RU147520U1 - DATA PROCESSING DEVICE - Google Patents

Abstract

A data processing device made in the form of a cryptographic unit including a processor, a cryptographic coprocessor and non-volatile memory connected to a power supply unit made in the form of a rechargeable battery and connected to the IEEE 802.11 radio interface with a radio antenna, as well as with USB and RS-232 wired interfaces, characterized in that in the portable case there is a cryptographic unit containing an intra-unit system communication channel to which through the first, second, third and fourth two-way of the communication channels, a processor, a dual-core cryptographic coprocessor, the first and second universal asynchronous transceivers UART, respectively, a clock generator, to the output of which a clock input of a cryptographic block, a non-volatile memory connected to an intra-block system communication channel via a fifth bidirectional communication channel to which it is connected, are connected a programmer connected to the RS-232 wired interface, and a power supply unit made in the form of a battery, with unified with the voltage step-down converter unit, while a clock generator, a cryptographic unit, a non-volatile memory and an IEEE 802.11 n radio interface with an antenna are connected to the power supply unit, an output connector of the device operation mode switch is connected to the control ports of the dual-core cryptographic coprocessor through the control bus of the second bidirectional communication channel , the first universal asynchronous UART transceiver connected via a USB / UART interface converter to a USB wired interface

Description

The utility model relates to cryptography and can be used to implement a secure protocol for exchanging data messages between a computer peripheral device and a small mobile device via a wireless communication channel.

Known modular cryptographic device [US patent No.20050216751, IPC H04L 9/00, publ. 09/29/2005], comprising a first cryptographic module housing including a local area network (LAN) user interface connected to a cryptographic processor connected to a first connector and a removable second communication module housing including a second connector connected to a wireless local area network (LAN) network interface ) with the function switching modes of its operation, connected to a cryptographic processor. The first cryptographic module housing additionally includes a power supply, to which a cryptographic processor, user and wireless network interfaces of a local area network (LAN) are connected. A cryptographic processor that implements an encryption algorithm that provides a given level of cryptographic protection includes a network host processor connected to a local area network (LAN) user interface and a cryptographic circuit, and a cryptographic processor shutdown circuit during manipulations with the first cryptographic module body. A wireless local area network (LAN) interface includes, for example, a WLAN communication scheme (for example, a set of chips implementing 802.11 a, b, g communication standards) for communicating with antennas.

The disadvantages of the known device are the low data exchange rate over the network wireless interface of the local area network, implemented in accordance with the IEEE 802.11 a, b, g communication standard, and the low functionality of the cryptographic unit.

The closest technical solution to the claimed is a data processing system [patent DE No. 102004014411, IPC H04L 9/32, H04L 12/28, publ. 10/13/2005], designed to exchange data between small mobile devices over the air. The system comprises a data processing device made in the form of a cryptographic unit including a processor, a cryptographic coprocessor and various types of memory (random access memory (RAM), read-only memory (ROM) and non-volatile memory (EPR)), an authentication device, including an authentication unit, a wireless interface and a fingerprint scanner, a light emitting diode and / or display, as well as a power supply unit made in the form of an internal battery. The data processing device is connected to a wireless interface, made in the form of a radio interface with an antenna, and with at least one wired interface. Data is exchanged between the data processing device and the authentication device via a wireless interface implemented in accordance with the IEEE 802.11 a, b, g communication standard, and at least one wired interface implemented using USB, RS-232. The system may further comprise a switch for turning on / off the functions of an authentication unit connected to a cryptographic unit connected to additional storage means of a computer program for performing the authentication process. Cryptographic functions are available only when they are activated by the mentioned switch. A cryptographic unit, a radio interface with an antenna, a switch for turning on / off the functions of the authentication unit, the mentioned additional storage means, a light-emitting diode and / or display are connected to the power supply.

The disadvantages of this technical solution are the low speed of data exchange over the radio interface, implemented in accordance with the communication standard IEEE 802.11 a, b, g, and the low functionality of the cryptographic unit.

The objective of the utility model is to create a portable device for data processing, made in the form of a cryptographic unit, performing cryptographic data conversion in accordance with GOST 28147-89 when implementing a secure or open protocol for exchanging data messages between a computer peripheral device and a small mobile device via a radio interface implemented in Complies with the IEEE 802.11 n Communication Standard.

Technical results - expanding the functionality of the cryptographic unit and increasing the speed of data exchange.

The problem is solved in that in a device for processing data made in the form of a cryptographic unit including a processor, a cryptographic coprocessor and non-volatile memory connected to a power supply unit made in the form of a battery and connected to the IEEE 802.11 radio interface with a radio antenna, and also with USB and RS-232 wired interfaces, according to the claimed technical solution, a cryptographic unit containing an intra-unit system communication channel to which through the first, second, third, and fourth bi-directional communication channels, a processor, a dual-core cryptographic coprocessor, a first and second universal asynchronous UART transceivers, respectively, a clock generator, to the output of which a clock input of a cryptographic block, a non-volatile memory connected to an intra-block system communication channel are connected via fifth bidirectional communication channel to which a programmer is connected, connected to the RS-232 wired interface and a power supply unit, made in the form of a battery connected to a block of step-down voltage converters, while a clock generator, a cryptographic unit, a non-volatile memory and an IEEE 802.11 n radio interface with an antenna are connected to the power supply unit to the control ports of a dual-core cryptographic coprocessor via the control bus of the second a bi-directional communication channel, the output connector of the device operation mode switch is connected, the first universal asynchronous UART transceiver is connected through a USB / UART interface converter with a USB wired interface, and a second universal asynchronous UART transceiver with an IEEE 802.11 n radio interface with a radio antenna, the dual-core cryptographic coprocessor that implements the specified cryptographic conversion standard, contains a data encryption core that includes blocks for the execution of the corresponding data encryption modes of a given standard cryptographic transformations, and a data decryption kernel, including blocks for performing the corresponding data decryption modes predetermined standard cryptographic transformations, additionally portable housing arranged time pulse generator provided with built-in rechargeable battery and connected to the communication channel system vnutriblochnomu tenth through bidirectional communication.

Due to the fact that the cryptographic block contains an in-block system communication channel, to which, through a second bi-directional communication channel, a dual-core cryptographic coprocessor is connected that implements a given standard of cryptographic transformations, comprising a data encryption core, including blocks for performing corresponding data encryption modes of a given cryptographic transform standard and a data decryption core including execution units of respective data decryption modes given of standard cryptographic transformations, and to the control ports of a dual-core cryptographic coprocessor via a second bidirectional bus control link is connected the output terminal of the mode switch device, the choice of operating modes is provided a dual-core cryptographic coprocessor and as a consequence, there is an extension of functionality of the cryptographic unit.

Due to the fact that the second universal asynchronous UART transceiver is connected to the radio interface with the radio antenna, implemented in accordance with the IEEE 802.11 n communication standard, an increase in the data exchange rate is provided.

Due to the fact that in addition to the portable case there is a time pulse generator equipped with a built-in rechargeable battery and connected to the intra-unit system communication channel via the tenth bidirectional communication channel, the cryptographic strength of cryptographic data conversion in gamma and gamma modes with feedback is provided.

The essence of the utility model is illustrated by reference to the accompanying drawings, in which:

FIG. 1 depicts a general block diagram of an inventive data processing device;

FIG. 2 is a block diagram of a cryptographic conversion unit in a simple replacement mode;

FIG. 3 is a block diagram of an algorithm for performing cryptographic conversion in a simple replacement mode;

FIG. 4 is a block diagram of a cryptographic conversion unit in gamma mode;

FIG. 5 is a block diagram of an algorithm for performing cryptographic conversion in gamma mode;

FIG. 6 is a block diagram of a cryptographic conversion unit in a gamma-feedback mode;

FIG. 7 is a flowchart of a cryptographic conversion algorithm in a gamma mode with feedback.

In the portable case 1 of the device, a cryptographic unit 2 is located, containing an intra-unit system communication channel 3, to which, through the first 4 _1, second 4 ₂ , third 4 ₃ and fourth 4 ₄ bidirectional communication channels, processor 5, a dual-core cryptographic coprocessor 6, the first 7 ₁ and second July ₂ universal asynchronous transceiver (UART), respectively, the clock generator 8, the nonvolatile memory (ENZP) 9, a power supply 10, configured as a battery 11 connected to the transformation unit 12 reducing ovateley voltage.

The control, signal and address ports of the processor 5 are connected to the corresponding buses of the intra-unit system communication channel 3 via the corresponding buses of the first 4 ₁ bi-directional communication channel (not shown in Fig. 1). The control and signal ports of the cryptographic coprocessor 6 are connected to the corresponding buses of the intra-unit system communication channel 3 via the corresponding buses of the second 4 ₂ bidirectional channels (not shown in Fig. 1). The control and signal ports of the first 7 ₁ universal asynchronous transceiver (UART) via the corresponding buses of the third 4 ₃ bidirectional channels are connected to the corresponding buses of the intra-unit system communication channel 3 (not shown in Fig. 1). The control and signal ports of the second 7 ₂ universal asynchronous transceiver (UART) via the corresponding buses of the fourth 4 ₄ bidirectional channels are connected to the corresponding buses of the intra-unit system communication channel 3 (not shown in Fig. 1).

The output of the clock generator 8 is connected to the clock port of the cryptographic unit 2.

To the clock port of the cryptographic unit 2 are connected the clock inputs of the processor 5, the dual-core cryptographic coprocessor 6, the first 7 ₁ and the second 7 ₂ universal asynchronous transceivers (UART) (not shown in Fig. 1).

Non-volatile memory (EEC) 9 for 256-bits, consisting of eight 32-bit drives, is connected to the intra-unit system communication channel 3 through the fifth 4 ₅ bi-directional communication channel, to which, through the sixth 4 ₆ bi-directional communication channel, a programmer 13 connected to RS is connected -232 wired interface 14. Moreover, the RS-232 wired interface 14 is made in the form of an output connector DE-9 on a portable housing 1 of the device.

In the reprogramming mode via RS-232, the wired interface 14 is connected to the data processing device by an external computer (not shown in Fig. 1).

The control, signal, and address ports of non-volatile memory (EEC) 9 are connected to the corresponding buses of the intra-unit system communication channel 3 via the corresponding buses of the fifth 4 ₅ bi-directional communication channel (not shown in Fig. 1). The control and signal ports of the programmer 13 (respectively not shown in FIG. 1) are connected to the control and signal ports of the non-volatile memory (EEC) 9 via the corresponding buses of the sixth 46 bi-directional communication channel.

To the control ports of the dual-core cryptographic coprocessor 6 through the control bus of the second 4 ₂ bidirectional communication channel is connected to the output connector of the switch 15 of the operating modes of the device.

The first 7 ₁ universal asynchronous transceiver (UART) is connected via a seventh 4 ₇ bi-directional communication channel with a converter 16 of USB / UART interfaces connected via an eighth 4 ₈ bi-directional communication channel with a USB wired interface 17. Moreover, the USB wired interface 17 is made in the form of a connector USB on the portable case 1 of the device.

By means of a USB connector, a peripheral computer device is connected to the inventive device (not shown in FIG. 1).

The transmitting, receiving, and controlling ports of the first 7 ₁ universal asynchronous transceiver (UART) are respectively connected via the corresponding buses of the seventh 4 ₇ bi-directional communication channel with the transmitting, receiving, and controlling ports of the converter 16 of the USB / UART interfaces (not shown in Fig. 1).

The second 7 ₂ universal asynchronous UART transceiver via the ninth 4 ₉ bidirectional communication channel with the radio interface 18 with the antenna 19. The radio interface 18 is implemented in accordance with the IEEE 802.11 n communication standard.

The transmitting, receiving, and controlling ports of the second 7 ₂ universal asynchronous transceiver (UART) are respectively connected via the corresponding buses of the ninth 4 ₉ bidirectional communication channel with the transmitting, receiving, and controlling ports of the radio interface 18 with antenna 19 (not shown in Fig. 1).

The dual-core cryptographic coprocessor 6, which implements cryptographic data conversions in accordance with GOST 28147-89, contains a data encryption core 20 and a data decryption core 21. The data encryption core 20 includes a simple replacement mode execution unit 22 ₁ , a gamma mode execution unit 22 ₂ and a feedback gamma mode execution unit 22 ₃ . The data decryption core 21 includes a simple replacement mode execution unit 23 ₁ , a gamma mode execution unit 23 ₂ and a feedback gamma mode execution unit 23 ₃ .

The corresponding outputs of the unit 12 step-down voltage converters are connected to the power ports of non-volatile memory (ENZP) 9, a cryptographic unit 2, a clock generator 8 and a radio interface 18.

Additionally, in the portable housing 1 of the device, a time pulse generator 20 is provided, equipped with a built-in rechargeable battery 21 and a real-time timer, connected to the intra-unit system communication channel 3 by means of a tenth 4 ₁₀ bi-directional communication channel. The control and signal ports of the generator 20 time pulses on the corresponding buses of the tenth 4 ₁₀ bidirectional communication channels are connected to the corresponding buses of the intra-unit system communication channel 3 (not shown in Fig. 1).

As seen in FIG. 2, the simple replacement mode execution unit 22 ₁ comprises first N _1, second N ₂ , third N ₃ and fourth N ₄ 32-bit drives, first CM1 and second CM2 32-bit adders, 256-bit key memory device (RAM), consisting from the first X ₀ , the second X ₁ , the third X ₂ , the fourth X ₃ , the fifth X ₄ , the sixth X ₅ , the seventh X ₆ and the eighth X ₇ 32-bit drives, the substitution block K, consisting of the first K ₁ , the second K ₂ third K ₃ , fourth K ₄ , fifth K ₅ , sixth K ₆ , seventh K ₇ and eighth K ₈ replacement nodes, each of which includes 64-bit memory, and a 32-bit left shift register R. Block 23 _{1 is} similar to block 22 ₁ .

As seen in FIG. 4, the gamma mode execution unit 22 ₂ contains a third N ₃ , a fourth N ₄ , a fifth N ₅ and a sixth N ₆ 32-bit storage device, a third CM3 and a fourth CM4 32-bit adders, a 64-bit adder CM5, and a mode execution unit a simple replacement B1, the structure of which is similar to the structure of block 221 and includes the first N ₁ , second N ₂ , third N ₃ and fourth N ₄ 32-bit drives, the first CM1 and second CM2 32-bit adders, 256-bit key memory (PUV) consisting of a first X _0, X ₁ second, third, X _2, X _3, fourth, fifth, X _4, shes th X _5, Seventh X ₆ and eighth X ₇ 32-bit accumulators, block substitutions K, consisting of the first K _1, the second K _2, a third K _3, a fourth K _4, the fifth K _5, sixth K _6, Seventh K ₇ and eighth K ₈ replacement nodes, each of which includes 64-bit memory and a 32-bit register to the left cyclic shift R. Block 23 _{2 is} similar to block 22 ₂ .

As seen in FIG. 6, the feedback gamma mode execution unit 22 ₃ contains a 64-bit adder CM3, as well as the simple replacement mode execution unit B1, the structure of which is similar to the structure of block 22 ₁ and includes the first N ₁ , second N ₂ , third N ₃ and the fourth N ₄ 32-bit drives, the first CM1 and the second CM2 32-bit adders, 256-bit key storage device (RAM), consisting of the first X ₀ , second X ₁ , third X ₂ , fourth X ₃ , fifth X ₄ , sixth X ₅ , seventh X ₆ and eighth X ₇ 32-bit drives, substitution block K, consisting of the first go K ₁ , second K ₂ , third K ₃ , fourth K ₄ , fifth K ₅ , sixth K ₆ , seventh K ₇ and eighth K ₈ replacement nodes, each of which includes 64-bit memory and 32-bit register R cyclic left shift. Block 23 _{3 is} similar to block 22 ₃ .

A device for processing data operates as follows.

From the power supply 10, the voltage necessary for the non-volatile memory (EEP) 9, cryptographic unit 2, clock generator 8 and radio interface 18 is supplied. The clock generator 8 synchronizes the operation of processor 5, cryptographic coprocessor 6, the first 7 ₁ and second 7 ₂ universal asynchronous transceivers UART.

In the mode of encryption / decryption of the data message, the processor 5 controls the operation of the cryptographic coprocessor 6, non-volatile memory (EPRS) 9, the first 7 ₁ and second 7 ₂ universal asynchronous UART transceivers, a generator of 20 time pulses connected to the intra-unit system communication channel 3.

The pulse generator 20 is powered by the built-in rechargeable battery 21.

A non-volatile memory (EEC) 9 contains a 256-bit secret key used for cryptographic conversion of a data message. Before starting the cryptographic conversion of the data message in the selected mode by the control signal from the processor 5, the secret key is read from the corresponding non-volatile memory (EEP) drive 9 and is written in the corresponding order to the corresponding storage device X _{i of the} key storage device (RAM) of the selected cryptographic conversion mode data.

Previously, before the device starts to work, to implement a secure data exchange channel for open data message, the user activates the core 20 of the cryptographic coprocessor 6 data encryption 20 using the device operation mode switch 15, and to use the dual core cryptographic coprocessor 6 data decryption core 21 to implement the open channel for exchanging the closed data message.

Depending on the required degree of security of the data message, the user selects the cryptographic conversion mode by dialing a binary code of the selected cryptographic conversion mode using the switch 15 of the device operation modes. Moreover, to ensure the operability of the device, the binary code of the selected encryption mode is equal to the binary code of the corresponding decryption mode.

Previously, in the gamma or gamma modes with feedback, according to the control signal of the processor 5, the time pulse generator 20 generates a 64-bit binary sequence (sync packet) S = (S ₁ , S ₂ , ..., S ₆₄ ), whose period T is equal to the time value τ beginning of cryptographic conversion in the mentioned modes, fixed by the built-in timer. According to the control signal of the processor 5, the generated clock package S = (S ₁ , S ₂ , ..., S ₆₄ ) is supplied to the corresponding ports of the cryptographic coprocessor 6 via the corresponding buses of the intra-unit system communication channel 3.

Consider the operation of the inventive device when implementing a secure duct for the exchange of open data message.

The binary code of the selected encryption mode of the open data message from the output connector of the switch 15 operating modes of the device via the control bus of the second 4 ₂ bidirectional communication channel is supplied to the corresponding control port of the dual-core cryptographic coprocessor 6, activates the corresponding block for the execution of the selected encryption mode of the open data message.

If it is necessary to establish a communication channel with a computer peripheral via a USB wired interface 17, the processor 5 supplies an initialization signal via the control bus of the internal unit communication channel 3 to the corresponding control port of the first 7 ₁ universal asynchronous UART transceiver, initializing the reception of an open data message.

The built-in USB wired interface 17 receives an open data message generated by a USB peripheral computer. The received open data message by means of the converter 16 of the USB / UART interfaces is standardized according to the UART standard. Then, according to the ready signal, the converter 16 USB / UART interfaces transmits an open data message, normalized according to the UART standard, to the receive port of the first 7 ₁ universal asynchronous UART transceiver.

According to the control signal of processor 5, an open data message normalized according to the UART standard is received from the signal ports of the first 7 ₁ universal asynchronous transceiver UART via the data bus of the intra-unit system channel 3 to the signal ports of processor 5, where it is recorded in its internal memory.

According to the ready signal, the cryptographic coprocessor 6 reads the indicated open data message T ₀ in binary code from the internal memory of processor 5, encrypting it in the selected mode in accordance with GOST 28147-89.

In the case when the simple replacement mode is selected by the user, the input of the simple replacement mode execution unit 22 ₁ receives an open data message in binary code T ₀ = (a ₁ (0), a ₂ (0), ..., a ₃₁ (0), a ₃₂ (0), b ₁ (0), b ₂ (0), ..., b ₃₂ (0)) read from the internal memory of processor 5. Then, the specified open data message T ₀ is partitioned into the first a (0) and the second b (0) 32-bit data block, respectively, inserted into the first N ₁ and second N ₂ 32-bit drives (step 301).

In this case, the input of the corresponding data block in binary code into the corresponding drive is performed as follows: the value a ₁ (0) is entered into the 1st bit of the first N ₁ drive, the value a ₂ (0) is entered into the 2nd bit of the first N ₁ drive and so on, the value a ₃₂ (0) is entered in the 32nd bit of the first N ₁ drive; the value b ₁ (0) is entered into the 1st discharge of the second N ₂ drive, the value b ₂ (0) is entered into the 2nd discharge of the second N ₂ drive, and so on, the value b ₃₂ (0) is entered into the 32nd discharge of the second N ₂ drives. As a result, the initial filling a (0) = (a ₃₂ (0), a ₃₁ (0), ..., a ₂ (0), a ₁ (0)) of the first N ₁ drive and the initial filling b (0) = ( b ₃₂ (0), b ₃₁ (0), ..., b ₁ (0)) of the second N ₂ drive.

When encrypting an open data message in a simple replacement mode, a 256-bit key is used in accordance with GOST 28147-89. The key is divided into eight blocks of 32 bits, and each bit of each block is sequentially inserted into the drive X of the corresponding order. That is, the 1st bit of the key is inserted into the 1st discharge of the first X ₀ drive, the 2nd into the 2nd discharge of the first X ₀ drive, the 33rd into the 1st discharge of the second X ₁ drive, 65th - in the 1st bit of the third X ₂ drive, and so on, the 224th bit of the key is inserted into the 1st bit of the eighth X ₇ drive, the 256th bit of the key is inserted into the 32nd bit of the eighth X ₇ drive. Thus, the contents of 32-bit drives X ₀ , X ₁ , ..., X ₇ has the form:

.

.

The substitution block K contains a 16 × 8 replacement table, which is a long-term key.

Encryption of a 64-bit data block in simple replacement mode consists of 32 cycles.

In the first cycle, the initial filling a (0) = (a ₃₂ (0), a ₃₁ (0), ..., a ₂ (0), a ₁ (0)) of the first N ₁ drive is summed modulo 2 ³² with connection X ₀ in the first CM1 adder, the summing result S _{mod is} stored in the first CM1 adder (step 302). Next, the said summation result S _mod stored in the first CM1 adder is converted to the substitution block K (steps 303-308).

The summation result S _mod stored in the first CM1 adder is divided into eight 4-bit elements S ₁ , S ₂ , S ₃ , S ₄ , S ₅ , S ₆ , S ₇ , S ₈ (step 303), each of which arrives to the input of the corresponding replacement node of the substitution block K (in the order of increasing bit precedence, respectively, the replacement nodes K ₁ -K ₈ ).

The conversion occurs as follows: the element S _mod -S _i is selected, first we start with the lowest element, and we replace the value from the substitution table by the i-th row and the column pointed to by the value of the element s _i . We pass to the s _{i + 1} element and proceed in a similar way and continue until we replace the value of the last element S _mod - we will denote the result of this operation as S _simple .

The result obtained, S _simple, is input to a 32-bit register R, where it cyclically shifts by eleven steps towards the higher digits (step 309-3010). The shift result S _{rol is} summed bitwise modulo 2 in the second CM2 adder with 32-bit filling of the second N ₂ drive (step 3011). The result S _{xor is} written to the first N ₁ drive, with the initial filling a (0) = (a ₃₂ (0), a ₃₁ (0), ..., a ₂ (0), a ₁ (0)) of the first N ₁ drive is overwritten in the second N ₂ drive. This completes the first cycle.

Subsequent cycles are carried out similarly, in this case, in the second cycle, the contents of the second X ₁ drive are read from the ROM, in the 3rd cycle the contents of the third X ₂ drive are read, and so on, in the 8th, the contents of the eighth X ₇ drive are read. In cycles from the 17th to the 24th, the contents of the ROM are read in the same order. In the last eight cycles from the 25th to the 32nd order, the contents from the RAM are read in the reverse order.

Obtained after the 32nd encryption cycle, the fillings of the first N ₁ and second N ₂ drives are data blocks constituting a closed data message T _W , corresponding to an open data message T ₀ .

After performing at least one of thirty-two encryption cycles of the previous open data message in simple replacement mode, the cryptographic coprocessor 6 gives a signal that it is ready to receive the next open data message.

,

, …,

,

, считанные из встроенной памяти процессора 5.In the case when the user has selected the gamma mode, open data messages, divided into 64-bit blocks, are received at the input of the gamma mode block 22 ₂

,

, ...,

,

read from processor internal memory 5.

When encrypting an open data message in gamma mode, a 256-bit key is used in accordance with GOST 28147-89.

A 64-bit binary sequence (sync packet) S = (S ₁ , S ₂ , ..., S ₆₄ ) is introduced into the first N ₁ and second N ₂ drives of the simple replacement unit B1; this is the initial filling of the said drives for the subsequent generation of M gamma blocks cipher (step 501). The clock package is entered into drives N ₁ and N ₂ so that the value S ₁ is entered into the 1st discharge of the first N ₁ drive, the value S ₂ is entered into the 2nd discharge of the first N ₁ drive, and so on, the value S ₃₂ is entered into 32- the first discharge of the first N ₁ drive, the value S ₃₃ is entered into the 1st discharge of the second N ₂ drive, the value of S ₃₄ is entered into the 2nd discharge of the second N ₂ drive, and so on, the value of S ₆₄ is entered into the 32nd discharge of the second N ₂ drive.

In the simple replacement mode execution unit B1, the sync packet S introduced into the first N ₁ and second N ₂ drives is encrypted similarly to encrypting an open data message in a simple replacement mode (step 502).

The result of encryption of the sync packet A (S) = Y ₀ , Z _{0 is} transferred to 32-bit third N ₃ and fourth N ₄ drives so that the filling of the first N ₁ drive is written to the third N ₃ drive (step 503), and the filling of the second N ₂ drive is rewritten in the fourth N ₄ (step 504).

In the third CM ₃ adder, the filling of the third N ₃ drive is summed modulo 2 ³² with the 32-bit constant C ₁ recorded in the fifth N ₅ drive, the summation is written to the third N ₃ drive (step 506). In the fourth CM4 adder, the filling of the fourth N ₄ drive is summed modulo (2 ³² -1) with the 32-bit constant C ₂ recorded in the sixth N ₆ drive, the summation is written to the fourth N ₄ drive (step 507).

Filling the third N ₃ drive is overwritten in the first N ₁ drive (step 508), and filling the fourth N ₄ drive is overwritten in the second N ₂ drive (step 509), while filling the third N ₃ and fourth N ₄ drives is saved. Filling the first N ₁ and second N ₂ drives is encrypted similarly to encrypting an open data message in a simple replacement mode in the simple replacement mode execution unit B1 (step 5011).

, который суммируется поразрядно по модулю 2 в пятом CM5 сумматоре с первым 64-разрядным блоком открытых данных

(шаг 5013-5014). В результате получается 64-разрядный блок закрытых данных

.The encryption results for the first N ₁ and second N ₂ drives after the concatenation procedure (step 5012) form the first 64-bit cipher gamma block

, which is summed bitwise modulo 2 in the fifth CM5 adder with the first 64-bit open data block

(step 5013-5014). The result is a 64-bit private data block.

.

заполнение третьего N₃ накопителя суммируется по модулю 2³² в третьем CM3 сумматоре с константой C₁, записанной в пятом N₅ накопителе, результат суммирования записывается в третий N₃ накопитель. Заполнение четвертого N₄ накопителя суммируется по модулю (2³²-1) в четвертом CM4 сумматоре с константой C₂, записанной в шестом N₆ накопителе, результат суммирования записывается в четвертый N₄ накопитель. Заполнение третьего N₃ накопителя переписывается в первый N₁ накопитель, а заполнение четвертого N₄ накопителя переписывается во второй N₂ накопитель, при этом заполнения третьего N₃ и четвертого N₄ накопителей сохраняются.To get the next 64-bit cipher gamma block

the filling of the third N ₃ drive is summed modulo 2 ³² in the third CM3 adder with a constant C ₁ recorded in the fifth N ₅ drive, the summation is written to the third N ₃ drive. Filling the fourth N ₄ drive is summed modulo (2 ³² -1) in the fourth CM4 adder with a constant C ₂ recorded in the sixth N ₆ drive, the summation is written to the fourth N ₄ drive. The filling of the third N ₃ drive is transferred to the first N ₁ drive, and the filling of the fourth N ₄ drive is transferred to the second N ₂ drive, while the filling of the third N ₃ and fourth N ₄ drives are saved.

, который суммируется поразрядно по модулю 2 в пятом CM5 сумматоре со вторым 64-разрядным блоком открытых данных

. В результате получается 64-разрядный блок закрытых данных

. Аналогично вырабатываются блоки гаммы шифра

,

, …,

и зашифровываются блоки открытых данных

,

, …,

. Если длина последнего M-блока открытых данных

меньше 64 бит, то из последнего M-го блока гаммы шифра

для зашифрования используется только соответствующее число разрядов гаммы шифра, остальные разряды отбрасываются.The fillings of the first N ₁ and second N ₂ drives are encrypted similarly to encrypting an open data message in a simple replacement mode in a simple replacement mode execution unit B1. The encryption of the fillings of the first N ₁ and second N ₂ drives after concatenation form the second 64-bit cipher gamma block

, which is summed bitwise modulo 2 in the fifth CM5 adder with a second 64-bit open data block

. The result is a 64-bit private data block.

. Similarly, cipher gamma blocks are produced

,

, ...,

and blocks of open data are encrypted

,

, ...,

. If the length of the last M-block of open data

less than 64 bits, then from the last Mth block of the cipher gamut

only the corresponding number of digits of the gamut of the cipher is used for encryption, the remaining digits are discarded.

.As a result of encryption of the open data message in gamma mode, a closed data message consisting of sync packet S and blocks of closed data is received in the intra-system communication channel 3

.

After summing the previous open data message with the gamma of the cipher in the fifth CM5 adder, the cryptographic coprocessor 6 gives a signal that it is ready to receive the next open data message.

,

, …,

,

, считанные из встроенной памяти процессора 5.In the case when the user selects a gamma mode with feedback, open data messages, divided into 64-bit blocks, are received at the input of block 22 ₃ of the gamma mode with feedback

,

, ...,

,

read from processor internal memory 5.

When encrypting an open data message in a gamma mode with feedback in accordance with GOST 28147-89, a 256-bit key is used.

In the first N ₁ and second N ₂ drives of the simple replacement mode execution unit B1, a 64-bit binary sequence (sync packet) S = (S ₁ , S ₂ , ..., S ₆₄ ) is entered (step 701). The clock package S is entered into the first N ₁ and second N ₂ drives so that the value S ₁ is entered into the 1st discharge of the first N ₁ drive, the value S ₂ is entered into the 2nd discharge of the first N ₁ drive, and so on, the value S ₃₂ is entered in the 32nd bit of the first N ₁ drive, the value of S ₃₃ is entered into the 1st discharge of the second N ₂ drive, the value of S ₃₄ is entered into the 2nd discharge of the second N ₂ drive, and so on, the value of S ₆₄ is entered into the 32nd discharge second N ₂ drive.

, который суммируется поразрядно по модулю 2 в третьем CM3 сумматоре с первым 64-разрядным блоком открытых данных

(шаг 706). В результате получается 64-разрядный блок закрытых данных

.The filling of the first N ₁ and second N ₂ drives is encrypted similarly to encrypting an open data message in a simple replacement mode in the simple replacement mode execution unit B1 (step 702-704). The encryption of the fillings of the first N ₁ and second N ₂ drives after the concatenation procedure (step 705) form the first 64-bit cipher gamma block

, which is summed bitwise modulo 2 in the third CM3 adder with the first 64-bit block of open data

(step 706). The result is a 64-bit private data block.

.

одновременно также является исходным состоянием первого N₁ и второго N₂ накопителей для выработки второго блока гаммы шифра

. Блок закрытых данных

разбивают на два подблока

и

(шаг 707), которые по обратной связи записывают в первый N₁ и второй N₂ накопители (шаг 708-709). При этом значения разрядов 1-32 записываются в накопитель N₁, а значения разрядов 33-64 записываются в накопитель N₂. Заполнения первого N₁ и второго N₂ накопителей шифруются аналогично шифрованию открытого сообщения данных в режиме простой замены в блоке выполнения режима простой замены Б1. Полученные в результате шифрования заполнения первого N₁ и второго N₂ накопителей после процедуры конкатенации образуют второй 64-разрядный блок гаммы шифра

, который суммируется поразрядно по модулю 2 в третьем CM3 сумматоре со вторым 64-разрядным блоком открытых данных

. В результате получается 64-разрядный блок закрытых данных

. Выработка последующих блоков гаммы шифра

и шифрование соответствующих блоков открытых данных

производится аналогично. Если длина последнего блока открытых данных меньше 64 разрядов, то используется только соответствующее число разрядов гаммы шифра, остальные разряды отбрасываются.Closed Data Block

at the same time, it is also the initial state of the first N ₁ and second N ₂ drives to generate the second block of the cipher gamut

. Closed Data Block

split into two subunits

and

(step 707), which feedback write to the first N ₁ and second N ₂ drives (step 708-709). In this case, the values of bits 1-32 are recorded in the drive N ₁ , and the values of bits 33-64 are recorded in the drive N ₂ . The fillings of the first N ₁ and second N ₂ drives are encrypted similarly to encrypting an open data message in a simple replacement mode in a simple replacement mode execution unit B1. The encryption results of filling the first N ₁ and second N ₂ drives after the concatenation procedure form the second 64-bit cipher gamma block

, which is summed bitwise modulo 2 in the third CM3 adder with a second 64-bit open data block

. The result is a 64-bit private data block.

. Generation of subsequent cipher gamma blocks

and encryption of corresponding blocks of open data

produced similarly. If the length of the last block of open data is less than 64 bits, then only the corresponding number of bits of the cipher gamut is used, the remaining bits are discarded.

.As a result of encryption of the open data message in the gamma-feedback mode, a closed data message consisting of sync packet S and blocks of closed data is received in the intra-system communication channel 3

.

After summing the previous open data message with the cipher gamut in the third CM3 adder, the cryptographic coprocessor 6 gives a signal that it is ready to receive the next open data message.

According to the control signal from processor 5, the closed data message T _Ш , obtained by encrypting the open data message T ₀ in the selected mode, is fed from the signal ports of the cryptographic coprocessor 6 via the data bus of the intra-unit system channel 3 to the signal ports of the second 7 ₂ universal asynchronous UART transceiver. According to the ready signal, the received closed data message T _W from the signal ports of the second 7 ₂ universal asynchronous UART transceiver via the data bus of the ninth 4 ₉ bidirectional communication channel is received at the receiving ports of the air interface 18 from the antenna 19, which implements the transmission of a closed data message in accordance with the IEEE 802.11 communication standard n to the antenna of the mobile device.

Consider the operation of the inventive device when implementing an open channel for exchanging a closed data message.

The binary code of the selected decryption mode of the closed data message, equal to the binary code of the previously selected encryption mode of the open data message, from the output connector of the switch 15 of the device operation modes via the control bus of the second 4 ₂ bidirectional communication channel is supplied to the corresponding control port of the dual-core cryptographic coprocessor 6, activates the corresponding the execution unit of the selected decryption mode of the closed data message.

If it is necessary to establish a communication channel with the mobile device via the radio interface 18 with the antenna 19, the processor 5 supplies the initialization signal via the control bus of the internal unit communication channel 3 to the corresponding control port of the second 7 ₂ universal asynchronous UART transceiver, initializing the reception of a closed data message.

The built-in antenna 19 of the air interface 18 receives a closed data message T _W generated by the mobile device. According to the control signal from processor 5, the received closed data message T _Ш from the signal ports of the second 7 ₂ universal asynchronous transceiver UART is transmitted to the signal ports of processor 5 via the data bus of the intra-unit system channel 3, where it is recorded in its internal memory.

Based on the ready signal, the cryptographic coprocessor 6 reads the specified closed data message T _Ш in binary code from the internal memory of processor 5, decrypting it in the selected mode in accordance with GOST 28147-89.

In the case when the simple replacement mode is selected by the user, the block 23 ₁ decrypts the closed data message in the same way as encrypting the open data message in the simple replacement mode, with the change that the fillings of the drives X ₀ , X ₁ , ..., X _{7 are} read from the ROM in decryption cycles in the following order: in the first cycle, the contents of the first X ₀ drive are read from the ROM, in the second cycle the contents of the second X ₁ drive are read, and so on, in the 8th, the contents of the eighth X ₇ drive are read. In cycles from the 9th to the 16th, from the 17th to the 24th and from the 25th to the 32nd, the contents from the RAM are read in the reverse order.

After performing at least one of thirty-two decryption cycles of the previous closed data message in a simple replacement mode, the cryptographic coprocessor 6 gives a signal that it is ready to receive the next closed data message.

, который суммируется поразрядно по модулю 2 в пятом CM5 сумматоре с первым 64-разрядным блоком закрытых данных

. В результате получается 64-разрядный блок открытых данных

.In the case when the user selects the gamma mode, block 23 ₂ decrypts the closed data message in the same way as encrypting the open data message in gamma mode, with the change that the encryption results in the filling of the first N ₁ and second N ₂ drives after concatenation forms the first 64 -bit cipher gamma block

, which is added bitwise modulo 2 in the fifth CM5 adder with the first 64-bit block of closed data

. The result is a 64-bit block of open data

.

After summing the previous closed data message with the cipher gamut in the fifth CM5 adder, the cryptographic coprocessor 6 gives a signal that it is ready to receive the next closed data message.

, который суммируется поразрядно по модулю 2 в третьем CM3 сумматоре с первым 64-разрядным блоком закрытых данных

. В результате получается 64-разрядный блок открытых данных

.In the case when the user selects the gamma mode with feedback, the block 23 ₃ decrypts the closed data message in the same way as encrypting the open data message in the gamma mode with feedback, with the change that the encryption results in filling in the first N ₁ and second N ₂ drives after concatenation forms the first 64-bit cipher gamma block

, which is summed bitwise modulo 2 in the third CM3 adder with the first 64-bit block of closed data

. The result is a 64-bit block of open data

.

After summing the previous closed data message with the cipher gamut in the third CM3 adder, the cryptographic coprocessor 6 gives a signal that it is ready to receive the next closed data message.

According to the control signal from processor 5, an open data message T ₀ , obtained by decrypting a closed data message T _W in the selected mode, is sent from the signal ports of the cryptographic coprocessor 6 to the signal ports of processor 5 via the data bus of the intra-unit system channel 3, where it is written to its built-in memory.

If it is necessary to establish a communication channel with a computer peripheral device via a USB wired interface 17, the processor 5 supplies an initialization signal via the control bus of the internal unit communication channel 3 to the corresponding control port of the first 7 ₁ universal asynchronous UART transceiver, initiating the transmission of an open data message.

According to the control signal of processor 5, an open data message normalized according to the UART standard is received from the signal ports of the first 7 ₁ universal asynchronous UART transceiver via the data bus of the internal unit channel 3 to the signal ports of the converter 16 of the USB / UART interfaces, where it is normalized to the USB standard. Then, according to the ready signal, an open data message, normalized according to the USB standard, is transmitted via the USB wired interface 17 to the input of the computer peripheral device.

In the reprogramming mode, during the planned replacement of the secret key or in the case of a threat of gaining unauthorized access to the data message, by the control signal from an external computer connected to the device via the RS-232 wire interface 14, the programmer 13 reprograms the non-volatile memory (EPR) 9, overwriting the new secret key in the corresponding drives in the appropriate order. After the end of the reprogramming process, the external computer is disconnected from the data processing device.

Claims (1)

A data processing device made in the form of a cryptographic unit including a processor, a cryptographic coprocessor and non-volatile memory connected to a power unit made in the form of a rechargeable battery and connected to the IEEE 802.11 radio interface with a radio antenna, as well as with USB and RS-232 wired interfaces, characterized in that in the portable case there is a cryptographic unit containing an intra-unit system communication channel to which through the first, second, third and fourth two-way of the communication channels, a processor, a dual-core cryptographic coprocessor, the first and second universal asynchronous transceivers UART, respectively, a clock generator, to the output of which a clock input of a cryptographic block, a non-volatile memory connected to an intra-block system communication channel via a fifth bidirectional communication channel to which it is connected, are connected a programmer connected to the RS-232 wired interface, and a power supply unit made in the form of a battery, with unified with the voltage step-down converter unit, while a clock generator, a cryptographic unit, a non-volatile memory and an IEEE 802.11 n radio interface with an antenna are connected to the power supply unit, an output connector of the device operation mode switch is connected to the control ports of the dual-core cryptographic coprocessor through the control bus of the second bidirectional communication channel , the first universal asynchronous UART transceiver connected via a USB / UART interface converter to a USB wired interface and the second universal asynchronous UART transceiver with an IEEE 802.11 n radio interface with a radio antenna, the dual-core cryptographic coprocessor that implements a given standard of cryptographic transformations, contains a data encryption core that includes blocks for performing the corresponding data encryption modes of a given cryptographic transform standard, and a data decryption core that includes blocks for the execution of the corresponding data decryption modes of a given standard of cryptographic transformations, additional ADDITIONAL in a portable housing arranged time pulse generator provided with a built-in rechargeable battery and connected to the communication channel system vnutriblochnomu tenth through bidirectional communication.

Images