Abstract:
A non-algebraic cryptographic architecture. The non-algebraic cryptographic architecture is a logical implementation of a non-algebraic cryptographic engine (sometimes referred to as a “NACE”). The architecture uses a NACE in conjunction with cryptographic key lengths up to 2048 bits to achieve real-time encryption at speeds sufficient to permit wideband digital data to be decrypted in real time thereby obviating the need for store-and-forward. The architecture is inherently parallel and can accept extended block lengths, which are several multiples of the length of the cryptographic key.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS  
       [0001]    This application claims priority under 35 U.S.C. §119(e) from provisional application No. 60/316,020, filed Aug. 31, 2001. The 60/316,020 provisional application is incorporated by reference herein, in its entirety, for all purposes. 
     
    
     
       FIELD OF INVENTION  
         [0002]    The present invention relates generally to data protection. More particularly, the present invention relates to the architecture of a device used to protect digital data that uses a non-algebraic method of encryption and decryption.  
         BACKGROUND OF THE INVENTION  
         [0003]    The science of keeping messages and data secure is broadly referred to as cryptology. Once an art practiced by government agencies and a few academics, cryptology has become an essential element of the digital age. The reasons for this interest in cryptology result from the consequences of going digital. Advances digital technology has enhanced our ability to distribute and store content in digital form. However, because digital data is readily transported and copied, it is inherently insecure in its raw form. Thus, to protect the content represented by digital data, a means of making the content inaccessible without interfering with the transportability or storage of the data must be found. The answer is to encrypt the digital data thus protecting the content represented by the data.  
           [0004]    Cryptology has evolved with personal computers, so it should not come as a surprise that the large majority of cryptology solutions are designed for a computer. In its current state, cryptology has developed cryptographic algorithms based on algebraic equations and mathematical operations that can be readily performed on a computer. Computational complexity of algorithms is sometimes measured in terms of the computing power needed to execute it for a given sized input. The larger the input, the slower the computation time. Algebraically strong algorithms, such as exponential algorithms are not feasible for large data inputs.  
           [0005]    Secure protection by a cryptographic algorithm means that it is not breakable by cryptanalytic techniques, which would allow one to decrypt the encrypted version without prior knowledge of the cryptographic key. A secure cryptographic algorithm that is not breakable can be attacked only by an exhaustive search of all combinations of its cryptographic keys, i.e., the “brute force attack”. In this method of attack, adversaries use all combinations of the cryptographic key together with knowledge of the cryptographic algorithm and encrypted text.  
           [0006]    One approach to securing an algorithm is to increase the key length to increase the number of possible combinations of keys that must be attempted in a brute force attack. The current “gold standard” for the length of a cryptographic key to protect financially sensitive data is 128 bits. Wideband data protected by a secure 128 bit cryptographic algorithm requires an adversary to examine over 3.4×10 38  potential keys. This is not technically feasible now, and is unlikely to be feasible within the next ten years given the current rate of progress in digital data processing systems.  
           [0007]    In the algebraic cryptographic world, the cryptographic process is optimized on the speed of the encryption function. Additionally, the size of the block of data is generally limited to the key length to enhance the security of the encrypted data by reducing the possibility of redundancies and statistical relationships between the data being encrypted (the plaintext) and the encrypted output (the ciphertext). These two limitations of the algebraic approach to encryption of data must be overcome when protecting large bandwidth blocks of data that must be decrypted in real-time. Moreover, the solution to these limitations must be easily implemented in hardware form for the market for wideband consumer and business products to reach its potential.  
           [0008]    To give this observation perspective, if the content of a video produced by a digital video camera were encrypted using a 128-bit key, to match the quality of the unencrypted content would require a decryption speed on the order of 10 7  bits per second. An HDTV-quality image encrypted with a 128-bit key would require a decryption speed of between 10 7  and 10 8  bits per second.  
           [0009]    The first generation of digital cinemas requires wideband digital imagery. This has two components, first the total number of digital imagery bits and second, the rate in bits per second that the digital imagery product must be displayed. The first generation of digital cinemas requires a data rate of 1.8×10 9  bits per second. This arises from a digital cinema product that displays 30 frames per second, frames of 2×10 6  pixels, and pixels consisting of 30 bits each. If the digital cinema product is 1.5 hours long, then the total number of bits is 9.720×10 12  bits. Subsequent generations of digital cinema products will growth to 70 frames per second, frames of 10 7  pixels, and pixels of 36 bits each, requiring a data rate of 2.52×10 10  bits per second, with data storage for the image of 1.37×10 14  bits.  
           [0010]    Providing content protection and storage for these data rates and quantities of data are daunting tasks. Data compression can help in both matters, by reducing the amount of data per frame, thus decreasing both storage requirements and data rates. However, it is an open question amongst cinematic producers as to the degree of compression that is acceptable without impact the artistic integrity of their product. In addition only compression techniques that adversely affect image quality provide any significant degree of data compression, and upon decompression do not produce the same quality image as before compression. In either case, with compression ratios limited to less than 10:1 and most probably less than 5:1 data, compression will not have a major effect on the data rate. Thus digital cinema projection systems using data compression would currently experience data rates of from 0.18×10 9  bits per second up to 0.36×10 9  bits per second. Succeeding generations of digital cinema would require data rates between 0.252×10 10  bits per second to 0.504×10 10  bits per second.  
           [0011]    Today, assuming a 128-bit key, the best encryption speed is about 2×10 8  bits per second and the best decrypt speed is about 2×10 7  bits per second. For this reason, large digital files are not encrypted, the key length is kept short to increase speed, or the key to decrypt them is entrusted to a third party. More importantly, products based on wideband digital data distribution that permit use of such data while protecting the content originator&#39;s ownership interest remain in the conceptual stage.  
           [0012]    What is needed is an architecture for a device capable of encrypting and decrypting digital cinema products at data rates between 0.252×10 10  bits per second to 0.504×10 10  bits per second so that the digital content can be decrypted in real time thereby obviating the need for store-and-forward.  
         SUMMARY OF THE INVENTION  
         [0013]    The present invention is embodied as a non-algebraic cryptographic architecture of a device for encrypting and decrypting digital cinema products in real time.  
           [0014]    It is an object of the present invention to be a secure method for the encryption and decryption of wideband data.  
           [0015]    It is a further object of the present invention to take maximum advantage of the inherent parallel structures of the NACE cryptographic algorithm.  
           [0016]    It is a further object of the present invention to have variable cryptographic key lengths of from 128 bits to 2048 bits.  
           [0017]    It is yet another object of the present invention to encrypt and decrypt at speeds at least 10 times faster than algebraic cryptographic algorithms with a cryptographic key length of 128 bits.  
           [0018]    It is yet another object of the present invention to encrypt and decrypt at speed in excess of 10 10  bits per second, using a custom hardware implementation.  
           [0019]    It is yet another object of the present invention to be a block cipher cryptographic algorithm with feedback cipher products in the generation of encrypted text data and in the generation of exchanged cryptographic keys.  
           [0020]    It is yet another object of the present invention to allow for a wide variety of processor implementations conforming to the processor system architecture.  
           [0021]    These and other objectives of the present invention will become apparent from a review of the general and detailed descriptions that follow. An embodiment of the present invention is a non-algebraic cryptographic architecture. In an exemplary embodiment of the present invention, this architecture is implemented as a “controller”. The architecture of the controller is a logical implementation of a nonalgebraic cryptographic engine (sometimes referred to as a “NACE”). A non-algebraic cryptographic engine meeting the requirements of the present invention is described in U.S. Patent Application entitled “Non-Alebraic Method of Encryption and Decryption” and filed on Aug. 30, 2002, which patent application is hereby incorporated by reference herein, in its entirety, for all purposes. (This patent is application is sometimes referred to herein as the “NACE Application”). The controller uses a NACE in conjunction with cryptographic key lengths up to 2048 bits to achieve real-time encryption at speeds sufficient to support the current and future digital cinema requirements described above.  
           [0022]    The architecture is inherently parallel and admits extended block lengths, which are several multiples of the length of the cryptographic key. The controller is optimized for its decryption speed and to process wideband digital data.  
           [0023]    The non-algebraic cryptographic architecture may be implemented by means well known in the art. By way of illustration and not as a limitation, the architecture may be implemented as a network of microprocessors, a network of digital processors, or as one or more custom ASIC chips, without departing from the scope of the present invention. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0024]    A better understanding of the present invention will be realized from the detailed description that follows, taken in conjunction with the accompanying drawings, in which:  
         [0025]    [0025]FIG. 1 is a block diagram illustrating an encryption architecture according to the present invention.  
         [0026]    [0026]FIG. 2 is a flow diagram illustrating the data and command flows of an encryption architecture according to the present invention.  
         [0027]    [0027]FIG. 3 is a block diagram illustrating a decryption architecture according to the present invention.  
         [0028]    [0028]FIG. 4 is a flow diagram illustrating the data and command flows of a decryption architecture according to the present invention. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0029]    An embodiment of the present invention is a non-algebraic cryptographic (NAC) architecture. In one embodiment according to the present invention, the NAC architecture is implemented as a “controller”. This embodiment is described in terms of its logical architecture. The reference to a “processor”, for example, is not a reference to a discrete component but to a logical element that performs the task of a processor. In this embodiment, a logical processor may comprise one or more discrete processors or may comprise elements of an integrated circuit that perform a referenced task.  
         [0030]    The controller can take two forms: an encryption controller or a decryption controller. An encryption embodiment of the non-algebraic cryptographic controller operates in the encryption mode of the NACE. A decryption embodiment of the non-algebraic cryptographic controller operates in the decryption mode of the NACE. Each of these embodiments is described separately. The first segment of the description illustrates the functionality of an embodiment according to the present invention. The second segment is a detailed description of the data flows involved between the individual logical elements of that embodiment.  
         [0031]    A. Encryption Embodiment  
         [0032]    1. Functional Description  
         [0033]    A block diagram of the system architecture of an encryption embodiment of the present invention is illustrated in FIG. 1. Referring to FIG. 1, the system architecture for the encryption controller comprises eight distinct types of logical processors: ancillary encryption processor  104 ; differential equation processors  108 ; route processor  112 ; input processor  116 ; system controller  120 ; output processor  124 ; data bus  128 ; and encryption engine processor  132 .  
         [0034]    As illustrated in FIG. 1, an encryption embodiment of the present invention utilizes multiple independent differential equation processors  108  numbering M E  Additionally, the ancillary encryption processor  104  performs pre-computation processing of ancillary data (as described below) before any encryption processing is initiated. Computations by the differential equation processors  108  and the route processor  112  are done in parallel with the encryption processing by the encryption engine processors  132 . The combination of pre-computation and parallel processing itself to extremely high encryption rates.  
         [0035]    The NACE generates ancillary data during the encryption mode, which data is subsequently used in the decryption mode to decrypt cipher text created using the NACE in the encryption mode. By retaining this data, no additional computational resources are needed during decryption to recreate it, resulting in significant improvement in processing speed. As noted, the ancillary encryption processor  104  generates seed data, based on the system controller&#39;s clock; performs the ancillary cryptographic key exchange, with the ancillary cryptographic key contained in static storage within the system controller  120 ; generates the exchanged ancillary cryptographic keys; performs the primary cryptographic key exchange, with the primary cryptographic key contained in static storage within the system controller  120 ; generates the exchanged primary cryptographic keys; generates the required and appropriate number of random numbers; receives and stores all ancillary data; and encrypts all the ancillary data.  
         [0036]    As disclosed in detail in the NACE Application, the non-algebraic cryptographic engine utilizes uses nonlinear equations and analysis, instead of algebraic equations, to generate cipher products to encrypt digital data. Certain classes of these equations have properties referred to as “attractors” that evolve from nonlinear differential equations, nonlinear partial differential equations, and nonlinear difference equations. “Routes” generated by a route constructor using random numbers are used to determine a time history along a trajectory of an attractor. The route parameters are computed for a specific route by using the time domain history contained in a route to find solution points on an attractor. These solution points are unique and intractable.  
         [0037]    The differential equation processors  108  select the field of coefficient; select the nonlinear differential equation, or nonlinear partial differential equation, or nonlinear difference equation; generate the solution space based on a pre-selected numerical integration technique; and store the solutions in form suitable and appropriate for subsequent processing.  
         [0038]    Because of the processing load inherent in the differential equation processor function, several parallel differential equation processors are utilized. The number of such processors is denoted by ME, and is determined by the specific implementation of the processor system architecture.  
         [0039]    The route processor  112  generates and sets the step intervals for all routes and generates all the routes required by the encryption engine processor.  
         [0040]    The system controller  120  manages a primary and an ancillary cryptographic keys, both held in static memory; and structures and organizes all of the processing for the encryption processors  132 , including, but not limited to, initiation of processing, routing of data, and maintaining timing and data transfers of all other processors. In an alternate embodiment of the present invention, an external authentication center is used to authenticate the originator and to exchange keys. In this alternate embodiment, the system controller  120  also establishes and verifies the authenticity of the originator through two-way communications with the systems authentication center.  
         [0041]    The NACE receives digital data in block form. The processing of wideband digital data is performed by first partitioning the wideband data and processing the partitioned data in parallel. The input processor  116  receives all of the original copy of wideband digital data; partitions the incoming data into the appropriate number of channels; and partitions the channelized data into frames of clear text data.  
         [0042]    The output processor  124  receives both the encrypted ancillary data and the encrypted version of the original copy of wideband digital data and stores both encrypted data files for retrieval during the decryption process.  
         [0043]    The data bus  128  routes within the accepted timelines and data bandwidths, data between all of the processors of this encryption embodiment.  
         [0044]    The encryption engine processor  132  encrypts the original copy of the wideband digital data, using the encryption mode of a NACE. The NACE Application also disclosed optional smoothing functions ELS 1 , ENLS 1 , ELS 2 , and ENLS 2 . An encryption embodiment of the present invention implements these functions along with the ES function in the encryption engine processor  132 . However, as would be apparent to someone skilled in the art of the present invention, these optional smoothing functions may be omitted without departing from the scope of the present invention.  
         [0045]    Because of the processing load inherent in the encryption engine processor function, several parallel encryption engine processors are utilized. The number of such processors is denoted by N E , and is determined by the specific implementation of the system architecture of the encryption processor.  
         [0046]    In an encryption embodiment of the present invention, each encryption engine processor simultaneously receives channelized and framed data of the original copy of wideband digital data. Thus, the original wideband digital data is being processed using parallel processing resulting in extremely high encryption data rates.  
         [0047]    2. Data Flow  
         [0048]    [0048]FIG. 2 contains a flow diagram that illustrates the information and data flow within the system architecture for an encryption embodiment. Within FIG. 2 the arrows indicate the directionality of the data flow for both information and control types of data. A bidirectional arrow indicates communication between two processors, whereas a single direction arrow indicates data transfer from one processor to another. All of the processors previously described access data and interchange data and information through the data buss  128 . All of the processors are activated and controlled by the system controller  120  through the data bus.  
         [0049]    The flow of the encryption process of an original copy of wideband digital data begins with pre-computation processing. The ancillary encryption processor  104  begins the procedure by importing the primary and ancillary cryptographic keys from the system controller  120 . This is under commands from the system controller  120  and is indicated by arrow ‘ 1 ’ in FIG. 2. This path also represents the system controller  120  performing its housekeeping task of checking status through an interrupt handling procedure. Next the ancillary encryption processor  104  extracts system clock data from the system controller  120  to initialize and generate seed data. The ancillary encryption processor  104  generates random numbers and both the primary and ancillary exchanged cryptographic keys. These data are retained by the ancillary encryption processor in its ancillary data file. During subsequent pre-computation processing, additional ancillary data is generated by the differential equation processors  108  and by the route processor  112 . These data are sent via the data bus  128  to the ancillary encryption processor where they are stored in the ancillary data file as indicated in FIG. 2 by the arrows ‘ 2 ’ and ‘ 3 ’, respectively. When the ancillary data is completed, the ancillary encryption processor proceeds to encrypt the ancillary data and then exports this data via the data bus to the output processor  124 , which is indicated in FIG. 2 by arrow ‘ 4 ’.  
         [0050]    The differential equation processors  108  begin their activity after the ancillary encryption processor  104  has generated the random number file and the exchanged ancillary cryptographic keys. This is under commands from the system controller and is indicated by arrow ‘ 5 ’ in FIG. 2. This path also represents the system controller  120  performing its housekeeping task of checking status through an interrupt handling procedure. The differential equation processors  108  generate the solution spaces for the differential equations using ancillary data from the ancillary encryption processor, indicated by arrow ‘ 6 ’ and then export them via the data bus to the route processor  112 , which is indicated in FIG. 2 by arrow ‘ 7 ’. The differential equation processors also produce certain ancillary data which are exported via the data bus to the ancillary encryption processor  104 , which is indicated in FIG. 2 by arrow ‘ 8 ’.  
         [0051]    The route processor  112  begins its processing after the differential equation processors  108  have generated sufficient solution spaces for its processing activities. This is under command from the system controller  120  and is indicated by arrow ‘ 9 ’ in FIG. 2. This path also indicates the system controller  120  performance of its housekeeping task of checking status through an interrupt handling procedure. The route processor  112  uses data from both the ancillary encryption processor  104  and the differential equation processors  108  as is indicated in FIG. 2 by arrow ‘ 7 ’ and ‘ 10 ’, respectively. The route processor  112  then generates routes and then uses them and the solution space information generated by the differential equation processors  108  to generate route data. Under the timing command of the system controller  120 , the route processor  112  exports its data to the encryption engine processors  132 , which is indicated in FIG. 2 by arrow ‘ 11 ’.  
         [0052]    When the ancillary encryption processor, the differential equation processors, and the route processor have completed the pre-computation tasks, then the encryption of the original copy of wideband digital data can begin through the importing of these data by the input processor  116 . This is under commands from the system controller  120  and is indicated by arrow ‘ 12 ’ in FIG. 2. This path also indicates the system controller  120  performance of its housekeeping task of checking status through an interrupt handling procedure. The input processor  124  channelizes the data and arranges the data into appropriate frames for subsequent processing. Upon command of the system controller  120 , the input processor then exports frames of original copy of wideband digital data frames to one of the encryption engine processors  132 , as is indicated by arrow ‘ 13 ’ in FIG. 2.  
         [0053]    Each of the encryption engine processors  132  begins processing a frame of wideband digital data. This processing is under commands from the system controller  120  and is indicated by arrow ‘ 14 ’ in FIG. 2. This path also indicates the system controller  120  performance of its housekeeping task of checking status through an interrupt handling procedure. An encryption engine processor  132  also receives route data via the data bus  128  from the route processor  112  as is indicated by arrow ‘ 11 ’ in FIG. 2. Upon the completion of its encryption processing, each of the encryption engine processors  132  send the now encrypted data to the output processor  124  via the data bus  128  as is indicated by arrow ‘ 15 ’ in FIG. 2.  
         [0054]    The output processor  124  begins its processing upon the receipt and command of the system controller  120  as indicated by arrow ‘ 16 ’ in FIG. 2. This path also indicates the system controller  120  performance of its housekeeping task of checking status through an interrupt handling procedure. The output processor  124  receives data from both the ancillary encryption processor  104  and each of the encryption engine processors  132 . The output processor segregates the ancillary data from the encrypted version of the original copy of wideband digital data. Upon receiving encrypted wideband digital data, the output processor  132  recombines the frames and channels into a single file of encrypted original copy of wideband digital data.  
         [0055]    B. A Decryption Embodiment  
         [0056]    1. Functional Description  
         [0057]    A block diagram of the system architecture of a decryption embodiment of the present invention is illustrated in FIG. 3. Referring to FIG. 3, the system architecture for the decryption processor comprises eight distinct types of logical processors: ancillary encryption processor  304 ; differential equation processor  308 ; route processor  312 ; input processor  316 ; system controller  320 ; output processor  324 ; data bus  328 ; and encryption engine processor  332 .  
         [0058]    As illustrated in FIG. 3, a decryption embodiment of the present invention utilizes multiple independent differential equation processors  308  numbering MD and Additionally, the ancillary decryption processor  304  performs pre-computation processing of ancillary data (as described below) before any decryption processing is initiated. Computations by the differential equation processors  308  and the route processor  312  are done in parallel with the decryption processing by the decryption engine processors  332 . The combination of pre-computation and parallel processing itself to extremely high decryption rates.  
         [0059]    As described above in relation to an encryption embodiment of the present invention, ancillary data generated during the encryption process is saved for use in the decryption of the encrypted wideband data. Referring again to FIG. 3, the ancillary decryption processor  304  decrypts the ancillary data and regenerates the exchanged primary cryptographic keys and exchanged ancillary cryptographic keys.  
         [0060]    The differential equation processors  308  use ancillary data to generate a solution spaces based on a pre-selected numerical integration technique; and then store the solutions in form suitable and appropriate for subsequent processing. Because of the processing load inherent in the differential equation processor function, several parallel differential equation processors may be utilized. The number of such processors is denoted by M D , and is determined by the specific implementation of the system architecture of processors.  
         [0061]    The route processor  312  generates and sets the step intervals for all routes and generates all the routes required by the decryption engine processor.  
         [0062]    The system controller  320  manages a primary and an ancillary cryptographic key, both held in static memory, and structures and organizes all of the processing for the decryption processors  332 , including, but not limited to, initiation of processing, routing of data, and maintaining timing and data transfers of all other processors. In an alternate embodiment of the present invention, an external authentication center is used to authenticate the user and to exchange keys. In this alternate embodiment, the system controller  320  also establishes and verifies the authenticity of the user through two-way communications with the systems authentication center  
         [0063]    The input processor  316  receives the files of encrypted ancillary data and the encrypted version of the original wideband digital data; separates the encrypted ancillary data from the encrypted version of the original wideband digital image data; partitions the encrypted wideband digital data into the appropriate number of channels; and partitions the channelized data into frames.  
         [0064]    The output processor  324  receive the clear text version of the original copy of the wideband digital data from the decryption engine processors  332 , puts the frame and channel data back into the original order; and transmits the clear text wideband digital data to a user device such as a projector or display system.  
         [0065]    The data bus  328  routes, within the accepted timelines and data bandwidths, all of the data between all of the processors of a decryption embodiment.  
         [0066]    The decryption engine processor  332  decrypts the encrypted version of the original wideband digital data using the decryption mode of a NACE. The NACE Application also disclosed optional smoothing functions DNLS 2 , DLS 2 , DNLS 1 , and DLS 1 . A decryption embodiment of the present invention implements these functions along with the DS function in the decryption engine processor  332 . However, as would be apparent to someone skilled in the art of the present invention, these optional smoothing functions may be omitted without departing from the scope of the present invention  
         [0067]    Because of the processing load inherent in the decryption engine processor function, several parallel decryption engine processors may be utilized. The number of such processors is denoted by ND, and is determined by the specific implementation of the system architecture of the decryption processor.  
         [0068]    In a decryption embodiment of the present invention, each decryption engine processor receives channelized and framed data of the encrypted version of the original wideband digital data. Thus, the encrypted wideband digital data is being processed using parallel processing resulting in extremely high decryption data rates.  
         [0069]    2. Logical Flow  
         [0070]    [0070]FIG. 4 contains a flow diagram that illustrates the information and data flow within the system architecture for the decryption processor. Within FIG. 4 the arrows indicate the directionality of the data flow, for both information and control types of data. A bidirectional arrow indicates communication between two processors, whereas a single direction arrow indicates data transfer from one process to another. All of the processors previously described access data and interchange through the data buss  328 . All of the processor modules are activated and controlled by the system controller  320  through the data bus.  
         [0071]    The flow of the decryption process of an encrypted version of the wideband digital data begins with a command from the system controller to the input processor  316  to initiate the decryption. This is described by arrow ‘ 1 ’ in FIG. 4. The input processor  316  then imports all of the encrypted files. The encrypted files comprise two distinctly different types of data: the encrypted ancillary data files and the encrypted version of the original copy of the wideband digital data. The input processor  316  strips the encrypted ancillary data file and sends it to the ancillary decryption processor  304  via the data bus as is indicated by arrow ‘ 2 ’ in FIG. 4.  
         [0072]    The ancillary decryption processor  304  receives the encrypted ancillary data files. This is under commands from the system controller  320  and is indicated by arrow ‘ 3 ’ in FIG. 4. This path also represents the system controller  320  performing its housekeeping task of checking status through an interrupt handling procedure. The receipt of the encrypted ancillary data files from the input processor  116  is indicated by arrow ‘ 2 ’ in FIG. 4. This initiates the pre-computation phase of the decryption process. The ancillary decryption processor  304  decrypts the encrypted ancillary data file to recover the original ancillary data, which comprises seed data, random numbers, and route constructor data. This data is then transmitted to the differential equation processors  308  and the route processor  312  using the data bus  328  and is indicated in FIG. 4 by arrow ‘ 4 ’ and arrow ‘ 5 ’, respectively. The ancillary decryption processor  304  also uses ancillary data and the primary and ancillary cryptographic keys to regenerate the exchanged primary and ancillary cryptographic keys. These data are retained by the ancillary decryption processor for subsequent use in the decryption processing.  
         [0073]    The differential equation processors  308  begin their activity after the ancillary encryption processor  304  has generated the exchanged ancillary cryptographic keys and decrypted the encrypted ancillary data. This is under commands from the system controller  320  and is indicated by arrow ‘ 6 ’ in FIG. 4. This path also represents the system controller  320  performing its housekeeping task of checking status through an interrupt handling procedure. The differential equation processors  308  generate the solution spaces for the differential equations using ancillary data from the ancillary decryption processor  304 , indicated by arrow ‘ 4 ’ and then exports the solution spaces via the data bus  328  to the route processor  312 , which is indicated in FIG. 4 by arrow ‘ 7 ’.  
         [0074]    The route processor  312  begins its processing after the differential equation processors  308  have generated sufficient solution spaces for its processing activities. This is under commands from the system controller  120  and is indicated by arrow ‘ 8 ’ in FIG. 4. This path also represents the system controller  320  performing its housekeeping task of checking status through an interrupt handling procedure. The route processor  312  uses data from both the ancillary decryption processor  304  and the differential equation processors  308  as is indicated in FIG. 4 by arrows ‘ 5 ’ and ‘ 7 ’, respectively. The route processor  308  generates routes and then uses them and the solution space information generated by the differential equation processors  308  to generate route data. Under the timing command of the system controller  320 , the route processor exports its data to the decryption engine processors  332 , which is indicated in FIG. 4 by arrow ‘ 9 ’.  
         [0075]    When the ancillary decryption processor, the differential equation processors, and the route processor have completed the pre-computation tasks, then the decryption of the encrypted version of the original clear wideband digital data can begin. This process is controlled by commands from the system controller  320  and is indicated by arrow ‘ 1 ’ in FIG. 4. This path also represents the system controller  320  performing its housekeeping task of checking status through an interrupt handling procedure.  
         [0076]    The process begins with the receipt of the encrypted original copy of the wideband digital data by the input processor  316 . The input processor  316  channelizes the data and arranges the channelized data into appropriate frames for subsequent processing. Upon command of the system controller  320 , the input processor  316  then exports the frames of the encrypted wideband digital data frames to one of the decryption engine processors  332 , as is indicated by arrow ‘ 10 ’ in FIG. 4.  
         [0077]    Each of the decryption engine processors  332  begins processing of a frame of encrypted wideband digital data under the control of the system controller  320  and is indicated by arrow ‘ 11 ’ in FIG. 4. This path also represents the system controller  320  performing its housekeeping task of checking status through an interrupt handling procedure. The encryption engine processor  332  also receives route data via the data bus  328  from the route processor  312  as is indicated by the arrow ‘ 9 ’ in FIG. 4. Upon the completion of its decryption processing, each of the decryption engine processors  332  sends the now decrypted data to the output processor  324  via the data bus  328  as is indicated by arrow ‘ 12 ’ in FIG. 4.  
         [0078]    The output processor  324  begins its processing upon the receipt under command of the system controller  320  and is indicated by arrow ‘ 13 ’ in FIG. 4. This path also represents the system controller  320  performing its housekeeping task of checking status through an interrupt handling procedure. The output processor  324  then puts the frames and channels back into the original order for transmission to a user device, such as a projector or display system.  
         [0079]    A non-algebraic cryptographic architecture has been described. As described herein, the non-algebraic cryptographic architecture provides for protection of wideband digital data while permitting such data to be encrypted and decrypted at speeds that satisfy the data rates required by both current and future wideband applications. Additionally, the present invention has achieved the aforementioned high data rates without requiring the intermediate storage of any clear text wideband digital data. It will be understood by those skilled in the art of the present invention that the present invention may be embodied in other specific forms without departing from the scope of the invention disclosed and that the examples and embodiments described herein are in all respects illustrative and not restrictive. Those skilled in the art of the present invention will recognize that other embodiments using the concepts described herein are also possible.