ITERATIVE CIPHER KEY-SCHEDULE CACHE FOR CACHING ROUND KEYS USED IN AN ITERATIVE ENCRYPTION/DECRYPTION SYSTEM AND RELATED METHODS

A key-schedule cache stores at least one key schedule based on a cipher key for data transformation using a block cipher. To obtain the round key for a data transformation, a key-word set, which may be a cipher key, including at least one round key is received in a round key control-circuit. The round key control-circuit determines whether the plurality of key words is already stored in the key-schedule cache and also determines whether the next round key, based on the key-word set, is also stored in the key-schedule cache. If the next round key is stored in the key-schedule cache, the round key control-circuit reads the next round key from the key-schedule cache and supplies the next round key to a next round key output. The round key control-circuit may also generate the next round key.

BACKGROUND

I. Field of the Disclosure

The technology of the disclosure relates generally to iterative data encryption/decryption ciphers, such as the Advanced Encryption Standard (AES), for example, in a processor using iteratively generated round cipher keys.

Information security is vital to many types of computer-related processing activities, such as computerized financial services, legal transactions, and personal communications. These computerized activities often involve handling of private information which can then be at risk of exposure or hacking to unauthorized entities when the private information is transmitted and/or stored in digital form. One way to maintain security of information in a document that is transmitted or stored in digital form is to encrypt the information. The private information can then be retrieved by decrypting the information in an authorized manner. For example, to keep a document secure, an author can use a computer application executing on a processor to encrypt the document according to an encryption algorithm into an encrypted, unrecognizable form based on a cipher key created by the author. The cipher key is a string of data that is characterized by its length in bits. Subsequently, the encrypted document can be transformed back into its original readable form by employing the same cipher key and a corresponding decryption program. In this way, the information in the document is only available in unencrypted form to those individuals having access to the cipher key that was used to encrypt the document and knowledge of the encryption algorithm used for the encryption.

One type of encryption algorithm (“encryption scheme”) that can be used to encrypt a document is a block cipher. The document is divided into blocks, each having a particular number of words, and a block cipher is applied to transform each block into an encrypted block. An example of a block cipher is the Advanced Encryption Standard (AES). AES is an iterative block cipher or algorithm that receives a block of the original document (e.g., in binary form), and a cipher key and generates a first transformed block. A block is first transformed by the cipher key. Additional keys are generated from the cipher key using a key expansion algorithm. One of the generated keys is used in each round of further block transformations of the first transformed block. The keys used in each round are referred to as round keys, and a key schedule is comprised of the cipher key and all round keys generated from the cipher key. The key expansion algorithm can operate in a forward direction for encryption or a backward direction for decryption.

SUMMARY OF THE DISCLOSURE

Aspects disclosed herein include an iterative cipher key-schedule cache for caching round keys used in an iterative encryption/decryption system. Related methods are also discussed. A block cipher is an algorithm used to encrypt a block of data in binary form into an unrecognizable form to prevent unauthorized access to the data. The algorithm includes a predetermined number of rounds of data transformation. The transformation begins in a first round using at least a portion of the cipher key and generates a new round key for each additional round. The round keys are generated from the cipher key using a key expansion algorithm. The complete set of round keys, including the cipher key, forms a key schedule. Since the same key schedule is employed for transforming (i.e., encrypting and/or decrypting) every data block of a document, the key schedule is used repeatedly. In some implementations, the key schedule is not stored for security reasons so the entire key schedule is regenerated from the cipher key each time a new block is transformed, wasting processor capacity and power. In other implementations, the round keys are stored in memory requiring frequent memory operations to access the round keys. In yet other implementations, the round keys are kept in the register file, occupying a limited processor resource.

An exemplary key-schedule cache is employed for storing at least one key schedule based on a cipher key for data transformation using a block cipher. To obtain the round key for a data transformation, a plurality of key words, or a key-word set, including at least one round key are received in a round key control-circuit. The key-word set may, for example, be a cipher key. The round key control-circuit determines whether the plurality of key words is already stored in the key-schedule cache and also determines whether the next round key, based on the key-word set, is also stored in the key-schedule cache. If the next round key is stored in the key-schedule cache, the round key control-circuit reads the next round key from the key-schedule cache. In one example, if the key-word set is not stored in the key-schedule cache, the round key control-circuit generates the next round key. In another example, if the key-word set is stored in the key-schedule cache, but the next round key is not stored in the key-schedule cache, the round key control-circuit generates the next round key. The next round key, whether it is read from the key-schedule cache or generated, is supplied, for example, to an encryption/decryption engine for the next round of data transformation according to the block cipher.

In this regard, in exemplary aspects disclosed herein, a round key control-circuit is disclosed. The round key control-circuit is configured to store at least one key schedule comprising round keys, each round key corresponding to a data transformation round of a block cipher and comprising a plurality of key words. The round key control-circuit is also configured to receive a key-word set comprising a plurality of key words of a key schedule, the key-word set comprising at least one round key, and determine whether the key-word set is stored in a key-schedule cache. In response to determining the key-word set is stored in the key-schedule cache, the round key control-circuit is also configured to determine whether a next round key, based on the key-word set, is stored in the key-schedule cache, and, in response to determining the next round key is stored in the key-schedule cache, read the next round key from the key-schedule cache. The round key control-circuit is further configured to supply the next round key to a next round key output.

In another exemplary aspect, a method of a round key control-circuit is disclosed. The method comprises storing at least one key schedule comprising round keys, each round key corresponding to a data transformation round of a block cipher and comprising a plurality of key words. The method includes receiving a key-word set comprising a plurality of key words of a key schedule, the key-word set comprising at least one round key, and determining whether the key-word set is stored in a key-schedule cache. The method also includes, in response to determining the key-word set is stored in the key-schedule cache, determining whether a next round key, based on the key-word set, is stored in the key-schedule cache. The method also includes reading the next round key from the key-schedule cache in response to determining the next round key is stored in the key-schedule cache. The method also includes supplying the next round key to a next round key output.

In another exemplary aspect, a processor circuit comprising a key-schedule cache and a round key control-circuit is disclosed. The round key control-circuit is configured to store at least one key schedule in the key-schedule cache, the at least one key schedule comprising round keys, each round key corresponding to a data transformation round of a block cipher and comprising a plurality of key words. The round key control-circuit is also configured to receive a key-word set comprising a plurality of key words of a key schedule, the key-word set comprising at least one round key, and determine whether the key-word set is stored in the key-schedule cache. The round key control-circuit is also configured to, in response to determining the key-word set is stored in the key-schedule cache, determine whether a next round key, based on the key-word set, is stored in the key-schedule cache. The round key control-circuit is also configured to, in response to determining the next round key is stored in the key-schedule cache, read the next round key from the key-schedule cache. The round key control-circuit is further configured to supply the next round key to a next round key output.

DETAILED DESCRIPTION

Aspects disclosed herein include an iterative cipher key-schedule cache for caching round keys used in an iterative encryption/decryption system. Related methods are also discussed. A block cipher is an algorithm used to encrypt a block of data in binary form into an unrecognizable form to prevent unauthorized access to the data. The algorithm includes a predetermined number of rounds of data transformation. The transformation begins in a first round using at least a portion of the cipher key and generates a new round key for each additional round. The round keys are generated from the cipher key using a key expansion algorithm. The complete set of round keys, including the cipher key, forms a key schedule. Since the same key schedule is employed for transforming (i.e., encrypting and/or decrypting) every data block of a document, the key schedule is used repeatedly. In some implementations, the key schedule is not stored for security reasons so the entire key schedule is regenerated from the cipher key each time a new block is transformed, wasting processor capacity and power. In other implementations, the round keys are stored in memory requiring frequent memory operations to access the round keys. In yet other implementations, the round keys are kept in the register file, occupying a limited processor resource.

An exemplary key-schedule cache is employed for storing at least one key schedule based on a cipher key for data transformation using a block cipher. To obtain the round key for a data transformation, a plurality of key words, or a key-word set, including at least one round key are received in a round key control-circuit. The key-word set may, for example, be a cipher key. The round key control-circuit determines whether the plurality of key words is already stored in the key-schedule cache and also determines whether the next round key, based on the key-word set, is also stored in the key-schedule cache. If the next round key is stored in the key-schedule cache, the round key control-circuit reads the next round key from the key schedule. In one example, if the key-word set is not stored in the key-schedule cache, the round key control-circuit generates the next round key. In another example, if the key-word set is stored in the key-schedule cache, but the next round key is not stored in the key-schedule cache, the round key control-circuit generates the next round key. The next round key, whether it is read from the key-schedule cache or generated, is supplied, for example, to an encryption/decryption engine for the next round of data transformation according to the block cipher.

Before discussing exemplary iterative encryption/decryption systems that include a round key control-circuit employing an iterative cipher key-schedule cache for storing (i.e., caching) and supplying a previously generated round key of a key schedule for transforming a data block, the iterative Advanced Encryption Standards (AES-128, AES-192, and AES-256) are first discussed with regard toFIGS. 1-4for context. The AES encryption/decryption schemes are block ciphers that iteratively transform data blocks of a document in binary form to encrypt or decrypt the document. Each data block is transformed in multiple rounds of operations that each employ a respective key used to operate on an input data block. In the first round, the input data block is the original binary data of a document, and the round key is at least a portion of a cipher key. The cipher key is a plurality of binary data words (“key words”) from a key provided by a document owner, for example. In the next (i.e., second) round, the data block transformed in the first round is the input data block to the second round. A next round key for the second round is generated from the key words of the cipher key, depending on the particular AES employed, and based on a key generation algorithm.

In the example of AES-128, the first round key, which is the cipher key, is 128 bits, the next round key is a 128 bit key generated from the cipher key, and all subsequent keys are 128 bit keys generated from a previous key. In AES-192, the cipher key contains the first round key (128 bits) and half (64 bits) of the second round key. The remainder of the second round key is generated based on the cipher key. In AES-256, the cipher key of 256 bits includes the first round key and the second round key of 128 bits each. Subsequent keys are generated based on the cipher key. In each subsequent round, the data block input is the transformed data from the previous data transformation round, and the key used for data transformation is generated from previous round keys.

As noted, in each of AES-128, AES-192, and AES-256, a 128 bit round key is used to perform data transformation in each round. However, the 128 bits, or four (4) words of the round keys are generated in different manners. In AES-128, the cipher key is a first 128 bit (4 word) round key used in the first data transformation round. Using a key expansion algorithm, the second 128 bit round key is generated from the first 128 bit round key, and the third 128 bit round key is generated from the second 128 bit round key, and so on. Thus, each of the round keys in the key schedule is based on the cipher key.

In AES-192, the cipher key is 192 bits or a six (6) key-word set. Although the key words are taken 4 at a time as round keys, the corresponding key expansion algorithm generates additional key words of the key schedule 6 key words at a time from the cipher key and continues to generate a next 6 key words from the previous 6 key words. In AES-256, the cipher key is 256 bits or an eight (8) key-word set, which includes 4 key words for the first round key used in the first data transformation round and 4 words for the second round key used in the second data transformation round. The corresponding key expansion algorithm generates 8 more key words from the cipher key and continues to generate 8 key words of the key schedule 8 at a time. Herein, the term “key-word set” will be used to refer to a plurality of key words of a cipher key or another plurality of key words of a same size as a cipher key and generated as a set in the key expansion algorithm. Thus, the key-word sets for AES-128, AES-192, and AES-256 are 4 key words, 6 key words, and 8 key words, respectively.

While the inventive aspects disclosed herein are described with reference to block ciphers AES-128, AES-192, and AES-256, the present disclosure and claims are not limited in this regard and are understood to be applicable to other iterative block ciphers.

FIG. 1is a flowchart100illustrating encryption rounds102(0)-120(n) of an AES block encryption scheme (“encryption sequence”)104. In each of the encryption rounds102(0)-102(n), a key and a data block are received, and an encrypted. data block is generated.FIG. 1also shows decryption rounds106(n)-106(0) of an AES data block decryption scheme (“decryption sequence”)108. As noted above, AES may be implemented with different key lengths (i.e., 128, 192, or 256 bits). The number of rounds (n+1) varies according to the key length. For example, AES encryption using a 128 bit key consists of eleven (11) rounds. In this example, the AES encryption sequence104may include encryption rounds102(0)-102(10) (e.g., “n”=10), and the corresponding AES decryption sequence108may include decryption rounds106(10)-106(0). In this example, a key schedule110includes ten (10) generated round keys112(1)-112(10), each 128 bits in length and generated successively from a 128 bit cipher key, which is the first round key112(0). In the AES decryption sequence108, the round keys112(0)-112(n) are used in the decryption rounds106(n)-106(0) in reverse order compared to the encryption sequence104. In other words, the AES decryption sequence108begins with decryption round106(n) using round key112(n), and the last decryption round106(0) uses the cipher key (round key112(0)).

FIG. 2is a flowchart200illustrating a set of operations202(1)-202(4) performed in any encryption round102(x) (where x=1 to n−1) in the AES encryption sequence104inFIG. 1. Each of such rounds includes a “Substitute Bytes” operation202(1), a “Shift Rows” operation202(2), a “Mix Columns” operation202(3), and an “Add Round Key” operation202(4). The operations performed in encryption rounds102(0) and102(n) of the AES encryption sequence104differ from those of encryption rounds102(1)-102(n−1), and will not be described further here, but all of the encryption rounds102(0)-102(n) receive a block of data and a key and generate encrypted data.FIG. 2also illustrates a set of operations204(1)-204(4) performed in a decryption round106(x), where x=n−1 to1in the decryption sequence108. Each of these rounds includes an “Inverse Shift Rows” operation204(1), an “Inverse Substitute Keys” operation204(2), an “Add Round Key” operation204(3), and an “Inverse Mix Columns” operation204(4). The operations performed in decryption rounds106(0) and106(n) of the AES decryption sequence108differ from those of decryption rounds106(1)-106(n−1), and will not be described further here, but all of the decryption rounds106(0)-106(n) receive an encrypted block of data and a key and generate decrypted data. Additional details of the AES encryption sequence104and decryption sequence108are publicly available and not described in further detail here.

FIG. 3illustrates a key schedule300generated from a cipher key301, based on a key expansion algorithm for the corresponding block cipher. The cipher key301includes the first round key112(0) for use in the encryption round102(0). The remaining round keys112(1)-112(n) (not shown) are generated from the cipher key301for using in the remaining encryption rounds102(1)-102(n) of the encryption sequence104and in decryption rounds106(n)-106(0) of the decryption sequence108.FIG. 3illustrates the cipher key301as an array of bytes B0-B(4K−1), where K is the number of key words (4, 6, or 8) in the cipher key301depending on the block ciphers AES-128, AES-192, and AES-256, respectively. The round key112(0) may be formed of four (4) 32-bit words (key words302(0)-302(3)) each consisting of four (4) bytes (i.e., 8 bits) of the cipher key301. In AES-128, for example, one of the round keys1112(1)-112(10) is generated for each of the encryption rounds102(1)-102(10), to produce a key schedule300consisting of a total of 44 key words302(0)-302(43). In AES-192, the round key112(0) is the first4words of the cipher key301, which includes six (6) 32-bit words (key words302(0)-302(5)), and in AES-256 the cipher key301includes eight (8) 32-bit words (key words302(0)-302(7)) including the first and second round keys112(0)-112(1).

FIG. 4illustrates the operations of an AES key expansion engine400consistent with the AES-128 and AES-192 algorithms. Operation of the AES key expansion engine400begins by receiving a cipher key402, generating a first key-word set404from the cipher key402, and generating a second key-word set406from the first key-word set404. The cipher key402may be the cipher key301and includes key words302(0)-302(K−1), where K is the number of key words in a cipher key. As shown, the key words302(K)-302(2K−1) are generated from the cipher key402and key words302(2K)-302(3K−1) are generated from the key words302(K)-302(2K−1), and so on. A function (G) is applied to key word302(K−1), and the result G(302(K−1)) is exclusively-ORed (XORed) with key word302(0) to generate key word302(K). As shown, key words302(K+1) through302(2K−1) are generated through a sequence of operations, which continues to key word302(4R−1) (seeFIG. 3), where “R” is the number of rounds in a block cipher.

To generate the entire key schedule300, which may he discarded immediately after a block is transformed, the large number of required operations illustrated in part inFIG. 4consume many processing cycles and a significant amount of power. if the same key schedule300is immediately needed again to process the next data block of a document for encryption or decryption, the processing cycles and power consumption could be saved by storing the key schedule300.

The instruction architecture of a processing circuit (“processor”) may include encryption/decryption (enc/dec) instructions available to a programmer for performing a data transformation as part of a programmed application. In one example, each enc/dec instruction may cause the processor to perform a single round (i.e., a “single round instruction”) of transformation on a data block. Therefore, prior to executing the enc/dec instruction, a round key request instruction must be issued to obtain the appropriate round key for the transformation round. In this method, a round key request instruction is issued for each round. However, generating a round key every time it is used wastes processor cycles and power. Storing round keys in memory creates a security risk, and temporarily saving the round keys in a register file limits the fast temporary storage available to the processor for operands.

Alternatively, an instruction architecture of a processor may include an enc/dec instruction to perform all rounds (i.e., an “all rounds instruction”) of a block cipher, such as the encryption sequence104and the decryption sequence108inFIG. 1. When an all rounds enc/dec instruction is executed, the processor or encryption engine can execute all the iterative transformation rounds in a manner that is transparent to the programmer. A round key corresponding to each of the R transformation rounds would he needed by the processor or encryption engine. A related all rounds round key request instruction may be employed to obtain the round keys individually in sequence.

Other variations of enc/dec instructions are also possible, such as instructions for executing a number of rounds but less than all rounds. In accordance with such instructions, other variations of round key request instructions would be issued within the processor.

FIG. 5is a schematic diagram of an exemplary round key control-circuit500in a processor or iterative encryption/decryption system (“processor”)501. As shown inFIG. 5, the round key control-circuit500includes a key-schedule cache502configured to store at least one key schedule504. in an alternative example, the key-schedule cache502may be external to the round key control-circuit500. A round key request instruction506(also referred to herein as a “request instruction506”) includes a request for a next round key508or a portion (e.g., half) of the next round key508. The request instruction506can be received on a dedicated serial or parallel interface, or a shared system bus, etc. In one example, the round key control-circuit500receives a key-word set510in association with the round key request instruction506. Key-word sets510are generated according to a key expansion algorithm corresponding to a block cipher. A key-word set510is created from a cipher key511and sized according to the block cipher. The key schedule504consists of key-word sets510beginning with the cipher key511and the remaining key-word sets510are generated in sequence starting from the cipher key511. In the key-schedule cache502inFIG. 5, the cipher key511may be stored in any one or more of the cache entries512. In one example, the remaining key-word sets510of the key schedule504may be stored as they are created in sequential cache entries512. adjacent to the cipher key511. A key-word set510is a set of key words (e.g., 32 bits per word) equal in size to a cipher key511(i.e., same number of key words, depending on the block cipher), and the key-word set510received with the round key request instruction506may be the cipher key511. The key expansion algorithm corresponding to the block cipher may be determined by the size (e.g., number of key words) of the received key-word set510or may be determined based on the round key request instruction506or a parameter included in the round key request instruction506. The cipher key511may be provided to identify the key-schedule cache502. Alternatively, the key-word set510received in association with the round key request instruction506may be the key-word set510immediately preceding the key-word set510containing the requested next round key508or a portion of the requested next round key508(or portion thereof). The key-word set510may be provided separate from the request instruction506or on a same interface.

While the cipher key511and the rest of the key schedule504are kept in the key-schedule cache502, they are kept secure by virtue of the fact that the only way to read the round keys508from the key-schedule cache502is to supply all of the information necessary to generate them. The key-schedule cache502may be viewed as a black box that speeds up subsequent generations of the key schedule504after it is initially generated, to reduce power consumption. Unlike storing the round keys508in registers, traditional caches, or memory, the key-schedule cache502does not store the round keys508in insecure locations, where they might be accessed in a manner that is not intended.

The round key control-circuit500is configured to securely store a key schedule504including a cipher key511and other key-word sets510, which are generated from the cipher key511. If a key schedule504based on a cipher key511is stored in the key-schedule cache502, and the same cipher key511is subsequently employed by the processor501to encrypt or decrypt additional data blocks, it is not necessary to regenerate the key schedule504for each data block. Round keys508that are requested but not present in the key-schedule cache502are generated and may be stored in the key-schedule cache502until they are purged, over-written, or invalidated, for example.

With continued reference toFIG. 5, the round key control-circuit500includes the key-schedule cache502including a plurality of cache entries512to store round keys508of a key schedule504. Each round key508stored in a cache entry512corresponds to a data transformation round of a block cipher. A round key508stored in the key-schedule cache502may have been received in a cipher key511or other key-word set510received in association with the request instruction506. The cipher key511or other key-word set510is received on a key-word set input514. A stored round key508may also have been generated from the received cipher key511or another key-word set510, or generated from another key-word set510previously generated within the round key control-circuit500. The key-schedule cache502is configured to store at least one key schedule504and may store multiple key schedules504.

In the case of a processor executing a single round key request instruction, a cipher key511or other key-word set510is received with a round key request instruction506requesting a next round key508and the round key control-circuit500returns the next round key508. The next round key508may be read from the key-schedule cache502, if available. In this regard, the round key control-circuit500includes a comparator circuit516that receives the key-word set510and determines whether the next round key508is stored in the key-schedule cache502by, for example, comparing at least a portion of the received key-word set510to at least a portion of key words stored in at least one cache entry512. The comparator circuit516may compare the at least one portion of the key-word set510to all of the key-word sets510stored in the cache entries512in the key-schedule cache502. The comparator circuit516receives stored key words from the cache entries512over a data bus CE OUT inFIG. 5. The details of cache management for controlling access to the cache entries512and providing the key words to the comparator circuit516for comparison to the key-word set510is design dependent, and may depend on a type of cache employed for the key-schedule cache502. The comparator circuit516may compare all of the key-word set510to cache entries512of the key-schedule cache502. The comparator circuit516may initially compare only a portion of the key-word set510to cache entries512.

The comparator circuit516is also configured generate a hit/miss indication H/M indicating whether the key-word set510is stored in the key-schedule cache502. If the comparator circuit516determines the received key-word set510is stored in the key-schedule cache502, the round key control-circuit500generates the hit/miss indication H/M, which is provided to a valid key indication circuit518. In response to the hit/miss indication HIM, the valid key indication circuit518determines whether the next round key508, based on the received key-word set510, is also stored in the key-schedule cache502. In this regard, the round key control-circuit500further includes a valid key indicator520indicating whether target cache entries512of the key-schedule cache502contain a valid round key508. The target cache entry512is the location in which the next round key508should be stored, if the next round key508is stored in the key-schedule cache502. And if the next round key508is stored in the key-schedule cache502, the next round key508is supplied to the processor501by a next round key circuit522on a next round key output NXT_RND_KEY.

in one example, in response to the hit/miss indication H/M indicating the key-word set510is stored in the key-schedule cache502, the valid key indication circuit518determines that the key-word set510stored in the key-schedule cache502is valid based on a valid key indicator520corresponding to the cache entry512in which the key-word set510is stored.

In some examples, the round key request instruction506includes an indication of a round number RN. For example, the cipher key511may be provided as the key-word set510with a request for the next round key508, and the round number RN indicates a target cache entry512where the next round key508may be stored based on a cache entry512containing the cipher key511(“cipher key cache entry512”). For example, the round number RN may be used as an index of cache entries512(e.g., from the cipher key cache entry512) or as an index of the key-word sets510stored in the key-schedule cache502. The next round key circuit522can determine whether the key-word set510, received in association with the round key request instruction506, is stored in the key-schedule cache502based on the valid key indicator520corresponding to the target cache entry512for the cipher key511.

In some examples, the round number RN indicates at least one cache entry512in which the key-word set510may be stored, and determining whether the key-word set510is stored in the key-schedule cache502is based on comparing at least a portion of the key-word set510to at least a portion of key words (e.g., 2 key words) stored in at least one cache entry512indicated by the round number RN. If the key-word set510is stored in one of the at least one cache entries512indicated by the round number RN, the next round key508is stored in a cache entry512corresponding to the at least one cache entry512. Thus, in response to determining that the key-word set510is stored in one of the at least one cache entries512indicated by the round number RN, the valid key indication circuit518checks the valid key indicator520associated with the cache entry512corresponding to the at least one cache entry512. The round key control-circuit500determines whether the next round key508is stored in the key-schedule cache502based on the valid key indicator520associated with the cache entry512corresponding to the at least one cache entry512.

In some examples, the key-word set510is the cipher key511, and the cipher key511is stored in a first one of the cache entries512. In this example, determining whether the next round key508is stored in the key-schedule cache502is based on the valid key indicator510corresponding to a target cache entry512, where the target cache entry512is indicated by the first one of the cache entries512and the round number RN.

The location of the target cache entry512may also be determined by a location of a cache entry512containing key words of the key-word set510, or may be determined by another aspect of the request instruction506(e.g., request instruction type) that indicates the particular round of the block cipher for which the round key508is needed. A key-word set510associated with the request for a next round key508might not be a cipher key511. The comparator circuit516may determine that the key-word set510is stored in a first cache entry512. or may determine that a last portion (e.g., last two key words) of the key-word set510is stored in the first cache entry512. In this example, all or a portion of the next round key508is stored in a target cache entry512adjacent to (e.g., next cache entry512after or before in the order of generating key-word sets510) the first cache entry512. Thus, determining whether the next round key508is stored in the key-schedule cache502is based on the valid key indicator520corresponding to the target cache entry512adjacent to the first cache entry512. InFIG. 5, the valid key indicators520are set by the VAL_SET signal and the outputs of the valid key indicators520are coupled to the valid key indication circuit518as signal VAL_IND. Thus, for example, ten (10) consecutive valid key indicators520sequential to a cache entry512in which a cipher key511is stored may indicate that an entire key schedule504of an AES-128 block cipher is stored in the key-schedule cache502.

in association with or within the round key request instruction506, the next round key circuit522may also include an encryption/decryption indicator ENC_DEC (“ENC_DEC indicator”) indicating whether a data block is being encrypted or decrypted. For example, the ENC_ DEC indicator may be employed to determine, in the case of a request instruction506requesting all round keys508of a key schedule504, whether the round keys508are provided sequentially in the order in which the round keys508are generated by the key expansion algorithm (for encryption), or in the reverse order (for decryption). In another example, the ENC_DEC indicator may be employed to determine whether a single requested round key508is in a key-word set510generated before or after the received key-word set510according to a key expansion algorithm of the block cipher. In this regard, in the case of the ENC_DEC indicator indicating encryption, determining whether the next round key508is stored in the key-schedule cache502is based on the valid key indicator520of a cache entry512for storing a round key508generated from the key-word set510according to a key expansion algorithm of the block cipher. In the case of the ENC_DEC indicator indicating decryption, determining whether the next round key508is stored in the key-schedule cache502is based on the valid key indicator520of a cache entry512for storing a round key508generated before the (received) key-word set510according to a key expansion algorithm of the block cipher.

In the case of a request instruction506requesting all round keys508of a key schedule504, the received key-word set510is the cipher key511of the key schedule504. In addition, an ENC_DEC indicator may also be received. In the case in which the ENC_DEC indicator indicates encryption, the requested next round key508is the first round key508of the key schedule504based on the cipher key511. In this case, the next round key508and the remaining round keys508of the key schedule504(generated based on the next round key508) are sequentially supplied to the processor501on the next round key output NXT_RND_KEY. That is, for each of the remaining round keys508of the key-schedule cache502based on the first round key508, in the order of round key508generation, the round key control-circuit500determines whether the round key508is stored in the key-schedule cache502, and in response to determining the round key508is stored in the key-schedule cache502, reads the round key508from the key-schedule cache502. In response to determining the round key508is not stored in the key-schedule cache502, a next round key circuit522generates the round key508and stores the round key508in the key-schedule cache502. Each round key508, whether read from the key-schedule cache502or generated in the next round key circuit522, is supplied to the next round key output NXT_RND_KEY.

In the case of a request instruction506requesting all round keys508of a key schedule504and the ENC_DEC indicator indicating decryption, the requested next round key508is a last round key508of the key schedule504based on the received cipher key511. Before supplying the last round key508to the next round key output NXT_RND_KEY, the next round key circuit522determines whether all the round keys508of the key schedule504based on the cipher key511are stored in the key-schedule cache502based on the valid key indicators520corresponding to the cache entries512for the round keys508of the key schedule504. The next round key circuit522sequentially generates (or requests generation of) round keys508not stored in the key-schedule cache502, and supplies the round keys508, from the last round key508of the key schedule504to the cipher key511in an order reverse to the order of round key508generation, to the next round key output NXT_RND_KEY.

With further reference toFIG. 5, the next round key circuit522includes a read control circuit52.4configured to read the next round key508from (e.g., the target cache entry512of) the key-schedule cache502in response to determining the next round key508is stored in the key-schedule cache502. The next round key circuit522. determines the next round key508is stored in the key-schedule cache502based on the hit/miss indication H/M indicating that the key-word set510received with the round key request instruction506is stored in the key-schedule cache502, and the valid key indicator520indicating the next round key508is stored in the target cache entry512of the key-schedule cache502.

In an example, the comparator circuit516is further configured to, in response to the hit/miss indication H/M indicating the received key-word set510is stored in the key-schedule cache502, generate a hit location identifier HIT_ADDR indicating a location of a cache entry512in which the received key-word set510is stored, and the next round key circuit522is further configured to determine a location TGT_ADDR of the target cache entry512of the key-schedule cache502based on the hit location identifier HIT_ADDR. The next round key circuit522generates address and control signals (not shown) to read the target cache entry512from the key-schedule cache502, and receives the next round key508from the target cache entry512over a data bus DOUT. The address of the target cache entry512may be determined based on the hit location identifier HIT_ADDR.

The next round key circuit522may be further configured to, in response to the received key-word set510received in the comparator circuit516being a generated round key of a key schedule504(i.e., not a cipher key), determine that the location TGT_ADDR of the target cache entry512is the next sequential cache entry512following the cache entry location identified by the hit location identifier HIT_ADDR. Alternatively, the next round key circuit522may be configured to, in response to the key-word set510received by the comparator circuit516being a cipher key511of the key-schedule cache502and the next round key circuit522receiving a round number RN included in or accompanying the round key request instruction506, determine the location TGT_ADDR of the target cache entry512based on the hit location identifier HIT_ADDDR and the round number1214. The valid key indication circuit518receives the location TGT_ADDR of the target cache entry512and the valid key indicators520for the target cache entry512and generates an indication TGT_VALID that the target cache entry512contains a valid round key508.

In other words, if the comparator circuit516determines the received key-word set510is stored in the key-schedule cache502, and the next round key508in the target cache entry512is indicated as valid by the corresponding valid key indicator520, the read control circuit524determines the next round key508is stored in the key-schedule cache502and reads the next round key508from target cache entry512of the key-schedule cache502.

On the other hand, if the comparator circuit516compares the key-word set510to the cache entries512(e.g., the cache entries512indicated as valid by the corresponding valid key indicators520) and determines that the key-word set510is not stored in the key-schedule cache502, the next round key circuit522generates the next round key508. Generating the next round key508includes generating, based on the key expansion algorithm corresponding to the block cipher, at least a portion of the next key-word set510. In response to generating the at least a portion of the next key-word set510, the next round key circuit522stores the at least a portion of the next key-word set510in the key-schedule cache502. Storing the next round key508in the key-schedule cache502includes storing the next key-word set510in the key-schedule cache502. Additionally, if the comparator circuit516determines the key-word set510is stored in the key-schedule cache502, but the valid key indication circuit518determines that the next round key508is not stored in the key-schedule cache502, the next round key circuit522generates the next round key508and stores the next round key508in the key-schedule cache502. In either of such circumstances, the next round key circuit522includes a key generation circuit526that generates a next round key508from the cipher key511or the key-word set510received with the round key request instruction506or from the last generated key-word set510in response to an all rounds request. The next round key circuit522either reads or generates the next round key508requested in the round key request instruction506and supplies the next round key508to the next round key output NXT_RND_KEY. The next round key circuit522includes a state machine528to control sequential operations such as sequentially supplying the round keys508to the processor501in response to a request instruction506requesting all round keys508of a key schedule504.100531With continued reference toFIG. 5, in response to the key generation circuit526generating the next round key508, the next round key circuit522stores the generated next round key508into the target cache entry512of the key-schedule cache502by way of a data bus DLN. In addition, the valid key indication circuit518sets the valid key indicator520corresponding to the target cache entry512to indicate the next round key508is stored in the target cache entry512. In one example, the key generation circuit526may interface to a round key generation engine that is external to the round key control-circuit500with the next round key circuit522controlling the interface. In such example, the key generation circuit526shown inFIG. 5would not include the round key generation engine. In one example, the processor501is the round key generation engine.

As noted above, in the example of the AES block ciphers, the key-word sets510may be 128, 192, or 256 bits in length, but the round keys508for each of these block ciphers is consistent at 128 bits (4 key words). Accordingly, an instruction architecture of a processor may include round key request instructions506containing key-word sets510of varying lengths. In one example, the cache entries512are each128bits and store one round key508. In another example, the cache entries512may each store one key-word set510with a length depending on the block cipher. To support key schedules504of different lengths, the next round key circuit522is configured for appropriate addressing and data management of different block ciphers. The width and controls of the comparator circuit516depend on supported block ciphers. In addition, the valid key indicators520would be adjusted depending on cache organization.

According to the example inFIG. 5, the round key control-circuit500ofFIG. 5includes the key-schedule cache502to store the at least one key schedule504, and the comparator circuit516to receive the key-word set510and determine whether the key-word set510is stored in the key-schedule cache502. The valid key indication circuit518determines whether the next round key508is stored in the key-schedule cache502, and the next round key circuit522can read the next round key508from the key-schedule cache502or generate the next round key508based on the key-word set510and supply the next round key508to the next round key output NXT_RIND_KEY. However, the structure inFIG. 5is only one non-limiting example for implementing the inventive aspects disclosed herein. The round key control-circuit500may be implemented in hardware logic circuits and storage elements formed of transistors and other electronic components on an integrated circuit, for example.

FIG. 6is flowchart of an exemplary method600of the round key control-circuit500inFIG. 5including storing at least one key schedule504comprising round keys508, each round key508corresponding to a data transformation round of a block cipher and comprising a plurality of key words (block602), receiving the key-word set510comprising a plurality of key words of the key schedule504, the key-word set510comprising at least one round key508(block604), and determining whether the key-word set510is stored in the key-schedule cache502(block606), The method600further includes, in response to determining the key-word set510is stored in the key-schedule cache502, determining whether a next round key508, based on the key-word set510, is stored in the key-schedule cache502. (block608), and, in response to determining the next round key508is stored in the key-schedule cache502, reading the next round key508from the key-schedule cache502(block610). The method600also includes supplying the next round key508to a next round key output NXT_RIND_KEY (block612).

FIG. 7is a schematic diagram of an exemplary round key control-circuit700in a processor701, wherein a key-schedule cache702includes a cipher key storage704for storing cipher keys706separate from a generated round key storage705for storing generated key-word sets710to reduce a number of comparisons required by a comparator circuit712to determine whether a cipher key706is stored in the key-schedule cache702. Aspects ofFIG. 7having similar functions to corresponding aspects ofFIG. 5are not discussed further here. The round key control-circuit700inFIG. 7is a modification of the round key control-circuit500inFIG. 5specifically for use in conjunction with an instruction architecture in which round key request instructions include a request for all round keys714of a key schedule. In this example, round key control-circuit700includes the key-schedule cache702configured to store generated round keys of at least one key schedule. The key-schedule cache702includes the cipher key storage704configured to store a cipher key of each of the at least one key schedule and the generated round key storage708. The comparator circuit712receives a cipher key706for a first data transformation round in the block cipher, determines whether the cipher key706is stored in the cipher key storage704, and generates a hit/miss indication H/M indicating whether the cipher key706is stored in the cipher key storage704. The round key control-circuit700includes the valid key indication circuit518and the valid key indicators520in the round key control-circuit500inFIG. 5and a next round key circuit716to control the separate cipher key storage704.

A round key control-circuit in an encryption/decryption system configured to store at least one key schedule including a cipher key and round keys generated based on the cipher key, and supply a next round key stored in the key-schedule cache to a processor to avoid wasting processor capacity and power consumption required to regenerate round keys of the key schedule from the same cipher key, such as the round key control-circuit inFIGS. 5 and 7, and according to any aspects disclosed herein, may be provided in or integrated into any processor-based device. Examples, without limitation, include a set top box, an entertainment unit, a navigation device, a communications device, a fixed location data unit, a mobile location data unit, a global positioning system (GPS) device, a mobile phone, a cellular phone, a smart phone, a session initiation protocol (SIP) phone, a tablet, a phablet, a server, a computer, a portable computer, a mobile computing device, a wearable computing device (e.g., a smart watch, a health or fitness tracker, eyewear, etc.), a desktop computer, a personal digital assistant (PDA), a monitor, a computer monitor, a television, a tuner, a radio, a satellite radio, a music player, a digital music player, a portable music player, a digital video player, a video player, a digital video disc (DVD) player, a portable digital video player, an automobile, a vehicle component, avionics systems, a drone, and a multicopter.

in this regard,FIG. 8illustrates an example of a processor-based system800including a round key control-circuit in an encryption/decryption system configured to store at least one key schedule including a cipher key and round keys generated based on the cipher key, and supply a next round key stored in the key-schedule cache to a processor to avoid wasting processor capacity and power consumption required to regenerate round keys of the key schedule from the same cipher key, such as the round key control-circuit inFIGS. 5 and 7, and according to any aspects disclosed herein. In this example, the processor-based system800includes one or more central processor units (CPUs)802, which may also be referred to as CPU or processor cores, each including one or more processors804. The CPU(s)802may have cache memory806coupled to the processor(s)804for rapid access to temporarily stored data. As an example, the processor(s)804could include a round key control-circuit in an encryption/decryption system configured to store at least one key schedule including a cipher key and round keys generated based on the cipher key, and supply a next round key stored in the key-schedule cache to a processor to avoid wasting processor capacity and power consumption required to regenerate round keys of the key schedule from the same cipher key, such as the round key control-circuit inFIGS. 5 and 7, and according to any aspects disclosed herein. The CPU(s)802is coupled to a system bus808and can intercouple master and slave devices included in the processor-based system800. As is well known, the CPU(s)802communicates with these other devices by exchanging address, control, and data information over the system bus808. For example, the CPU(s)802can communicate bus transaction requests to a memory controller810as an example of a slave device. Although not illustrated inFIG. 8, multiple system buses808could be provided, wherein each system bus808constitutes a different fabric.

Other master and slave devices can be connected to the system bus808. As illustrated inFIG. 8, these devices can include a memory system812that includes the memory controller810and one or more memory arrays814, one or more input devices816, one or more output devices818, one or more network interface devices820, and one or more display controllers822, as examples. Each of the memory system812, the one or more input devices816, the one or more output devices818, the one or more network interface devices820, and the one or more display controllers822can include a round key control-circuit in an encryption/decryption system configured to store at least one key schedule including a cipher key and round keys generated based on the cipher key, and supply a next round key stored in the key-schedule cache to a processor to avoid wasting processor capacity and power consumption required to regenerate round keys of the key schedule from the same cipher key, such as the round key control-circuit inFIGS. 5 and 7, and according to any aspects disclosed herein. The input device(s)816can include any type of input device, including, but not limited to, input keys, switches, voice processors, etc. The output device(s)818can include any type of output device, including, but not limited to, audio, video, other visual indicators, etc. The network interface device(s)820can be any device configured to allow exchange of data to and from a network824. The network824can be any type of network, including, but not limited to, a wired or wireless network, a private or public network, a local area network (LAN), a wireless local area network (WLAN), a wide area network (WAN), a BLUETOOTH™ network, and the Internet. The network interface device(s)820can be configured to support any type of communications protocol desired.

The CPU(s)802may also be configured to access the display controller(s)822over the system bus808to control information sent to one or more displays826. The display controller(s)822sends information to the display(s)826to be displayed via one or more video processors828, which process the information to be displayed into a format suitable for the displays)826. The display(s)826can include any type of display, including, but not limited to, a cathode ray tube (CRT), a liquid crystal display (LCD), a plasma display, a light emitting diode (LED) display, etc. The display controller(s)822, display(s)826, and/or the video processor(s)828can include a round key control-circuit in an encryption/decryption system configured to store at least one key schedule including a cipher key and round keys generated based on the cipher key, and supply a next round key stored in the key-schedule cache to a processor to avoid wasting processor capacity and power consumption required to regenerate round keys of the key schedule from the same cipher key, such as the round key control-circuit inFIGS. 5 and 7, and according to any aspects disclosed herein.

FIG. 9illustrates an exemplary wireless communications device900that includes radio frequency (RF) components formed from an integrated circuit (IC)902, wherein any of the components therein can include a round key control-circuit in an encryption/decryption system configured to store at least one key schedule including a cipher key and round keys generated based on the cipher key, and supply a next round key stored in the key-schedule cache to a processor to avoid wasting processor capacity and power consumption required to regenerate round keys of the key schedule from the same cipher key, such as the round key control-circuit inFIGS. 5 and 7, and according to any aspects disclosed herein. The wireless communications device900may include or be provided in any of the above-referenced devices, as examples. As shown inFIG. 9, the wireless communications device900includes a transceiver904and a data processor906. The data processor906may include a memory to store data and program codes. The transceiver904includes a transmitter908and a receiver910that support bi-directional communications. in general, the wireless communications device900may include any number of transmitters908and/or receivers910for any number of communication systems and frequency bands. All or a portion of the transceiver904may be implemented on one or more analog ICs, RF ICs (RFICs), mixed-signal ICs, etc.

The transmitter908or the receiver910may be implemented with a super-heterodyne architecture or a direct-conversion architecture. In the super-heterodyne architecture, a signal is frequency-converted between RF and baseband in multiple stages, e.g., from RF to an intermediate frequency (IF) in one stage, and then from IF to baseband in another stage for the receiver910. In the direct-conversion architecture, a signal is frequency-converted between RF and baseband in one stage. The super-heterodyne and direct-conversion architectures may use different circuit blocks and/or have different requirements. In the wireless communications device900inFIG. 9, the transmitter908and the receiver910are implemented with the direct-conversion architecture.

In the transmit path, the data processor906processes data to be transmitted and provides I and Q analog output signals to the transmitter908. In the exemplary wireless communications device900, the data processor906includes digital-to-analog converters (DACs)912(1),912(2) for converting digital signals generated by the data processor906into the I and Q analog output signals, e.g., I and Q output currents, for further processing.

Within the transmitter908, lowpass filters914(1),914(2) filter the I and Q analog output signals, respectively, to remove undesired signals caused by the prior digital-to-analog conversion. Amplifiers (AMPs)916(1),916(2) amplify the signals from the lowpass filters914(1),914(2), respectively, and provide I and Q baseband signals. An upconverter918upconverts the I and Q baseband signals with I and Q transmit (TX) local oscillator (LO) signals through mixers920(1),920(2) from a TX LO signal generator922to provide an upconverted signal924. A filter926filters the upconverted signal924to remove undesired signals caused by the frequency upconversion as well as noise in a receive frequency band. A power amplifier (PA)928amplifies the upconverted signal924from the filter926to obtain the desired output power level and provides a transmitted RF signal. The transmitted RF signal is routed through a duplexer or switch930and transmitted via an antenna932.

In the receive path, the antenna932receives signals transmitted by base stations and provides a received RF signal, which is routed through the duplexer or switch930and provided to a low noise amplifier (LNA)934. The duplexer or switch930is designed to operate with a specific receive (RX)-to-TX duplexer frequency separation, such that RX signals are isolated from TX signals. The received RF signal is amplified by the LNA934and filtered by a filter936to obtain a desired RF input signal. Downconversion mixers938(1),938(2) mix the output of the filter936with I and Q RX LO signals (i.e., LO_I and LO_Q) from an RX LO signal generator940to generate I and Q baseband signals. The I and Q baseband signals are amplified by amplifiers (AMPs)942(1),942(2) and further filtered by lowpass filters944(1),944(2.) to obtain I and Q analog input signals, which are provided to the data processor906. In this example, the data processor906includes analog-to-digital converters (ADCs)946(1),946(2) for converting the analog input signals into digital signals to be further processed by the data processor906.

In the wireless communications device900ofFIG. 9, the TX LO signal generator922generates the I and Q TX LO signals used for frequency upconversion, while the RX L( )signal generator940generates the I and Q RX L(i) signals used for frequency downconversion. Each LO signal is a periodic signal with a particular fundamental frequency. A TX phase-locked loop (PLL) circuit948receives timing information from the data processor906and generates a control signal used to adjust the frequency and/or phase of the TX L( )signals from the TX L(I) signal generator922. Similarly, an RX PLL circuit950receives timing information from the data processor906and generates a control signal used to adjust the frequency and/or phase of the RX LO signals from the RX LO signal generator940.