storage unit 102. In addition, when the system wants to transmit data to the external network, it is stored in the shared memory for input / output, and then the packet is created in dedicated hardware.

The external network connection network 114 is an input / output connection network to which a high speed radio network switch is connected, and may be an ATM network, an Ethernet, or a core network.

The central processing unit 100 receives the encryption processing request of the application program and transmits the corresponding command to the encryption processing unit 107 together with the address information. In this case, the encryption processing unit 107 directly performs the necessary communication with the shared memory storage unit 102 when checking and using the DMA, and when not using the central processing unit 100 Data is read from the shared memory storage unit 102 and inputted to the encryption processing unit 107 or vice versa. In the shared memory access, physical timing adjustment is performed by the memory controller 105, and the connection between the system bus 103 and the input / output bus 106 is performed by the bus bridge 104.

As shown in FIG. 2, the encryption processing unit 107 includes the DMA controller 200, the switch controller 201, the encryption processing controller 202, the scheduler 204, the memory pointer 203, and the state storage unit 205. The elements constituting the data path include an input selector 206, a switch 207, an input / output memory (or a multi-buffer) 208, a multiple encryption processing unit 209, and an output unit 210. .

The DMA controller 200 is a part that enables data communication from the shared memory storage unit 102 of the system where the cryptographic processor is used without the intervention of the central processing unit 100, and communicates or centralizes a large amount of data. It is used to reduce the load of the device unit 100.

The switch controller 201 is a part for performing data path control between the input / output memory 208 and the multiple encryption processing unit 209, and has a state of operating and occupied state information of the scheduler 204 and the input / output memory 208. Communicate with the reservoir 205 to create an optimal switch connection situation.

The cryptographic processing controller 202 controls the general operation of the multiple cryptographic processing unit 209. The multiple cryptographic processing unit 209 composed of a plurality of cryptographic processors performs parallel processing, and the cryptographic processing controller 202 performs control through appropriate communication with the scheduler 204 and the switch controller 201 in consideration of this.

The scheduler 204 controls the input / output memory 208 of the multiple cryptographic processing unit 209 to perform efficient cryptographic processing bonsai work. The scheduler 204 checks input commands and data, selects an appropriate input / output memory 208, and reads and Perform a write.

The memory pointer 203 has address information about the data stored in the input / output memory 208 and read and write address values, and stores the desired data in the output unit 210 or the multiple encryption processing unit 209.

The state store 205 has operation state information of the multiple encryption processing unit 209 and state information of the input / output memory 208.

The input selector 206 selects a case of receiving an input from the outside and a part of receiving the output from the multiple encryption processing unit 209.

The switch 207 is used to set the data path of the input / output memory 208 used for both input and output and to set the storage data path of the scheduled input data. An all-to-all connection is used to ensure maximum parallel processing characteristics of the multiple cryptographic processing unit 209.

The input / output memory 208 is required as many as the number of cryptographic processors constituting the multiple cryptographic processing unit 209 and is used as the input / output common memory of each cryptographic processor. By using the input / output memory 208 in common, the memory requirement is reduced in f8, which is a confidentiality algorithm of the 3GPP system.

The multiple cryptographic processing unit 209 is configured in a structure that can be processed in parallel by multiple cryptographic processors. The output unit 210 outputs the result stored in the input / output memory 208 by an appropriate control signal.

As described above, a high performance cryptographic processor may be implemented using a plurality of cryptographic processors and a pipelined technique.

3 illustrates an input / output structure and a controller structure of a cryptographic processing unit using a cryptographic processing unit 309 to which a pipeline technique is applied according to another embodiment of the present invention. In FIG. 3, the same reference numerals are used for the same components as in FIG. 2.

Since the cryptographic processing unit 309 is configured by applying a pipeline, the input scheduler 311 is controlled by the scheduler 204, which can be viewed as a MUX circuit having a control signal.

In order for the new data to be used in the cryptographic processing unit 309 implemented as a pipeline, the data is stored in the input buffer and waits until the operation calculated in all pipelines is completed. There is a method in which new data and key values are input and executed at the timing. The present invention has a state store 205 for notifying a plurality of calculated result values as an interrupt so that the latter method can be applied, and for storing the operation status of each pipeline. In addition, the scheduler 204 allocates an empty input / output memory 208 for new input data and controls the input to the desired pipeline slot.

4 is an operation flowchart of an encryption processing apparatus using a multiple encryption processing unit as shown in FIG. 2.

First, the cipher processing command generated by the central processing unit 100 makes the multiple cipher processing unit 211 start from the initial state, and the multiple cipher processing unit 209 checks whether it is available among the cipher processors that are not currently operating. Go through the steps (S400 ~ S404).

The multi-cipher processing unit 209 performs a step of checking whether there is a password processor that can be used again at an appropriate time while remaining in a standby state when no password processor is currently available. Here, the waiting time interval until checking the available channel again may be defined (S405).

When the available channel is checked, that is, when there is a cryptographic processor available, the multiple cryptographic processing unit 209 reserves the corresponding cryptographic processor, and the central processing unit 100 checks whether the DMA controller 200 is used. (S406 to S407).

When the DMA controller 200 is used, the load of the central processing unit 100 is less. When the DMA controller 200 is not used, the central processing unit 100 performs operations such as data input / output and calculation results. It is important to keep track of the end time.

Referring to the operation flow when the DMA controller 200 is not used, the CPU 100 stores data of the corresponding address from the shared memory storage 102 in the input / output memory 208 and the corresponding key value. It also stores (S408 to S409).

When the storage of the data and the key value is completed, the corresponding encryption processor of the multiple encryption processing unit 209 performs an operation, and the central processing unit 100 waits until the operation of the encryption processing unit is finished. This operation is controlled by the cryptographic processing controller 202 (S410 to S412).

When the operation of the encryption processor is terminated, the encryption processing controller 202 generates an interrupt signal to the central processing unit 100 to notify that the operation is finished. On the other hand, the operation result is stored in the same input and output memory 208 through the switch 207 and the switch controller 201 where the input data is stored.

After the operation is finished, the central processing unit 100 reads the value of the memory pointer 203 of the cryptographic processing unit 107 to read the result value, checks the address value of the input / output memory 208 where the result is stored, and stores the state storage. (205) The normal operation is read by reading the value (S413).

In the case where the result value is successfully read, the central processing unit 100 updates the value of the state store 205 and confirms that the result value is normally read. At this time, the read result value is stored in the shared memory storage unit 102 to continue the subsequent work (S414 to S415).

Referring to the operation flow in the case of using the DMA controller 200, the multi-cipher processing unit 209 checks the available encryption processor to reserve a channel, the DMA controller 200 establishes a DMA path (S416).

After the DMA path is established, the DMA controller 200 reads data or command information from the corresponding address value of the shared memory storage unit 102. At this time, the data transmission is performed without the intervention of the central processing unit 100. The data or command information is stored in the input / output memory 208 and used as data or key values (S417 to S418).

After the data necessary for the encryption processing operation is input, the operation of the encryption processing unit 107 starts, and the DMA controller 200 waits for the completion of the encryption processing operation, and when the operation is completed, the result is shared memory storage unit 102 (S419 to S421).

At this time, the subject that transmits the result value to the shared memory storage unit 102 is not the central processing unit 100 but the DMA controller 200. After the operation on the result value is completed, this state is stored in the state store 205 to continue the subsequent operation (S422 to S423).

In the case of performing encryption processing using the DMA controller 200, data communication between the encryption processing unit 107 and the shared memory storage unit 102 is transmitted in packet units, and packets that are processed at one time are defined as sessions. . Therefore, when the processing for one session is finished, this value is stored in the input / output memory 208, and when all session processing of a job is not finished, the DMA controller 200 resets the DMA address and then starts reading the DMA data. Start again (S424-S425).

If the operation for all sessions is completed, go to the initial state (S426).

5 is a detailed block diagram of an external network interface block for the encryption processing apparatus for a high speed radio network switch according to the present invention.

The external network interface block 109 includes an input terminal 501 and an output terminal 508 connected to the external network connection network 110, an input / output bus connection port 505 of the system, a receiving buffer 502 and a transmitting buffer ( 507, a packet analyzer 503 and a packet writer 506, an input / output shared memory 504, a DMA control unit 509, and a shared memory control unit 510.

Looking at the operation of the external network interface block 109 as described above, the packet received from the external network connection network 110 is stored in the receiving buffer 502 and performs packet analysis through the packet analyzer 503 in hardware, When the analyzed packet is stored in the input / output shared memory 504 and immediately encrypted, it is transmitted to the encryption processing unit 107 through the input / output bus connection port 505 of the system, and the central processing unit 100 When further processing is required, data is transferred to the memory storage unit 101 or the shared memory storage unit 102 in the system.

In this way, since the external network interface block 109 can directly communicate with the encryption processing unit 107 with respect to the packet requiring encryption processing without the intervention of the central processing unit 100, high-speed processing is possible.

The external network interface block 109 communicates with the DMA processor 200 of the encryption processing unit 107 by the DMA control unit 509 to perform DMA transfer when the DMA transfer is required, and the memory storage unit of the system ( When the DMA transfer is required for the 101 and 102, it communicates with the memory control section 105 of the system to transfer the data.

Consistency and data management of the shared memory 504 for input / output of the external network interface block 109 is performed by the shared memory controller 510, which is the shared memory storage unit 102 of the system. And the memory are recognized in the same address space as that of the input / output memory 208 of the encryption processing unit 107.

In the above description, but limited to one embodiment of the present invention, it is obvious that the technology of the present invention can be easily modified by those skilled in the art. Such modified embodiments should be included in the technical spirit described in the claims of the present invention.

The encryption processing apparatus for a high speed radio network switch of the present invention having the structure as described above has the following effects.

First, it has a multiple encryption processing unit, a DMA controller, and a shared memory storage device, thereby providing a high throughput. In addition, due to the multi-buffer structure, the corresponding scheduler, and the multi-interrupt processing capability, the response time is fast for specific input data. Therefore, it can be efficiently used in the RNC equipment of the 3GPP system that requires a large amount of data processing.

Second, since it has a structure that can efficiently accommodate parallel cryptographic processors implemented by multiple cryptographic processing units and pipelined techniques with multiple parallelized cryptographic processors, high-performance 3GPP confidentiality and integrity cryptographic systems can be implemented.

Third, it is highly scalable and portable because it has a DMA function, easily interfaces with existing commercial I / O buses, and communicates with a central processing unit of a system to be mounted in a shared memory system. In other words, it is easy to apply to existing RNC system.

Claims (10)

A cryptographic processing apparatus for a high speed radio network switch for processing confidentiality processing and integrity verification cryptographic algorithm in a high speed radio network switch, A memory storage unit for storing input / output protocol packets or data, instructions, and control signals extracted from the packets; A shared memory storage unit for storing packets, data extracted from the packets, control signals, and instructions; A memory controller for performing synchronization with the input / output control of the memory storage unit and the shared memory storage unit; A cryptographic processing unit for processing confidentiality and integrity verification cryptographic algorithms, An external I / O control unit for controlling external I / O, An external network interface block configured to perform packet analysis on packets received from an external network connection network, and to transmit the analyzed packets to the encryption processing unit, the memory storage unit or the shared memory storage unit; A cryptographic processing device for a high speed radio network switch comprising a central processing unit that performs basic protocol interpretation and packet processing, memory management, shared memory management, and cryptographic processor control. The apparatus of claim 1, wherein the encryption processing unit A DMA controller for enabling data communication from the shared memory storage unit without intervention of the central processing unit; A multiple cryptographic processing unit structured to be processed by multiple cryptographic processors in parallel, A plurality of input / output memories used as input / output common memory of each cryptographic processor, A scheduler for controlling the input / output memory to perform an efficient encryption processing bonsai operation; And a cryptographic processing controller for controlling the general operation of the scheduler and the multiple cryptographic processing unit. The method of claim 2, wherein the DMA controller is A high speed radio network switch, characterized in that the data storage device or the shared memory storage unit inputs and outputs data or commands without the intervention of the central processing unit, and processes a large amount of data required by the multiple cryptographic processor at high speed. Password processing unit for. 3. The scheduler of claim 2, wherein the scheduler is A cryptographic processing device for a high speed radio network switch, characterized in that the scheduling of the input and output data to the parallel cryptographic processor designed as the multiple cryptographic processing unit or pipeline. The method of claim 2, wherein the multiple encryption processing unit A cryptographic processing device for a high speed radio network switch, characterized in that it can accommodate a pipelined cryptographic processor. The system of claim 1, wherein the central processing unit The shared memory storage unit communicates with a cipher processing unit or a peripheral block, and the central processing unit and the cipher processing unit use the same address space so that high-speed communication is possible. Processing unit. The method of claim 1, wherein the memory control unit And performing access control and input / output control of the memory storage unit and the shared memory device unit, and maintaining a consistency function of the shared memory device unit. The cryptographic processing unit of claim 5, wherein the pipelined cryptographic processing unit Cryptographic processing apparatus for a high-speed radio network switch, characterized by using a cryptographic processor that can perform high speed with a pipeline technique. The method of claim 1, wherein the external network interface block Cryptographic processing apparatus for a high-speed radio network switch, characterized in that for performing the packet analysis operation and the packet creation operation using hardware for data transmitted and received from the external network. The method of claim 1, wherein the external network interface block And a shared memory for the input / output memory and a shared memory controller, the apparatus having the same address space as the shared memory of the system and the input / output memory of the encryption processing unit.