Method and system for extending advanced encryption standard (AES) operations for enhanced security

In a wireless communication system, a method and system for extending Advanced Encryption Standard (AES) operations for enhanced security are provided. In an AES encryption operation, an initial state may be modified by XORing with an initial modifier before a first processing round and a final state may be modified by XORing with a final modifier after a final processing round. The output of a MixColumns function performed during AES decryption operation rounds may be modified by XORing with a corresponding round modifier. In an AES decryption operation, an initial state may be modified by XORing with a decoded final modifier before a first processing round and a final state may be modified by XORing with a decoded initial modifier after a final processing round. The input of an InvMixColumns function performed during AES decryption operation rounds may be modified by XORing with a corresponding decoded round modifier.

This application also makes reference to:

The above stated applications are hereby incorporated herein by reference in their entirety.

FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

Not applicable.

Not applicable.

FIELD OF THE INVENTION

Certain embodiments of the invention relate to cryptography. More specifically, certain embodiments of the invention relate to a method and system for extending Advanced Encryption Standard (AES) operations for enhanced security.

BACKGROUND OF THE INVENTION

In secured data transmission systems or cryptosystems, the use of standardized encryption algorithms provides a common platform from which compatible system components may be developed and/or deployed. Current encryption standards include the Data Encryption Standard (DES) and the Triple DES or 3DES. The National Institute of Standards and Technology (NIST) specified 3DES to provide more secure encryption than that achieved by DES given of the vulnerability of the latter to the use of more powerful computers. The use of 3DES was viewed as a temporary solution and on Nov. 26, 2001, NIST introduced the Advanced Encryption Standard (AES) as Federal Information Processing Standards Publication (FIPS PUB) 197, with the purpose of providing a longer term platform for the development of more secure cryptosystems. The AES specifies a FIPS-approved cryptographic algorithm, based on the Rijndael algorithm, that may be utilized to protect electronic data.

The AES algorithm is a symmetric block cipher that is capable of encrypting plaintext information into ciphertext and also decrypting ciphertext information into plaintext or descrambled information. The AES algorithm may use cryptographic or cipher keys of 128, 192, or 256 bits to encrypt and decrypt blocks of data. The length of the cipher key sequence is referred to as the key length, K. Input and output data blocks in the AES algorithm each consists of sequences of 128 bits. The length of the data blocks is referred to as the block length. In addition, the AES specification provides that the AES algorithm may be implemented in software, firmware, hardware, or any combination thereof. The specification, however, does not provide a specific implementation, instead, the implementation may be based on several factors, for example, the environment, application, and technology being used.

In some instances, the security capabilities provided by the AES encryption/decryption standard may not be sufficient to accommodate the requirements of cryptosystems when utilized under certain conditions and/or certain applications. In these cases, an already taxed digital signal processor (DSP), system processor, or application specific integrated circuit (ASIC) may not be easily, or cost-effectively, adapted to accommodate the demands imposed by the application and/or conditions for which the secured data transmission system is intended.

BRIEF SUMMARY OF THE INVENTION

Certain embodiments of the invention may be found in a method and system for extending Advanced Encryption Standard (AES) operations for enhanced security. Aspects of a method for increasing encryption security may comprise generating an initial state by XORing a plaintext data block with an initial modifier. A first round output state may be generated in a first AES encryption round based on the generated initial state, wherein an output of a MixColumns function performed during the first AES encryption round is XORed with a first round modifier. After generating the first round output state, subsequent round output states may be generated in subsequent AES encryption rounds, wherein an output of the MixColumns function performed during each of the subsequent AES encryption rounds is XORed with a corresponding round modifier. After generating the subsequent round output states, a final round output state may be generated in a final AES encryption round. A ciphertext data block may be generated by XORing the generated final round output state with a final modifier.

The method may also comprise transferring the generated ciphertext data block via a first secure data channel to at least one device for decryption. The initial modifier, the first round modifier, the corresponding round modifier for each of the subsequent AES encryption rounds, and the final modifier may be generated based on a look-up table. In another embodiment, the initial modifier, the first round modifier, the corresponding round modifier for each of the subsequent AES encryption rounds, and the final modifier may be generated by a random number generator or a pseudo-random number generator. In the latter case, a seed value may be transferred through a secure channel to the pseudo-random number generator. In another aspect of the method, the initial modifier, the first round modifier, the corresponding round modifier for each of the subsequent AES encryption rounds, and the final modifier may be encoded and may be transferred via a second secure data channel to at least one device for decoding.

A non-transitory machine readable storage medium may be provided having stored thereon, a computer program having at least one code for increasing encryption security in cryptography operations, the at least one code section being executable by a machine for causing the machine to perform steps in the method described above.

Aspects of a method for increasing decryption security may comprise generating an initial state by XORing a ciphertext data block received via a first secure data channel with a final modifier. A first round output state may be generated in a first AES decryption round based on the generated initial state. After generating the first round output state, subsequent round output states may be generated in subsequent AES decryption rounds, wherein an input to an InvMixColumns function performed during each of the subsequent AES decryption rounds is XORed with a corresponding round modifier. A descrambled data block may be generated by XORing a last of the generated subsequent round output states with an initial modifier.

The method may also comprise transferring the generated descrambled data block via a data channel to at least one device for further processing. The initial modifier, the corresponding round modifier for each of the subsequent AES decryption rounds, and the final modifier may be generated based on a look-up table. In another embodiment, the initial modifier, the corresponding round modifier for each of the subsequent AES decryption rounds, and the final modifier may be generated by a random number generator or a pseudo-random number generator. In the latter case, a seed value received via a second secure data channel may be decoded to be utilized in the pseudo-random number generator. In another aspect of the method, an encoded initial modifier, an encoded corresponding round modifier for each of the subsequent AES encryption rounds, and an encoded final modifier may be received via the second secure data channel and may be decoded into the initial modifier, the corresponding round modifier for each of the subsequent AES decryption rounds, and the final modifier respectively.

A machine-readable storage may be provided having stored thereon, a computer program having at least one code for increasing decryption security in cryptography operations, the at least one code section being executable by a machine for causing the machine to perform steps for the method described above.

Aspects of a system for increasing encryption security may comprise circuitry for generating an initial state by XORing a plaintext data block with an initial modifier. Circuitry may be provided for generating a first round output state in a first AES encryption round based on the generated initial state, wherein an output of a MixColumns function performed during the first AES encryption round is XORed with a first round modifier. Circuitry may be provided for generating subsequent round output states in subsequent AES encryption rounds, after generating the first round output state, wherein an output of the MixColumns function performed during each of the subsequent AES encryption rounds is XORed with a corresponding round modifier. The system may also comprise circuitry for generating a final round output state in a final AES encryption round after generating the subsequent round output states. Circuitry for generating a ciphertext data block by XORing said generated final round output state with a final modifier may also be provided.

The system may also comprise circuitry for transferring the generated ciphertext data block via a first secure data channel to at least one device for decryption. Circuitry may be provided for generating the initial modifier, the first round modifier, the corresponding round modifier for each of the subsequent AES encryption rounds, and the final modifier based on a look-up table. In another embodiment, circuitry may be provided for generating the initial modifier, the first round modifier, the corresponding round modifier for each of the subsequent AES encryption rounds, and the final modifier by a random number generator or a pseudo-random number generator. In the latter case, circuitry may be provided for receiving a seed value via a secure parameter channel by the pseudo-random number generator. In another aspect of the system, circuitry may be provided for encoding the initial modifier, the first round modifier, the corresponding round modifier for each of the subsequent AES encryption rounds, and the final modifier. Circuitry may be provided for transferring the encoded initial modifier, the encoded first round modifier, the encoded corresponding round modifier for each of the subsequent AES encryption rounds, and the encoded final modifier via a second secure data channel to at least one device for decoding.

Aspects of a system for increasing decryption security may comprise circuitry for generating an initial state by XORing a ciphertext data block received via a first secure data channel with a final modifier. Circuitry may be provided for generating a first round output state in a first AES decryption round based on the generated initial state. Circuitry may be provided for generating subsequent round output states in subsequent AES decryption rounds, after generating the first round output state, wherein an input to an InvMixColumns function performed during each of the subsequent AES decryption rounds is XORed with a corresponding round modifier. Circuitry is also provided for generating a descrambled data block by XORing a last of the generated subsequent round output states with an initial modifier.

The system may also comprise circuitry for transferring the generated descrambled data block via a data channel to at least one device for further processing. Circuitry may be provided for generating the initial modifier, the corresponding round modifier for each of said subsequent AES decryption rounds, and the final modifier based on a look-up table. In another embodiment, circuitry may be provided for generating the initial modifier, the corresponding round modifier for each of the subsequent AES decryption rounds, and the final modifier by a random number generator or a pseudo-random number generator. In the latter case, circuitry may be provided for decoding a seed value received via a second secure data channel to be utilized in the pseudo-random number generator. In another aspect of the system, circuitry may be provided for receiving an encoded initial modifier, an encoded corresponding round modifier for each of the subsequent AES encryption rounds, and an encoded final modifier via a second secure data channel and for decoding them into the initial modifier, the corresponding round modifier for each of the subsequent AES decryption rounds, and the final modifier respectively.

DETAILED DESCRIPTION OF THE INVENTION

Certain embodiments of the invention may be found in a method and system for extending Advanced Encryption Standard (AES) operations for enhanced security. An integrated circuit (IC) solution for the AES algorithm may provide a built-in capability that allows for enhanced security while maintaining compatibility with the encryption and decryption operations specified by the AES standard. This approach may result in low-cost application specific IC encryption/decryption systems that are capable of providing sufficient computational resources to execute the operations of the AES algorithm while also supporting the use of additional security measures. Note that the following discussion may generally utilize the terms “encoding,” “encrypting,” and “ciphering” interchangeably. The terms “decoding,” “decrypting,” and “deciphering” may also be utilized interchangeably. Accordingly, the scope of various aspects of the present invention should not be limited by notions of difference between the terms “encoding,” “encrypting,” and “ciphering” or between the terms “decoding,” “decrypting,” and “deciphering.”

FIG. 1Aillustrates an exemplary AES cipher, in connection with an embodiment of the invention. Referring toFIG. 1A, the AES cipher100may comprise suitable logic, circuitry, and/or code that may be adapted to perform the encryption operations of the AES algorithm on plaintext data blocks to generate ciphertext data blocks that may be transferred through a data channel to at least one device for decoding. Because the AES algorithm is an iterative symmetric block cipher, the AES cipher100may operate by repeating the same defined steps multiple times on a fixed number of bytes while utilizing a secret key encryption process. The AES cipher100may utilize cryptographic or cipher keys of 128, 192, or 256 bits to encrypt 128 bits data blocks of plaintext. The cipher keys may be received through a secure key channel.

The AES cipher100may perform the encryption operations of the AES algorithm on a two-dimensional array of bytes called a state or state array. The state may consist of four rows of bytes, each containing Nb bytes, where Nb is the block length divided by 32. Each individual byte in the state array has two indices, with its row number, r, in the range 0≦r<4 and its column number, c, in the range 0≦c<Nb. An individual byte in the state array may be referred to as either sr,cor s[r,c]. For a block length of 128 bits, then Nb=4 and 0≦c<4.

At the start of the encryption operations of the AES algorithm in the AES cipher100, a data block comprising 128 bits or 16 bytes of plaintext information may be copied or mapped into an initial state according to the scheme: s[r,c]=in[r+4c], where 0≦r<4 and 0≦c<Nb. At the end of the encryption operations in the AES cipher100, the final value of the state may be copied or mapped to a 128-bit ciphertext output data block by the scheme: out[r+4c]=s[r, 4c], where 0≦r<4 and 0≦c<Nb.

The number of iterative steps or rounds, Nr, to be performed during the execution of the AES algorithm in the AES cipher100may depend on the key length, K, where the key length may be represented by the number of 32-bit words in the cipher key, Nk. For example, cipher keys of 128, 192, or 256 bits may be represented by Nk=4, 6, or 8 respectively. The following table represents the Key-Block-Round combinations that may be supported in the encryption operations of the AES algorithm in the AES cipher100:

The AES algorithm encryption operations are described below as pseudo code:

AES_Encrypt(byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)]){byte state[4,Nb]state = inAddRoundKey(state, w[0, Nb−1])for round = 1 step 1 to Nr−1{SubBytes(state)ShiftRows(state)MixColumns(state)AddRoundKey(state, w[round*Nb, (round+1)*Nb−1])} (end for)SubBytes(state)ShiftRows(state)AddRoundKey(state, w[Nr*Nb, (Nr+1)*Nb−1])out = state}
where “in” corresponds to the 128-bit plaintext data block, “out” corresponds to the 128-bit ciphertext data block, “state” corresponds to the 16-byte state array, “w” is a schedule of cipher key values for the various AES encryption rounds, and AddRoundKey, SubBytes, ShiftRows, and MixColumns are byte-oriented encryption functions that may be performed to transform the state or state array during the various AES encryption rounds.

The AddRoundKey function may comprise suitable logic, circuitry, and/or code that may be adapted to add a Round Key to the state by a simple bitwise XOR operation. Each Round Key may consist of Nb words and may be generated through a Key Expansion function that generates a schedule of cipher key values. For example, the AES-128 16-byte cipher key, K, is expanded into a schedule of 11 individual 16-byte Round Keys, w(*), for a total of 176 bytes, where 10 of the 16-byte Round Keys, w(*), correspond to the 10 AES encryption rounds for AES-128 and an additional 16-byte Round Key corresponds to an initial AddRoundKey function performed before the 10 AES encryption rounds, for example, when a round counter value is 0.

The SubBytes function may comprise suitable logic, circuitry, and/or code that may be adapted to perform a non-linear byte substitution that operates independently on each byte of the state by utilizing a substitution table or S-box. For example, a byte s[r,c]={53} may be substituted by a byte s′[r,c] in a substitution table by utilizing the hexadecimal value “5” as a row index and the hexadecimal value “3” as a column index. The ShiftRows function may comprise suitable logic, circuitry, and/or code that may be adapted to cyclically shift the bytes in the last three rows of the state over by different numbers of bytes or offsets. For example, a left most byte, corresponding to the lowest column value, in a second row of the state may be shifted to the highest column position or right most position while the remaining bytes are shifted left by one position. For the third and fourth rows of the state, similar two and three byte shifts may be performed respectively.

The MixColumns function may comprise suitable logic, circuitry, and/or code that may be adapted to determine a state or state array value by left-multiplying the current state by a polynomial matrix. The MixColumns function operates on the state column-by-column, treating each column as a four-term polynomial. According to the standard specification of the AES algorithm, the MixColumns function is not performed during the last AES encryption round, for example, when a round counter value is Nr.

FIG. 1Billustrates an exemplary extended AES cipher that provides additional security measures from those specified for the AES encryption process, in accordance with an embodiment of the invention. Referring toFIG. 1B, an extended AES cipher120may comprise suitable logic, circuitry, and/or code that may be adapted to perform the encryption operations provided by the AES algorithm specification and/or expanded security measures that may be compatible with the encryption operations provided by the AES algorithm specification. In this regard, the extended AES cipher120may also encrypt plaintext data blocks to generate ciphertext data blocks that may be transferred through a data channel to at least one device for decoding.

The encryption process in the extended AES cipher120may be based on cipher keys of 128, 192, or 256 bits received through a secure channel and/or on a plurality of extension parameters provided through a separate secure channel, for example, a 3DES-based channel or an RSA-based channel, where RSA is a public key encryption algorithm invented by Ron Rivest, Adi Shamir, and Leonard Adleman. In some instances, the cipher keys and the extension parameters may be provided to the extended AES cipher120through a single secure channel. The extension parameters and/or additional parameters generated from the extension parameters may be encoded by the extended AES cipher120and may be transferred for decoding to, for example, the same devices to which the ciphertext data blocks were transferred.

An exemplary pseudo code description of extended security measures for the AES encryption process are described below:

Ext_AES_Encrypt(byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)]){byte state[4,Nb]state = in XOR C(0)AddRoundKey(state, w[0, Nb−1])for round = 1 step 1 to Nr−1{SubBytes(state)ShiftRows(state)MixColumns(state)state = state XOR C(round)AddRoundKey(state, w[round*Nb, (round+1)*Nb−1])} (end for)SubBytes(state)ShiftRows(state)AddRoundKey(state, w[Nr*Nb, (Nr+1)*Nb−1])out = state XOR C(Nr)}
where “in,” “out,” “state,” “w,” and the functions AddRoundKey, SubBytes, ShiftRows, and MixColumns are the same as for the conventional AES encryption process in the AES cipher100, and where C(0), C(Round), and C(Nr), correspond to user-defined modifying parameters or modifying vectors to be utilized in the extended AES encryption operations. The Key Expansion function that generates a schedule of cipher key values may also be similar to that used in the conventional AES encryption process. The XOR function described in the pseudo code above refers to a bitwise XOR operation between a current state value and a modifying parameter or vector. The initial modifying parameter or initial modifier, C(0), may be utilized by the extended AES cipher120to determine the initial state value before the AES encryption rounds, for example, when a round counter value is 0. The modifying parameters or modifiers, C(Round), may be utilized in the first and subsequent encryption rounds, until and including the Nr−1 round, to determine the state or state array value after the MixColumns operation is performed. The final modifying parameter or final modifier, C(Nr), may be utilized by the extended AES cipher120to determine the final state or state array value in a final round or when a round counter value is Nr. The final state determined by the final modifier may then be mapped or copied to the ciphertext data block for transmission in a data channel. The use of modifying parameters may provide an additional security measure that is compatible with the conventional AES encryption process.

In a special case of the extended AES encryption process, when C(0)=K1, C(Nr)=K2, the AES cipher key=K, and C(round)=0, for round=1, 2, . . . , Nr−1, the extended encryption process reduces to:
Ext_AES_EncryptK,K1,K2(data)=K2⊕AESK(K1⊕data).
In this case, the operation of the extended AES cipher120corresponds to that of the AES cipher100inFIG. 1Bwhere the plaintext has been masked by K1and the ciphertext has been masked by K2.

FIG. 2is a block diagram of an exemplary system for performing extended AES encryption operations, in accordance with an embodiment of the invention. Referring toFIG. 2, the extended AES cipher120may comprise an extended cipher102, a C(X) generator and encoder204, and a first substitution box (S-box—1)206. U.S. patent application Ser. No. 10/932,832 filed Sep. 2, 2004, discloses a detailed hardware accelerator for AES encryption and decryption, and is hereby incorporated herein by reference in its entirety. The extended cipher102may comprise suitable logic, circuitry, and/or code that may be adapted to perform the state modification or masking steps described above and the functions AddRoundKey, SubBytes, ShiftRows, MixColumns, and Key Expansion. The extended cipher102may also provide a round counter that indicates the current round in the AES encryption process. For example, the round counter value may be 0 before the first AES encryption round and may be Nr during and/or after the last round of AES encryption processing, where Nr=10, 12, or 14 for AES-128, AES-192, or AES-256 respectively. The round counter may be reset to a value of 0 at the start of the encoding process for a new plaintext data block, for example.

The C(X) generator and encoder204may comprise suitable logic, circuitry, and/or code that may be adapted to receive a plurality of extension parameters from a secure channel and to utilize the extension parameters to generate a plurality of modifying parameters, C(X), where X refers to the corresponding round in the extended AES encryption process. The secure channel from which the extension parameters may be received are, for example, 3DES-based channels or RSA-based channels. In one embodiment of the invention, the C(X) generator and encoder204may comprise a memory or look-up table which may be populated by information received from the extension parameters. The information in the memory or look-up table may then be utilized to generate the modifying parameters, C(X), in the extended AES encryption process. In another embodiment of the invention, the C(X) generator and encoder204may comprise a random number generator or a pseudo-random number generator which may be utilized to generate the modifying parameters. In the latter case, the extended AES cipher120may receive a seed value as an extension parameter that me be utilized by the pseudo-random number generator to generate the modifying parameters, C(X).

The C(X) generator and encoder204may also comprise suitable logic, circuitry, and/or code that may be adapted to encode the extension parameters and/or the modifying parameters for transfer to at least one device for decoding through a secure parameter channel, where the decoding devices may be the same devices to which the ciphertext data blocks may be transferred. The secure parameter channel may also be a 3DES-based channel or a RSA-based channel, for example. Moreover, when the operation of the C(X) generator and encoder204is based on a pseudo-random number generator, the seed value received may also be encoded and transferred to the decoding devices through the secure parameter channel.

The S-box_1206may comprise suitable logic, circuitry, and/or code that may be adapted to provide a byte-wise non-linear substitution as required by the SubBytes function. The information contained in the S-box_1206may be updated through the extension parameters provided to the extended AES cipher120. In this regard, any update to the look-up table substitution operation provided by the S-box_1206may require an update to a corresponding look-up table substitution operation in the decoding devices. This update may be carried out by transferring the necessary information to the C(X) generator and encoder204and having the C(X) generator and encoder204encode and transfer the information through the secure parameter channel to the decoding devices. U.S. patent application Ser. No. 10/933,702 filed Sep. 2, 2004, discloses a detailed description of an S-box, and is hereby incorporated herein by reference in its entirety.

FIG. 3is a flow diagram that illustrates exemplary steps for performing extended AES encryption operations, in accordance with an embodiment of the invention. Referring toFIG. 3, in step302of a flow diagram300, the modifying parameters, C(X), may be generated and encoded by the C(X) generator and encoder204inFIG. 2. In this regard, the modifying parameters necessary for encryption may be generated prior to the extended AES encryption process or may be generated as required during the extended AES encryption process. In step304, a round counter value may be set to 0 to indicate when a plaintext data block is received as an input data block for encryption. In step306, the Key Expansion function may be performed on the AES cipher key, K, to generate the key schedule of Round Keys to be used during the extended AES encryption process. In this regard, the Round Keys necessary for encryption may be generated prior to the extended AES encryption process or may be generated as required during the extended AES encryption process. In step308, the initial state of the extended AES encryption process may be generated by XORing the initial modifier, C(0), with the plaintext data block. In step310, the AddRoundKey function may be performed on the initial state by utilizing a corresponding Round Key from the key schedule.

In step312, the extended AES cipher120may determine whether a current round is a last round of AES encryption. When the current round is not the last round of AES encryption, the flow diagram300may proceed to step314where the round counter value may be increased by one. Because the round counter value was currently set to 0, the current round counter value is now set to one, indicating that the current round is a first AES encryption round. In step316, the SubBytes function may be performed on the state or state array by utilizing the substitution information in the S-box_1206during the first AES encryption round.

In step318, the ShiftRows function may be performed on the state or state array. In step320, extended AES cipher120may determine whether the current round is the last AES encryption round. When the current round is not the last AES encryption round, the flow diagram300may proceed to step322where the MixColumns function may be performed on the state or state array. In step324, the output of the MixColumns function may be XORed with a modifying parameter, C(Round), where X=Round indicates the current AES encryption round. Because the current round value is one, the current modifying parameter, C(1), may refer to a first round modifier. The flow diagram300may then return to step310where the AddRoundKey function may be performed on the modified output of the MixColumns function to generate a first round output state.

Steps312,314,316,320,322, and324may be performed for AES encryption rounds that are subsequent to the first AES encryption round, where the subsequent AES encryption rounds include up to the penultimate round or Nr−1 AES encryption round. For each of these subsequent AES encryption rounds, the output of the MixColumns function may be XORed with a corresponding round modifier. Moreover, each of these subsequent AES encryption rounds may generate a corresponding subsequent round output state that may be used as the input state for the next AES encryption round. Returning to step312, when the current round is a last of the subsequent rounds or the penultimate round Nr−1, the flow diagram300may proceed to perform steps314,316,318, and320. In step320, because the current round is now the last of the AES encryption rounds after the counter value change in step314, the flow diagram300may go to step310and perform the AddRoundKey function to generate a final round output state. Returning to step312, the current round is the last AES encryption round and the flow diagram may proceed to step326where the final output state may be XORed with a final modifier to generate the ciphertext data block.

FIG. 4Aillustrates an exemplary AES decipher, in connection with an embodiment of the invention. Referring toFIG. 4A, the AES decipher400may comprise suitable logic, circuitry, and/or code that may be adapted to perform the decryption operations of the AES algorithm on cipher text data blocks to generate descrambled data blocks that may be transferred through a data channel to at least one device for further processing. Since the AES algorithm is an iterative symmetric block cipher, the AES decipher400may operate by repeating the same defined steps multiple times on a fixed number of bytes while utilizing a secret key encryption process. The AES decipher400may utilize cryptographic or cipher keys of 128, 192, or 256 bits to encrypt 128 bits data blocks of plaintext. The cipher keys may be received through a secure key channel.

The AES decipher400may perform the decryption operations of the AES algorithm on a two-dimensional array of bytes called a state or state array. The state may consist of four rows of bytes, each containing Nb bytes, where Nb is the block length divided by 32. Each individual byte in the state array has two indices, with its row number, r, in the range 0≦r<4 and its column number, c, in the range 0≦c<Nb. An individual byte in the state array may be referred to as either sr,cor s[r,c]. For a block length of 128 bits, then Nb=4 and 0≦c<4.

At the start of the decryption operations of the AES algorithm in the AES decipher400, a data block comprising 128 bits or 16 bytes of ciphertext information may be copied or mapped into an initial state according to the scheme: s[r,c]=in[r+4c], where 0≦r<4 and 0≦c<Nb. At the end of the decryption operations in the AES decipher400, the final value of the state may be copied or mapped to a 128-bit descrambled output data block by the scheme: out[r+4c]=s[r, 4c], where 0≦r<4 and 0≦c<Nb.

The number of iterative steps or rounds, Nr, to be performed during the execution of the AES algorithm in the AES decipher400may depend on the key length, K, where the key length may be represented by the number of 32-bit words in the cipher key, Nk. For example, cipher keys of 128, 192, or 256 bits may be represented by Nk=4, 6, or 8 respectively.

The AES algorithm decryption operations are described below as pseudo code:

AES_Decrypt(byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)]){byte state[4,Nb]state = inAddRoundKey(state, w[Nr*Nb, (Nr+1)*Nb−1])for round = Nr−1 step −1 downto 1{InvShiftRows(state)InvSubBytes(state)AddRoundKey(state, w[round*Nb, (round+1)*Nb−1])InvMixColumns(state)} (end for)InvShiftRows(state)InvSubBytes(state)AddRoundKey(state, w[0, Nb−1])out = state}
where “in” corresponds to the 128-bit ciphertext data block, “out” corresponds to the 128-bit descrambled data block, “state” corresponds to the 16-byte state array, “w” is a schedule of cipher key values for the various AES decryption rounds, and AddRoundKey, InvSubBytes, InvShiftRows, and InvMixColumns are byte-oriented decryption functions that may be performed to transform the state or state array during the various AES decryption rounds. The decryption or deciphering functions are the inverse of their corresponding encryption or ciphering functions and may be implemented in the reverse order to produce the decryption process in the AES algorithm.

The AddRoundKey function may comprise suitable logic, circuitry, and/or code that may be adapted to add a Round Key to the state by a simple bitwise XOR operation. The AddRoundKey is its own inverse and it is operationally and functionally similar to the AddRoundKey described for the AES algorithm encryption operations in the AES cipher100inFIG. 1A.

The InvSubBytes function may comprise suitable logic, circuitry, and/or code that may be adapted to perform a non-linear byte substitution that operates independently on each byte of the state by utilizing a substitution table or S-box. The non-linear byte substitution is the inverse of the non-linear byte substitution performed by the SubBytes function previously described. The InvShiftRows function may comprise suitable logic, circuitry, and/or code that may be adapted to cyclically shift the bytes in the last three rows of the state over by different numbers of bytes or offsets. The cyclical byte shift performed in the InvShiftRows function is the inverse of the cyclical byte shift performed by the ShiftRows function previously described. The InvMixColumns function may comprise suitable logic, circuitry, and/or code that may be adapted to perform the inverse of the column-based multiplication operations performed by the MixColumns function as previously described. According to the standard specification of the AES algorithm, the InvMixColumns function is not performed during a first AES decryption round. The first AES decryption round may correspond to the inverse operation of the last AES encryption round.

FIG. 4Billustrates an exemplary extended AES decipher that provides additional security measures from those specified for the AES decryption process, in accordance with an embodiment of the invention. Referring toFIG. 4B, an extended AES decipher420may comprise suitable logic, circuitry, and/or code that may be adapted to perform the decryption operations provided by the AES algorithm specification and/or expanded security measures that may be compatible with the decryption operations provided by the AES algorithm specification. In this regard, the extended AES decipher420may also decrypt ciphertext data blocks to generate scrambled data blocks that may be transferred through a data channel to at least one device for further processing.

The decryption process in the extended AES decipher420may be based on cipher keys of 128, 192, or 256 bits received through a secure channel and/or on a plurality of encoded parameters provided through a separate secure channel, for example, a 3DES-based channel or an RSA-based channel. The encoded parameters may comprise the encoded modifying parameters and/or additional parameters such as a seed value, for example. In some instances, the cipher keys and the encoded parameters may be provided to the extended AES decipher420through a single secure channel.

An exemplary pseudo code description of extended security measures for the AES decryption process is described below:

Ext_AES_Decrypt (byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)]){byte state[4,Nb]state = in XOR C(Nr)AddRoundKey(state, w[Nr*Nb, (Nr+1)*Nb−1])for round = Nr−1 step −1 downto 1{InvShiftRows(state)InvSubBytes(state)AddRoundKey(state, w[round*Nb, (round+1)*Nb−1])State = state XOR C(round)InvMixColumns(state)} (end for)InvShiftRows(state)InvSubBytes(state)AddRoundKey(state, w[0, Nb−1])out = state XOR C(0)}
where “in,” “out,” “state,” “w,” and the functions AddRoundKey, InvSubBytes, InvShiftRows, and InvMixColumns are the same as for the conventional AES decryption process in the AES decipher400, and where C(0), C(Round), and C(Nr), correspond to decoded versions of the encoded modifying parameters to be utilized in the extended AES decryption operations. The Key Expansion function that generates a schedule of cipher key values may also be similar to that used in the conventional AES decryption process. The XOR function described in the pseudo code above refers to a bitwise XOR operation between a current state value and a modifying parameter or vector. The initial modifying parameter or initial modifier, C(0), may be utilized by the extended AES decipher120to determine the initial state value before the AES decryption rounds, for example, when a round counter value is Nr. The modifying parameters or modifiers, C(Round), may be utilized in the first and subsequent decryption rounds, until and including when the round counter value counts down to 1, to determine the state or state array value before the InvMixColumns operation is performed. The final modifying parameter or final modifier, C(Nr), may be utilized by the extended AES decipher420to determine the final state or state array value in a final round or when a round counter value is 0. The final state determined by the final modifier may then be mapped or copied to the descrambled data block for transmission in a data channel. The use of modifying parameters may provide an additional security measure that is compatible with the conventional AES decryption process.

FIG. 5is a block diagram of an exemplary system for performing extended AES decryption operations, in accordance with an embodiment of the invention. Referring toFIG. 5, the extended AES decipher420may comprise an extended decipher502, a C(X) extractor and synchronizer504, and a second substitution box (S-box_2)506. The extended decipher502may comprise suitable logic, circuitry, and/or code that may be adapted to perform the state modification or masking steps described above and the functions AddRoundKey, InvSubBytes, InvShiftRows, InvMixColumns, and Key Expansion. The extended decipher502may also provide a round counter that indicates the current round in the AES decryption process. For example, the round counter value may be Nr before the first AES decryption round and may be 0 during and/or after the last round of AES decryption processing, where Nr=10, 12, or 14 for AES-128, AES-192, or AES-256 respectively. The round counter may be reset to a value of Nr at the start of the decoding process for a new ciphertext data block, for example.

The C(X) extractor and synchronizer504may comprise suitable logic, circuitry, and/or code that may be adapted to receive a plurality of encoded parameters from a secure channel, to decode the encoded parameters and/or extract information from the encoded parameters, and to synchronize the decoded parameters and/or extracted information with the ciphertext data blocks received by the extended decipher502, where X refers to the corresponding round in the extended AES decryption process. The secure channel from which the encoded parameters may be received are, for example, 3DES-based channels or RSA-based channels. In one embodiment of the invention, the C(X) extractor and synchronizer504may comprise a memory or look-up table which may be populated by information extracted and/or decoded from the encoded parameters. The information in the memory or look-up table may then be utilized to generate the modifying parameters, C(X), in the extended AES decryption process. In another embodiment of the invention, the C(X) extractor and synchronizer504may comprise a random number generator or a pseudo-random number generator which may be utilized to generate the modifying parameters. In the latter case, the extended AES decipher420may receive an encoded seed value as an encoded parameter and may decode the seed value before being utilized by the pseudo-random number generator to generate the modifying parameters, C(X).

The S-box_2506may comprise suitable logic, circuitry, and/or code that may be adapted to provide a byte-wise non-linear substitution as required by the InvSubBytes function. The information contained in the S-box_2506may be updated through the encoded parameters provided to the extended AES decipher420. In this regard, any update to the look-up table substitution operation provided by the S-box_2506may require an update to a corresponding look-up table operation in an encoding device.

FIG. 6is a flow diagram that illustrates exemplary steps for performing extended AES decryption operations, in accordance with an embodiment of the invention. Referring toFIG. 6, in step602of a flow diagram600, the modifying parameters, C(X), may be decoded and/or extracted by the C(X) extractor and synchronizer504inFIG. 5. In this regard, the modifying parameters necessary for decryption may be generated from the encoded parameters prior to the extended AES decryption process or may be generated as required during the extended AES decryption process. In step604, a round counter value may be set to Nr to indicate when a ciphertext data block is received as an input data block for decryption. In step606, the Key Expansion function may be performed on the AES cipher key, K, to generate the key schedule of Round Keys to be used during the extended AES decryption process. In this regard, the Round Keys necessary for decryption may be generated prior to the extended AES decryption process or may be generated as required during the extended AES decryption process. In step608, the initial state of the extended AES decryption process may be generated by XORing the final modifier, C(Nr), with the ciphertext data block. In step610, the AddRoundKey function may be performed on the initial state by utilizing a corresponding Round Key from the key schedule.

In step612, the extended AES decipher420may determine whether a current round is a last round of AES decryption, where the last round of AES decryption corresponds to a round counter value of 0, for example. When the current round is not the last round of AES decryption, the flow diagram600may proceed to step614where the extended AES decipher420may determine whether the current round is a first round of AES decryption processing. The first AES decryption round may correspond to a round counter value of Nr. Because the round counter value was currently set to Nr, the current round is the first AES encryption round and the flow diagram600may proceed to step616.

In step616, the InvShiftRows function may be performed on the state or state array output of the AddRoundKey function during the first AES decryption round. In step618, the InvSubBytes function may be performed on the state or state array by utilizing the substitution information in the S-box_2506. The output state from the InvSubBytes function in step618may correspond to a first round output state in a first AES decryption round. Following step618, in step620, the round counter value may be decreased by one to a value of Nr−1, where Nr−1 may correspond to a round counter value for a second AES decryption round.

The second AES decryption round may comprise steps610,612, and614. In step614, the round counter value is no longer Nr and the flow diagram600may proceed to steps622and624before performing step616during the second AES decryption round. In step622, the output state from the AddRoundKey may be XORed with a modifying parameter, C(Round), where X=Round indicates the current AES decryption round. In step624, the InvMixColumns function may be performed on the modified state generated in step622. All AES decryption rounds subsequent to the first AES decryption round, including the AES decryption round that corresponds to a round counter value of 1, may perform steps622and624. In this regard, the subsequent AES encryption rounds may generate subsequent round output states based on the corresponding round modifiers that may be utilized in step622.

Returning to step612, when the current round counter value has reached 0, the AES decipher420may generate a descrambled data block by XORing a last of the subsequent round output states with the initial modifier, C(0). The descrambled data block may then be transferred to other processing devices for further processing.

The approach described above may result in a low-cost integrated circuit (IC) solution for implementing the AES algorithm that provides a built-in capability for enhanced security while maintaining compatibility with the encryption and decryption operations specified by the AES standard. This approach may be capable of providing sufficient computational resources to execute the operations of the AES algorithm while also supporting the use of additional security measures.