Source: https://patents.google.com/patent/WO2005043396A2/en
Timestamp: 2018-09-23 22:52:38
Document Index: 460279055

Matched Legal Cases: ['art 30', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art 16', 'art\n18', 'art\n32']

WO2005043396A2 - Word-individual key generation - Google Patents
Word-individual key generation Download PDF
WO2005043396A2
WO2005043396A2 PCT/EP2004/009054 EP2004009054W WO2005043396A2 WO 2005043396 A2 WO2005043396 A2 WO 2005043396A2 EP 2004009054 W EP2004009054 W EP 2004009054W WO 2005043396 A2 WO2005043396 A2 WO 2005043396A2
PCT/EP2004/009054
WO2005043396A3 (en )
Individual word key generation
The present invention relates to the protection of memory contents by encryption in general and in particular to the generation unit individual key for accessing the addressable units of a memory.
To protect against unauthorized snooping of information stored in various applications, the memory contents of the memory are encrypted. In the field of cashless payment transactions such as stored amounts of money are stored encrypted, to protect them against unauthorized snooping or tampering, such as unauthorized amount changes on smart cards.
To the encrypted information stored in a memory, that is the plaintext, an unauthorized person enters, for example, by statistical analysis of the data stored on the memory cipher. This statistical analysis, for example, include an analysis of certain Auftretenswahrschein- friendliness ciphertext data blocks or the like. To complicate 'this statistical analysis, it is desirable that the same plain texts, which are located in encrypted form to different storage positions of the memory, there vorlie- not in the form of identical ciphertexts gene.
One way to ensure the encryption of plain text at different storage positions in the different cipher texts is the scrambling system seiung the so-called cipher block chaining method to use, ie the operation of a block cipher in CBC mode, as for example in the Handbook of Applied Cryptoworks tography, CRC Press, NY, 1997, pp 230, is described. In the CBC mode always the cipher of the previous plaintext block of data is used for encryption of a plaintext block of data, such as the plain text data block with lower by 1 or higher by 1 address in the memory. The CBC mode has the disadvantage that a single isolated data in the memory can only be decrypted when the entire chain of sequential data is decrypted. Consequently, no direct access to data within the CBC chain is made possible. again going through the cipher chain costs precious computing time and consumes an unnecessary amount of electricity, which is especially smart cards disadvantage that are used in battery-powered devices such as cell phones, or smart cards, where customers of the chip card issuers shortest possible transaction times require at the terminals.
ensure another way that like plain texts, which are located at different storage positions are encrypted into different cipher texts is to generate address-dependent key to encrypt the plaintext. The use of address-dependent key makes use of the fact that a to be stored to be encrypted date cherplatz a fixed storage and hence is assigned a dedicated address, and that the encrypted data stored is accurately stored on this dedicated address and remains, until it is read again based on this address. From an existing secret master key and the Adressin- formation for a storage position and an individually addressable unit can now an individual keys are generated, which can be then encrypted with the date in question in a write operation and decrypted in a read operation. The address-dependent generation has the disadvantage that the cost of key generation is approximately as large as the cost of encryption and decryption yourself, as must be done for each adressierba- ren space or for each addressable memory word a key generation which ensures that the mapping of address associated address-dependent keys for an unauthorized person is impene- possible cautiously. ty key generation on Speicherwortgranulari- thus also contemplates a high degree of performance reduction with it, which can reduce the customer convenience in, for example, smart cards.
A way to counter calibrate the security deficit by omitting the address dependency in the encryption of stored memory contents, would be to increase the block sizes for encryption, since this increases the number of possible plaintexts a cipher. However, an increased effort on the part of encryption associated with it lungs- and decryption hardware, which makes this option for mass-produced goods such as smart cards intolerable.
The object of the present invention is to provide a method and an apparatus for generating individual keys that allow access to a memory on the basis of the individual key, thereby reducing the total cost for access.
This object is achieved by an apparatus according to claim 1 and a method according to claim. 13
The finding of the present invention is that the existing systems in many grouping of individually addressable units of memory to
Groups or sites may be used to reduce the complexity of the address-dependent key generation with only slight reduction in the safety significantly, if at first a page pre is calculated based on a page address and then on the basis of
Seitenvorschlüssels and the word address only the individual keys is determined. Thereby, the address-dependent key generation in a cryptographically demanding relatively expensive process, but must be carried out only rarely, namely the Seitenvorschlüsselberechnung, and in a quick, almost expense-free step that must be performed for each word or each individually addressable unit, namely the determining the individual key are based on the Seitenvorschlüssels and the word address is split. can thus be chosen to process the Seitenvorschlüsselberechnungs- that the operation in the implementation of less chip area and / or more processing runtime times greater than the implementation of the determination of the individual key. In this way, the access time can be reduced to the memory as the page address so th for all individually addressable Einhei- belonging to a page that is the same and therefore need not always be calculated again. Rather, the page address can be cached to stand for those of the subsequent accesses to the memory available which relate to addressable units in the corresponding memory page. Storage can for example take place in a displacement memory in which a certain displacement mechanism is used in the same example to provide the page pre for those pages temporarily stored on or their complimentary units most likely be accessed again soon. This memory may be when present, integrated with a cache or data cache or combined, who is in a similar manner to as to provide actual data for fast access, without requiring access to a slower background memory is necessary ,
Preferred embodiments of the present invention are explained below with reference voltages to the accompanying drawings in detail. In the drawings: Figure 1 is a block diagram of a memory system in which a key generation according to the invention can be used, according to an embodiment of the present invention.
FIG. 2a is a schematic block diagram for illustrating the structure and operation of the key generation device in the memory system of Figure 1 according to an embodiment of the present invention.
Figure 2b is a schematic representation of the structure of a page of words according to an embodiment of the present invention.
FIG. 3 is a schematic block diagram for illustrating the structure and operation of the key advantages calculating means in FIG. 2 according to an embodiment of the present invention;
Figure 4 is a schematic drawing illustrating the structure and operation of the means for determining the individual key from the Seitenvorschlüsseln and the word address of Figure 2 in accordance with an embodiment of the present invention..;
Fig. 5 is a schematic drawing illustrating the structure and operation of the investigative apparatus of FIG 2 according to another embodiment of the present invention.
Fig. 6 is a schematic drawing illustrating the structure and operation of the investigative apparatus of FIG 2 according to another embodiment of the present invention. Figure 7 is a schematic drawing illustrating the structure and operation of the discovery ¬ device of Figure 2 according to another embodiment of the present invention..;
Fig. 8 is a block diagram of a relevant portion for the decryption of an encryption / Entschlüsselungsein- direction as in Fig 1 according to an embodiment of the present invention.
9 is a block diagram of a relevant part for the encryption of an encryption / Entschlüsselungsvor- direction as in Fig 1 according to an embodiment of the present invention..; and
Fig. 10 is a block diagram of a device for calculation ¬ drying a round key sequence as the individual key from the prekey fertil according to another embodiment of the present inventions.
Before referring to the drawings, the present invention will be explained in more detail with reference to embodiments, it is noted that the same elements or similar elements in these figures, identical or similar reference numerals are provided, and that a repeated description of these elements is avoided.
Fig. 1 illustrates a system of CPU 10, memory 12 and a memory accessing device 14. The system of Fig. 1 is for example part of a crypto controller on a chip card. In the memory 12, which may for example be part of a physically larger memory, secret information is stored, such as a credit, a master key of a chip card-issuing institution or a secret code of a secret cryptographic algorithm. The CPU 10 executes a program, which can for example be also stored in the memory 12 to be protected from access by unauthorized. Some commands require in the program that the CPU 10 loads memory content in the memory 12 or reads or loading memory contents in the memory 12 by new information or overrides.
The access device 14 is provided to sicherzustel- len, that the secret information is always stored in the memory 12 in encrypted form, and that, conversely, the encrypted memory contents of the memory 12 during loading operations or when reading out the same be decrypted.
The access device 14 includes an encryption / decryption means 16, and a key generation device 18. The encryption / decryption means 16 is adapted to encrypt data from the CPU 10, to be stored in the memory 12 prior to their storage, and the memory 12 to decode output, stored and encrypted data before forwarding to the CPU 10 degrees. refer to the encryption / decryption means 16 uses a word individual key, which it receives from the key device 18th
More specifically, the CPU 10 is connected via an address bus 20 to both an address input of the memory 12 and an address input of the key generation means 18th The key generation device 18 outputs at its output from word key for the custom addresses on the address bus 20, the output of the key generation device 18 with a key input of the encryption / decryption means 16 is connected. Via a data bus 22, the CPU 10 is connected to a data input / output of the memory 12th In the data bus 22, the encryption / decryption means 16 is connected. In particular, a data input of the encryption / decryption means 16 to a data output of the CPU 10 and another data input of the encryption is / decryption device 16 connected to a DATAOUT ¬ transition of the memory 12 while a data output of the encryption / decryption means 16 to a data input of the memory 12 and a further data output of the encryption / decryption device 16 is connected to a data input of the CPU 10 degrees. The encryption / decryption means 16 thus forms an interface between CPU 10 and memory 12 and ensures that on the data bus 22 between CPU 10 and
Encryption / decryption means 16, the data in entschlüs ¬ selter form, that is in plain text, and in that part of the data bus 22 between the memory 12 and the encryption / decryption device 16 in encrypted form, ie as cipher text, occur.
Having described above the construction of the system of FIG. 1, hereinafter the operation of which will be described. In the following description of the operation of the CPU 10, it is assumed that there are already encrypted memory contents in the memory 12th The memory 12 is divided into the smallest individually addressable units, referred to as words. Each word of the memory 12 is assigned a unique address. Now, if the CPU 10 is instructed to perform a charging operation when execution of a program, ie to load the encrypted memory contents to an individually addressable element or a word from the memory 12, the CPU 10 on the address bus 20 outputs the corresponding unique address. The memory 12 uses the address to access the corresponding physical memory location and reading the stored encrypted word there and to the data bus 22 to the encryption / decryption device outputting 16th
The key generation device 18 also receives the output from the CPU 10 address. As will be described hereinafter, determines the key generation device 18 from the address on the address bus 20 a word individual key, the averaging means, the encryption / decryption requires 16 to decrypt the encrypted read out Senen memory content of the memory 12th The key generating means 18 outputs the word therefore individual key from the encryption / decryption device sixteenth This decrypted on the basis of the word individual key the erhalte- NEN of the memory 12 memory contents and outputs memory content in plain text to the CPU 10, which processes the now decrypted memory content according to the command in plain text, such as loads or the like into an internal register ,
In the case that the program being executed indicates a write operation to be executed in the command line, the CPU 10 on the address bus 20 outputs the address indicating the word is to be stored in which a specified by the write command data. The datum to be stored, the CPU 10 outputs to the data bus 22 to the encryption / decryption device sixteenth As above, in the charging process, the key generation device 18 generates from the address on the address bus 20 a word individual key and outputs the same to the encryption / decryption means 16 from. This uses the word individual encryption key to be memorized date and returns the ciphertext to the memory 12th The memory 12 stores the received cipher text at the specified by the address on the address bus 20 location in the corresponding word.
In the description so far has not yet received close attention to the operation of the key generation means 18th As the embodiments described below for the key generation device 18 newspaper are gen, the key generation device 18 is formed such that it is able to generate word individual key to encrypt the memory content or words in the memory 12, but without any even a perform about the same elaborate key generation process. This is achieved by a plurality of words, which represent the smallest addressable units of data of the memory 12 are combined in each case to one side, and that complex for a page only the page address specifying the page as the pages of the memory 12, in a complicated and and thus a secure manner is used to produce a Seitenvorschlüssels, while the word individual keys are generated in a simple, less complicated manner on the basis of the Seitenvorschlüssels for the words within that page. then loads, as often occurs, the CPU 10 sequentially, the words of a page, then it is only the first word of this page necessary to perform the elaborate Vorschlüsselgenerierung, while for the remaining words of the page then only the less complex derivation of the word individual key prekeystream this is necessary on the base.
To illustrate the division of the memory 12 in sides and closer words, first in Fig. 2a and 2b by reference. Fig. 2a shows schematically shown as a rectangle in its upper half a section of the memory 12. The detail shown in Fig. 2a by way of example 12a comprises 15 pages. Each page, in turn, consists of 16 words 12b, and this for reasons of clarity but is shown in Fig. 2a only one side 12a. The words 12b of the memory 12 are the smallest addressable units of data of the memory 12. This means in other words that each word is allocated 12b a unique address by which it, with the memory 12 units connected, such as the CPU 10 of FIG. 1 is possible to access the memory contents of the individual words 12b. It should be noted that the spatial arrangement of the words 12b, as shown in Fig. 2a, of course, is only exemplary, and that the memory 12 can also have several übereinanderange- arranged memory planes, and that the individual words and 12b differently to Sites may be combined or otherwise may be arranged as shown in rows and columns as shown in Fig. 2a.
In order to simplify the representation of the following description, it is assumed hereinafter that the memory encompasses 12 2 20 words. Each word consists of 32 bits = 2 5. The memory size of the memory 12 is thus according to this merely illustrative example 2 25 bits = 2 17 x 2 = 8 bits 128 kilobytes. The division into pages is made by way of example in such a way that all words with addresses whose most significant 16 bits (MSB, MSB = Most Significant Bits) are equal, belong to a page or to be construed combined into one page. The word addresses of words in a page thus differ only in the remaining four least significant bits (LSB Least Significant Bits) of the twenty bit word address. Consequently, the memory 12 contains 2 15 pages.
In Fig. 2a, the construction of a unique address of a word 12b is shown at 30 still by way of example. As already mentioned, is assumed in the following that the unique address is 30 20 bits long. The higher-value part of the unique address 30 consisting of the 16 MSBs and is referred to as the page address portion 30a of the unique address. The page address portion 30a contains the so-called. Page address. The low order part 30b of the unique address is formed from the four LSBs and represents the word address portion 30b. The word address portion 30b indicates the unique address 30 is associated with which of the words in the direction indicated by the page address portion side 12a.
This is illustrated in Fig. 2b illustrates in more detail, illustrating a side 12b of the division in the 16 words 12a side 12b, and in the numbered words and with an associated 4-bit word address and a 4-bit offset value are provided, which must be included for each word in the word address portion 30b. By the word address, or the offset value in the word address portion 30b of each word of a page is assigned a fixed place within the page consequently.
Referring to FIG. 2a, the key generation device 18 will now be described according to an embodiment of the present invention in the following. The key generation device 18 includes a Seitenwechselfeststellungs- device 32, a Vorschlüsselberechnungseinrichtung 34 and a device 36 for determining the individual key. Further, the key generation device 18 includes a memory such as a volatile memory 38 is received on the function and production or in more detail below for temporary storage of the one or more last verwen- Deten page pre (n).
The page change detection means 32 is adapted to receive the page address portion 30a of the unique address 30 on the address bus 20 and to check to see if the same page is concerned, for which is already a page pre in the cache 38th If this is the case, the page change detecting means 32 is able to access on the basis of the stored page address to the buffer memory 38, which then the cached page pre for the specified by the page address page to a side vorschlüsseleingang the device 36 passes.
Represents the page change detection means 32 determines that the direction indicated by the page address page, no page pre exists, the same page address indicates a page address input of Vorschlüsselberech- drying apparatus 34 on. The Vorschlüsselberechnungsein- direction 34 is calculated from the page address for this page a page pre and outputs the calculated on the page pre Seitenvorschlüsseleingang the device 36 on. Furthermore, they are the same, displacing a previously stored Seitenvorschlüssels for temporary storage to the memory 38 from.
The word address portion 30b of the present on the address bus 20 unique address 30 is passed to a word address input of the device 36 for determining the individual key. The means 36 determines from incoming word address or offset value and lodged lodged page pre an individual key word for the word to which the unique address 30 shows. The means 36 outputs these individual word key out at its output, which is at the same time the output of the key generation device 18, which, as shown in Fig. 1, averaging means with the key input of the encryption / decryption 16 is connected.
Once above the structure and the function of the individual components of the key generation device has been described 18, in the following, the operation is described. For this purpose is first assumed that there is still no side 12a of the memory 12, a page pre has been generated, and therefore there is not one stored in memory 38th
Upon receipt of a unique address 30, the page change detection means 32 first strikes after the memory 38, whether for the information contained in the page address portion 30a page address of the page in which the word is located, to which the unique address 30 is, as indicated by an arrow 40 is a page pre exists. The lookup finds using the page address rather than as an index, wherein in the memory 38 a table of side- nadress is provided page pre-pairs /. The memory 38 thus provides a content addressable memory, the look up for incoming page addresses, whether it has a side- nadress / page pre-pair with this page address and outputs the corresponding key, if that is the case. However, this is presently under the above assumption initially not be the case. The memory 38 divides the failure (miss), consequently, the Seitenwechselfeststellungseinrich- tung 32, which in turn forwards the page address to the Vorschlüsselberechnungseinrichtung 34th
The Vorschlüsselberechnungseinrichtung 34 calculates a page pre based on the page address. This calculation comprises, according to the reference to FIG. Exemplary embodiment described in more detail 3 as the Verschlüsselungsbe- calculation means 34, for example, an encryption of the page address by using a master key, so that the correlation between the calculated Vorschlüsselberechnungseinrichtung 34 from the page address to the page addresses complicated possible Seitenvorschlüsseln, is. The Vorschlüsselberechnungseinrichtung 34 may, for example, more generally, the page address at its address input side in accordance with a non-linear mapping to the Seitenvorschlüs- is mapped. This nonlinear mapping may be page pre to an M-bit of any image of the 16-page address, where m must be> 16, so really a different page pre is generated for each page, m but can also be less than 16, if this is not is required. The Vorschlüsselbe- calculating means 34 can also be a one-way function or an asymmetric encryption used to image the page address to the page pre.
Of the offset value containing word address portion 30b of the present on the data bus 20 and the 30 unique address just calculated from the page pre Vorschlüsselberechnungseinrichtung 34 is used by the device 36 to calculate the individual key word. As later with reference to Fig. 4 - will be explained in more detail 7, the device for determining the individual key 36 may use, for example, the offset value or the word address to its word address input to modify the page pre, namely using simple arithmetic operations such as XOR or NXOR operations or the like. Preferably, the arithmetic operations, using the means 36 for determining the individual key should be fewer in number and less time consuming than the Vorschlüsselberechnungs- means 34 for calculating the Seitenvorschlüssels used. Further, it is preferred that the device 36 is implemented for determining the individual key with less chip area and / or the implementation of the means 36 for determining the individual key has a smaller calculating time duration than the prekey calculating means 34th
The word individual keys, as has been determined by the device 36 is forwarded 16, then device to the encryption / decryption.
To prevent now that the complicated Vorschlüsselberechnung must be carried out anew for each unique address 30 that is output on the address bus 20, stores the Vorschlüsselberechnungseinrichtung 34 at each calculation of the newly calculated page pre in the latch 38. The latch 38 is, for example, by the FIFO principle (FIFO = First in First out) managed so that when storing a new page pre Seitenvorschlüssels displaced one by Vorschlüsselberechnungseinrichtung 34 and is overwritten which has been written into first. Of course or other update or displacement principles are applicable, such as the LRU (Least Recently Used) principle, in which the page pre paged on the longest time means not through the Seitenwechselfeststellungs- has been accessed 32, the LFU - (least Frequently Used) principle, in which the page pre paged which has the smallest number of accesses by the page change detecting means 32nd
Now, if a following unique address 30 that is output on the address bus 20 then, comprises a page address portion 30a in which a page address is indicative of a page for which in the buffer memory 38 is still cached a page pre, this shows the memory 38 of the paging detection means 32 on receipt of the page address as an index out by a hit (hIT) signal. The paging detection means 32 derives the page address thereto not on the Seitenadress- 34 input of the encryption calculation means further but bypassing the latter of the inte- ressierenden page address is assigned and outputted previously calculated page pre from the memory 38 to the Seitenvorschlüsseleingang the device 36th in the case of a hit, so no complicated and time-consuming Vorschlüsselberechnung must in this case carried out due to the evasion of Vorschlüsselberechnungseinrichtung 34th Only a lookup in the buffer 38 is necessary to determine the page pre for the new unique address 30 on the address 20th Here can between the unique address 30, actually calculated on whose output on the address bus 20 toward the page pre through the Vorschlüsselberechnungseinrichtung 34 and has been registered in the buffer memory 38, and the unique address 30 to which out of the page pre is retrieved from the memory 38 , already have one or more unique addresses have been issued 30 interim on the address 20th This means that possibly no Vorschlüsselberechnung must over long periods of time and over a plurality of unique addresses on the address bus 30 20 of time, at a suitable, to the relevant application of the system of Fig. 1 adjusted displacement strategy of the memory 38 are performed. Only the simple modification of the information retrieved from the buffer memory 38 Seitenvorschlüssels by the word address, or the offset value in the device 36 must be carried out to arrive at the word individual key for the word, to which the unique address is assigned on the address bus 20 30th
The latch 38 may be integrated into an extended cache associated in one of the CPU 10 cache memory (in Fig. 1 not shown). The cache contained then beispielswei- se for faster data access the contents of recently used pages, ie pages were accessed recently. The contents were then stored encrypted. For each page content the associated page address and the page pre would be stored in the cache. So this expanded shouldered cache contained a table of triplets from page address, and page pre Seitenchiffrat. The displacement strategy of this extended cache could be one of the foregoing mentioned. In the event of failure, the operation would be the same search as described above, with the difference that now the encrypted contents of the current page is saved by displacing another page in the cache. In the case of a hit, in addition to the output of the Seitenvorschlüssels to the device 36 1 would further the output of the scrambling system rare word, to which the unique address 30 shows (from the cipher text of interest side to the data input of the encryption / decryption device 16, Fig. be) output which is connected to the memory 12, whereby the slower access would circumvent the memory 12th Public swimming lent could also be organized as words with triples from word address and page pre Wortchiffrat the cache. In the case of a data cache with unencrypted data that would be located in the plaintext domain between the CPU and device 14 (FIG. 1) and a combination of the data cache to the memory 38 would be unnecessary. Further, also a simple memory for storing only the last calculated Seitenvorschlüssels could be used instead of the cache memory 38, the content is read out during a subsequent access operation and used, bypassing the device 34, if the next page address, to which this access operation refers like which is the same to the previous memory operation was, in which the last calculated Speichervorschlüssel was calculated and stored.
Referring to FIG. 3, an execution will now approximately example of the Vorschlüsselberechnungseinrichtung 34 described below. The Vorschlüsselberechnungseinrichtung 34 of FIG. 3 includes a page address input 50 and a Vorschlüsselausgang 52, and an expansion device 54, and a block cipher module 56. A data input of the expansion device 54 is connected to the page address input 50 to obtain the 16-bit page address. The expansion device 54 generates on the basis of 16-bit page address a 64-bit data block 58, by spreading each bit of the page address bit positions of the four 64-bit data block 58th He accu- words, 54 writes the expansion means the
Page address in the bits 0 - 15, 16-31, 32-47 and 48-63 of the 64-bit data block 58 as is also indicated in Fig. 3. The thus formed 64-bit data block 58 outputs the expansion device 54 to a data input of the block cipher module 56th The block cipher module 56 further includes in addition to the data input of a key input, receives a 64-bit master key to the same. The 64-bit master key is fixed and must be protected by appropriate measures by third parties from unauthorized access. The block cipher module 56 causes a non-linear map, which depends on the master key, and is for example a DES-module or an AES module. Based on the master key encrypts or scrambles the block cipher module 56 the 64-bit data block 58 to obtain an encrypted 64-bit block of data and output it to the data output 52nd This encrypted 64-bit block of data sets according to this embodiment the sides tenvorschlüssel represents, based on which, as described in Fig. 2a, the word individual key of the words of the associated side are calculated on showing the page address on the input 50.
Referring to the following FIG. 4 -. 7 embodiments for the device 36 for determining the individual key from the page pre and the word address of Figure 2a will now be described.
According to the embodiment of FIG. 4, the 4-bit word address is added by XOR operations several times on the side keys. For this purpose, the device 36 includes 16 4-bit XOR devices 60a, 60b, 60c, 60d and 60e. Each XOR linking means comprises two 4 bit
Data inputs and a 4-bit data output. the XOR received at the first of two 4-bit data inputs
Linking devices 60a - 60e, the 4-bit word address. received at the second data inputs, the XOR operation devices 60a - 60e different four
Bits of the 64-bit prekeystream that has been generated, for example in the manner shown in Fig. 3 way. More specifically, each XOR device 60a receives - 60e different four consecutive bits of the side prekeystream, namely, the XOR device 60a, the bits of the bit positions 63-60, the XOR operation device 60b, the bits of the bit positions 59-56, the XOR combining means 60c, the bits of the bit positions 55 ... 52, etc. of the prekeystream, as indicated in Fig. 4. The XOR devices 60a - 60e bitwise link the 4-bit word address with the respective four bits from the 64-bit prekey.
For example, let where the side key as the vector Kseite = (k 0 k x k 2 ... k 62 k 63 j, where k ir for i = 0 ... 63
Bit value of the bit position is Seitenvorschlüssels to i, and the word address by the vector (w 0 w x w 2 w 3), wherein W 3 j the bit of the word address is j with j = 0 ... at the bit position. The bit-wise XOR operation results of the XOR gates 60a - 60i are then combined in such a word individual keys with 64 bits, that the word individual keys results in a vector Kort, with kword = (K 0 θw 0, k x θ wi, k 2 θ w 2, k 3 θ w 3, k 4 ® w 0, sθ wi, k 6 ® w 2, w k 7 θ 3, ..., keo © w 0 kßi® w x, w 2 kβ 2 ® , δ θ 3 w 3), wherein θ a XOR operation display.
According to the embodiment of FIG. 5, the device 36 for determining the individual key comprises a look-up table 70 that provides a different 64-bit mask vector for any 4-bit word address and a 64-bit XOR operation device 72. According this embodiment is used to access the word address as an index by an illustrated with 74 lookup means, for example, the lookup table 70 to access the masking vector which is associated with the word address which is supplied to the device 36 from the word address portion of the currently available on the address bus unique address , The lookup table 70 outputs the inde- xed masking vector from a first data input of the XOR operation means 72nd A second 64-bit data input of the XOR operation device 72 receives the 64-bit page pre. A 64-bit data output of the XOR operation device 72 at the same time the output of the device 36 of FIG. 5 represent. At this word of the individual 64-bit key is output.
Is given for example by the reference defined in Fig. 4 vector Kseite the page pre, the XOR operation means outputs 72 at its data output (knθmo, k x θ in, ..., k 63 ®m 63) as a word individual key Kor, if the indexed masking vector (m 0, mi, ..., rri 63). In other words, a masking vector for each word address, according to the embodiment of FIG. 5 provided which has the same bit length as the side orschlüssel being controlled via a look-up table for the interest word address its associated masking vector and this masking vector then on the page pre or aufad- by ​​XORing are coded, and the result of 64-bit word individual is key.
According to the embodiment of FIG. 6, the device 36 for determining the word individual key comprises a look-up table 80 in the predefined different Permutationsvorschriften, namely, a different permutation for each possible value that the word address may take, and a controllable permutation means 82. By the device 36 supplied word address of the word address portion of the currently available on the address bus unique address as an index accesses a symbolized with 84 look-up means to the look-up table 80, which then processing the assigned this word address permutation to the controllable Permutationseinrich- forwards 32nd The Permutationsvorschriften stored in the lookup table 80 for each possible value of the word addresses are, for example, 64-bit vectors with 6-bit coefficient, the first coefficient indicates at what point of the permutation is the least significant bit at the 64 bit data input of the controllable permutation means 82 is shifted, the second coefficient indicates where the next higher order bit to be shifted to the 64-bit data input of the controllable permutation means 82, etc. the data input of the controllable permutation means 82 receives the page pre. At the 64-bit data output of the controllable permutation means 82 of the word individual 64-bit key is issued, the only differs according to the indexed permutation of the page pre that the individual bits are shifted within the 64 bit positions or interchanged. Is given for example by the defined with reference to FIG. 4 vector Kseite the page pre, the permutation means are 72 to its data output (kp {0), P (i), ..., kp (63)) as a word individual key kword from if the selected permutation (P (0) P (1), ..., P (63)).
In other words, standing of the embodiment of FIG. 6 for each word address in a specific permutation loading riding. To generate the individual key word from the page pre allowed to act on the bits of the word address Seitenvorschlüssels the associated permutation, the result is then the word individual keys.
With respect to the above with reference to FIGS. 4 - 6 described embodiments for the device 36 for determining the word individual key, applies that the same are readily with the embodiment of Figure 3 for the Vorschlüsselberechnungseinrichtung 34 can be combined as the same as the page pre a 64. -Bit-
expect or demand page pre. But as already mentioned, it is also possible that Vorschlüsselberechnungs- device 34 perform differently. It could be possible that the Vorschlüsselberechnungseinrichtung 34 generates a 79-bit page pre. Of these, the embodiment of Fig. 7 goes out of the device for determining the individual key. According to this embodiment 36 the device consists of a multiplexer 90 having a 79-bit data input, a 4-bit control input and a 64-bit data output, the multiplexer 90 is formed to depend from the 4-bit word address 64 of the 79 bits of the Seitenvorschlüssels outputting the 4-bit control input to the data input of a 64-bit word individual key on the 64-bit data output. In other words, is generated according to the embodiment of FIG. 7, a slightly longer than the page pre required for the data encryption actually. a particular segment of this long Seitenschlussel is then selected and used as individual key word depending on the Wortad- ress.
The multiplexer 90 may, for example be formed such that it (the page pre Kseite = (k 0, k i, k 2, ..., k, k 7 g) depending W on the word individual 64-bit key Kort = of the word address k 0, k x, .-., k 63) depicts when W = 0000 b, on kword = (ki, k 2, ..., k 64) when W = 0001 b, on Kwor = (k 2 , k 3, ..., k 6 5) when W = 0010 b ... and kword = (kis, kι 6, ..., k 78), when W = llll b.
. Of course, other exemplary embodiments as shown in FIG 4 are - 7 shown for the device 36 for determining the individual word Schlusseis possible. The device 36 could also be implemented as a cryptographic one-way function, for example. A one-way function is a function in which it is much more complex to determine the inverse function, or when it is impossible to determine diesel be. An example of a one-way function, a modular operation, such as, for example, a odula- re exponentiation. This one-way function is then let's act on the respective word address. The thus resulting function value associated with the page pre gives the wortin- dividual key.
After the preceding exemplary embodiments of Figure 3, -. 7 Final same accounting means primarily with exemplary embodiments for the pre- 34 and the Ermittlungsein- busy direction 36, referring to Figure 8, an exemplary embodiment for the part of the encryption / Entschlusselungseinrichtung 16 describes the for. decryption of the (or from a cache in the case of a hit) from the memory 12, sent to the CPU 10 encrypted words based on the word individual
Key as it is sent from the Schlusselerzeugungseinrichtung 18, be competent. The decoding part of FIG. 8 is generally shown at 16a. It comprises a data input 100 for the encrypted, to be decrypted word from the memory 12 channels and a data output 102 for the decoded word to be forwarded to the CPU output 10. Further, the decryption part 16a includes a key input 104 for receiving the word individual key from the key generation device 18 (Fig. 1). As an internal component of the receiving part 16a includes a permutation means 106 for performing an inverse permutation, eight parallel-connected 4x4 S-boxes S ^ 1 - S g 1 which are connected in parallel and each have different four bits of a 64-bit value in accordance with a non-linear map image on four different bits of an output value, 108, a 32-bit XOR logic device 110, a Rundenschlüsselgenerie- inferring means 112 and a switch 114. a 32-bit data input of the permutation means 106 is connected to the data input 100 to the encrypted to get 32-bit word. The permutation 106 permutes the bits of the 32-bit word at the permutation, and outputs the permuted 32 bit word at its permutation output from, wherein the permutation is a predetermined permutation P inverse, which is indicated by P '1. The result of the permutation is the same as a 32-bit value at the parallel S-boxes 108 of each S-box S '1 - S'. 1 includes a 4-bit data input and a 4-bit data output on each 4-bit. -Dateneingang the S-boxes 108 are located at different four bits of the 32-bit value, the onseinrichtung of the Permutati- have been output 106 form the S-boxes 108, as already mentioned, by a non-linear map which for each of the. S-boxes can be different, and preferably also, the four bit values ​​at the data inputs to four bit values ​​at the data outputs from. the four bit values ​​at the data outputs compiled into a 32-bit word and a data input of the XOR Shortc pfungseinrichtung 110 supplied. The XOR operation unit 110 comprises a further data input. This is an output of the Rundenschlüsselgene- rierungseinrichtung 112 is connected, whose input is in turn connected to the key input 104th On the key input 104, the word individual 64-bit key is present, as for example, by one of the devices of FIG. 4 - is obtained 7 or 18 by another possible configuration of the key generation means, the lap key generation device 112 generates based on the word individual key a 32-bit round key and outputs the same to the second data input of the XOR operation means 110th The XOR operation unit 110 linked bit by bit to 32-bit round keys and the 32-bit output value of the S-boxes 108 to at a data output thereof the 32-bit
to get round intermediate result. A switch input of the switch 114 is connected to the data output of the XOR operation means 110th The switch 114 includes two switch outputs, namely a 32-bit round continuation switch output and a 32-bit
Around termination switch output. The switch 114 connects the data input to the round continuation switch output, so that the encrypted word a predetermined number of times, the devices 106 in the data input 100 - has passed through the 110th Number is high enough to ensure adequate security of the encryption. The lap is continued switch output connected to the permutation of the permutation means 106, while the Run denbeendigungsschalterausgang is connected to the data output 102, the decrypted by the predetermined number of rounds, which has passed through the encrypted word at the data input 100 32-bit Word at the data output to output 102 via the data bus 22 (Fig. 1) is connected to the CPU 10. The round key generation device 112 is designed such that it for each round that the devices 106 the encrypted word - which generates a different round key from the individual word 64-bit key at the data input 104 passes through 110th
Once above the structure of the decryption has been described in part 16, hereafter referred to its operation will be described. The encrypted 32-bit word that has been read out from the memory 12, accessed via the data input 100, the permutation 106. These permuted the encrypted word in respect to the arrangement or Bitpositionsverteilung its bits according to a permutation P _1. Then, the parallel S-boxes 108 to ensure a non-linear mapping of the permuted 32 bit value to a permuted, illustrated 32-bit value. This will be with a first Rundenschlüs- which the round key generating means 112 has generated for the first round from the individual key word, bitwise XORing the XOR device 110, whereby the round intermediate result is obtained with 32 bits. This 32-bit word is derived the switch 114, if more than one round is to be performed, again 106 further to the input of the permutation means, whereby the permutation, the non-linear mapping, and the XOR operation to be repeated, the latter but with a newly determined round key. After the last round of the switch 114 switches to the round termination switch output and gives the round intermediate result as decrypted 32-bit word.
The decryption part of the encryption / decryption means 16 described with reference to FIG. 8 is always active when the CPU loads encrypted content from the storage memory 12. Fig. 9 shows an embodiment for an encryption part 16b of the encryption / decryption means 16 which is able to encrypt unencrypted words from the CPU 10 to the memory 12 for a storage operation such in encrypted words, that they, when used in a charging again device 16 are decrypted by the decryption part 16a of Fig. 8 from the encryption / decryption, access in its original state through the data bus 22 to the CPU 10.
The encryption part 16b comprises a data input 120 for an unencrypted, to be encrypted word from the CPU 10 receiving as well as a data output 122 for an encrypted word to be forwarded to the memory output 12. Furthermore, the encryption portion 16b includes a key input 124 for receiving the word individual key. In addition, the encryption part 16b comprises a permutation means 126 to the permutation of a 32-bit value to a permutation in accordance with a permutation P, which is the inverse of the permutation performed by the permutation means 106 to a Permutationsergebnis to a permutation, eight parallel-connected 4x4 S-boxes Si - S 8, 128, an XOR operation unit 130, a Rundengenerierungseinrich- tung 132 and a switch 134th
The XOR device 130 includes two 32-bit data inputs, one of which is a to the data input 120 of the other inference means having a data output of the Rundenschlüsselgenerie- 132 is connected. A 32-bit data output of the XOR operation means 130 is the S-boxes Si
- S 8 is connected, that abut the 4-bit data inputs of the same four different bits of the 32-bit data output of the XOR operation means 130th The S-boxes Si
- S 8 form 4-bit values at their data inputs according to non-linear maps 4-bit values at their data outputs from, the linear transformations are inverse to those of the S-boxes of Figure 8, associated at the 108th ie Sχ (s x ()) = s 1 (S (x)) = x for all i = 1 ... 8 and for 4-
Bit values ​​x.
The 4-bit values ​​to the data outputs of the S-boxes 128 as a 32-bit value to the permutation of the permutation device 126 forwarded. The permutation of the permutation means 126 is connected to a switch input of the switch 134th A round-continuation switch output of switch 134 is connected to the first data input of the XOR operation means 130, while a Run denbeendigungsschalterausgang of the switch 134 is connected to the data output 122nd An input of the Rundenschlüs- selgenerierungseinrichtung 132 is connected to the key input 124th
Having described above the construction of the encryption part 16b, whose operation will be described hereinafter. The encryption part 16b is substantially builds listed inverse to the decryption part 16a. If a plaintext word arrives at the data input 120 to the XOR device 130, the XOR device 130 associated unencrypted this word with a round key, which the Rundenschlüsselgenerie- approximately 132 generated from the individual key word. This round key is the one round key, the decryption part will use in his final round 16 to decrypt the encrypted word again. The continuous safe XOR-linked 32-bit value is represented by the S-boxes 128 to a mapped 32-bit value. This operation is exactly through the S-box
Imaging of the last round in the decryption in the decryption part 16a are reversed. The illustrated 32-bit value is permuted by the permutation means 126 according to the permutation P to obtain the permuted 32 bit value representing the round intermediate result. This permutation of the first round in the encryption are reversed as the decryption in the last round by the permutation P _1 in the decryption part 16a. As long as more rounds are desired, 134 connects the switch the switch input to the round continuation switch output, otherwise with the round termination switch output, to output the 32-bit round intermediate result as the encrypted word via the data output 122 to the memory 12th The round key generating the round key generation means 132 from the word individual key are different for the respective rounds are rounds the reversed assigned compared to the round keys, which generates the round key generation device 112 for the decryption rounds. In this way it is ensured that a coded word as it is generated by the encryption part 16b, is decrypted by the decryption part 16a back to a decoded word with the original value. The word individual key which abuts the key inputs 104 and 124, respectively, is the same for decryption and encryption, since is output both during charging and memory access the same unique address for the respective word on the address bus 20 (Fig. 1) so that the key generation device 18, both generated during charging and when saving the same individual key word.
With respect to FIGS. 8 and 9 is also pointed out that it certainly selungseinrichtung also many other ways of implementing the encryption / decryption in the encryption / decrypted 16 are. Among other things, could be 16 used in the encryption unit 16b parts of the components in the decoding unit when respective switches provide, depending on the encryption or decryption of a suitable interconnection of these components. Further, encryption and decryption round also of double could be having a portion of round with a S-box picture and a partial round with an inverse S-box _1 figure, so that all components of the encryption / decryption device, both in decrypting could also be used as the encryption.
The foregoing embodiments have assumed that a 64-bit key of the encryption / decryption device is supplied as word individual key, which then then generated according to the embodiments of Figs. 8 and 9 round keys, the lungs- for each encryption or decryption rounds used become. The embodiment described below with reference to Fig. 10 differs from these embodiments in that a round key sequence of the encryption / decryption means is supplied as word individual key, which consists of round keys, but indeed are for the words of a page the same in a different sequence are arranged ,
Fig. 10 shows an embodiment for a such a word individual key generating means 36 ''. The device 36 '' comprises a round key calculation means 140, a look-up table 142, a readout device 144, and a Auswahlreihenfolgebestimmungseinrich- tung 146. The round key calculation means 140 includes a data input and a data output, is present at the data input of the 64-bit page pre as either is supplied from the Vorschlüsselberechnungseinrichtung 34 or the buffer memory 38 (see Fig. 2a). The round key calculation means 140 calculates denschlüssel several different Run based on the Seitenvorschlüssels. The number of round key depends on the number of rounds of iterative block cipher, which is implemented by the encryption / decryption means 16, such as so transmits the Round Key calculating means 140 through the decryption and encryption part of Fig. 8 and 9. For each round a different round key in the lookup table 142nd The selection order determination means 146 receives at a data input 4-bit word address of the 30 located just on the address bus 20 unique address Depending on the word address selects the selection order determination means 146, a predetermined different order with respect to the round key, to be with the same read out sen. This sequence displays the same to the readout device 144 which reads out the 32-bit Langen round key out according to the order indicated in order in the order shown as Rundenschlüs- same seifolge of 32-bit round keys in the encryption / decryption means outputting sixteenth Different words with different word addresses in the same page hence also perform at the very same word content to a different cipher, as the round key sequence is not the same in the iterative block cipher in the encryption / decryption means 16 in the individual rounds.
In other words, it is considered according to the embodiment of Fig. 10 of an iterative block cipher in encryption / decryption means 16, wherein in each round its own round key is applied. This round keys are available in registers the lookup table 142, after they have been calculated in advance from the page pre. The 4-bit word address will then determine the order in which the round keys are applied in the iterative block cipher.
The exemplary embodiments for the generation of keys used for encryption to storage chernder data and / or decryption of stored, read data when accessing a storage described above thus provide an address-dependent area key generation. However, rather than complicated to carry out the area key generation for each word equally the pro- process of key generation area into two sub-processes split, namely a relatively expensive and slow step and a quick and easy step that is virtually free. Only the simple step must be performed on every single word of consuming step, however at the same time only once for several words. While sticking to the address-dependent area key generation is more than reasonable: In a microprocessor word size is nowadays a few bytes. For example, 4 bytes, or 32 bits. but a cryptographic 32-bit block cipher makes no sense. The number 32 is small enough so that an adversary for all possible 2 32 "4.3 billion full text could collect the associated cipher text and list them in a kind of coding lexicon. Cryptographic block cipher make only for block widths of 64 bits, 128 bits for better, mind. This problem can not be solved by the application as it has been described in the introduction of a CBC mode, a "32-bit block cipher." The address-dependent area key generation solves this problem, however satis- factory. Now, no coding lexicon the above type be created. For the same 32-bit plain-text word, which occurs at two different memory addresses is encrypted with different area keys. Thus, the corresponding ciphertexts are also different, even if the underlying plain text is the same.
The area key generation for accessing a store with encrypted content according to the above embodiments was to generate a page or page-wide-wide prekeys from the secret master key and the page address or page address. This is the consuming step that needs to be done only once per page or page. Then, from the prekeys and the word address in a simple manner word individual key is derived. The encryption of the word is now with the word individual key.
Benefits arising are as follows: The calculation of the Page key must meet certain cryptographic criteria and is correspondingly expensive. The page key is calculated either in a separate hardware unit or is the encryption unit 16 is also used to calculate the Page key. Now that the calculation of the Page key is rarely required (only once per page), the hardware unit for the Page key generation can be made smaller because of this. In the other case, in which the cryptographic hardware is shared to the Page key generation, the encryption rate is increased as a result of the now rare stress of the cryptographic hardware.
Referring to the above embodiments is also pointed out that, for example, easily the XOR gates could be replaced by exclusive NOT gate. The temporary storage of the page pre-described in the foregoing with displacement strategy can also be replaced by a storage in a sufficiently large volatile memory without displacement strategy, so that the page pre would be automatically deleted in the absence of power supply. Furthermore, prior to the generation of Seitenvorschlüssels the page address and other operations could be subjected as the expansion of Fig. 3. Further, the present invention does not operate based on the smallest addressable units of directly addressable memory, but it can also be selected larger addressable units. Furthermore, the mapping of the sides could tenadressen be any image on the page pre, preferably of course, a non-linear mapping.
It is pointed out that may be implemented depending on the circumstances, the inventive scheme in software. The implementation may be on a digital storage medium, particularly a floppy disk or a CD having electronically readable control signals, which can cooperate with a programmable computer system such that the respective method is performed. Generally, the invention thus also consists in a computer program product stored on a machine-readable carrier, the program code for performing of the inventive method when the computer program product runs on a computer. In other words, the invention can be realized as a computer program with a program code for performing the method when the computer program runs on a computer.
12 page memory 12a
12b word
14 access system
16 encryption / decryption means
16a decryption part 16b encryption part
18 Key Generator
30 unique address 30a page address portion
30b word address part
32 page change detection means
34 VorSchlüsselberechnungseinrichtung
36 means for determining the individual key
50 data input
52 data output 54 expansion means
56 block cipher module
58 expanded data block
60a-60e XOR gate means
70 look-up table 72 XORing means
80 look-up table
82 controllable permutation
84 Index 90 multiplexer
100 data input
102 data output 104 Schlusseleingang
106 permutation
108 S-boxes
110 XOR 112 Verknupfungseinrichtung Rundenschlusselgenerierungseinrichtung
120 data input
122 data output
124 126 Schlusseleingang permutation
128 S-boxes
130 XOR Verknupfungseinrichtung
132 Rundenschlusselgenerierungseinrichtung
134 switch 140 round final reckoning device
142 look-up table
144 readout device
146 selection order determination means
1. A device for generating an individual key for accessing a predetermined addressable unit (12b) of an in addressable units (12b) articulated memory (12), wherein the addressable units (12b) are combined in groups to form sides (12a), wherein the predetermined addressable unit has a unique address (30) is associated, which is composed of a page address (30a) which indicates the page that belongs to the addressable unit, and a unit address (30b), the addressable unit addressable among the other units of page belong identified, composed, with the following characteristics:
means (34) for calculating a Seitenvorschlüssels on the basis of the page address (30a), and
means (36) for determining the individual key on the basis of Seitenvorschlüssels and the word address (30b).
2. Device according to claim 1, wherein the means (34) for calculating the Seitenvorschlüssels has more chip area and / or longer processing time than the runtime
Means (36) for determining the individual key.
3. A device according to claim 1 or 2, wherein the means (34) for calculating means (56) for encrypting the page address or a signal derived from the same data block with a master key has to keep the page pre.
4. The device according to claim 3, wherein the means (56) for encrypting means (54) for expanding the page address (30a) in order to obtain an expanded data block (58) by mapping each bit of the page address (30a) on at least one different bit of the expanded data block (58) and imaging at least one bit of the page address (30a) on at least two bits of the expanded data block (58), and wherein the Einrich- tung is adapted to encrypt to the expanded data block (58) to cipher.
5. Device according to one of claims 1 to 4, wherein the means (36) for determining the individual key sels means (60a - 60e) for bit-wise XOR linking of bits of the word address (30b) having predetermined bits of the Seitenvorschlüssels having to obtain the individual keys.
6. Device according to one of claims 1 to 4, wherein the means (36) for determining the individual key further comprises:
a look-up table (70) with masking vectors, one of which is associated with a possible word address;
means (74) for looking up the look-up table with the word address as an index to obtain the associated masking vector; and
means (72) for bit-wise XOR operation between the masking vector and to obtain the individual keys of the Seitenvorschlüssels.
7. Device according to one of claims 1 to 4, wherein the means for determining the individual key a controllable permutation means (82) for permuting bits of the page address according to a permutation, which depends on the word address to obtain the individual key , having.
8. A device according to any one of claims 1 to 4, wherein the means (36) for determining the individual key selection means (90) for selecting bits of the page address according to a selection rule that is dependent on the word address to obtain the individual key , having.
9. Device according to one of claims 1 to 4, wherein the means (36) for determining the individual key has sels following feature:
means (140) for deriving a plurality of round keys from the page pre; and
means (144, 146) for defining an order among the round keys to obtain a sequence of round keys, wherein the order of the word address dependent and the sequence represents the individual key.
10. A device according to any preceding claim, further comprising:
means (38) for storing the calculated Seitenvorschlüssels; and
means for checking whether in a next access to another predetermined unit that is associated with another unique address in the temporary memory (38) already page pre exists calculated which has been calculated based on a page address a unique address, the is identical to the page address of the other unique address, and, if this is the case, for forwarding, bypassing the device (34) for calculating, the already calculated Seitenvorschlüssels to the means (36) for detecting and, if this is not the case is, for forwarding the page address of the unique address to the other device (34) for calculating.
11. A system for accessing a predetermined addressable unit of an articulated in addressable units memory (12), wherein the addressable units (12b) in groups to form sides (12a) are combined, wherein the predetermined addressable unit has a unique address (30) is associated, resulting from a page address (30a) which indicates the page that belongs to the addressable unit, and a unit address (30b), which identifies the addressable unit among the other addressable units that belong to the side, composed, having the following features:
an apparatus for producing according to any of claims 1 to 10; and
a device for descrambling a scrambled content in the predetermined memory addressable unit on the basis of the individual key.
Wherein associated 12. A system for accessing a predetermined addressable unit of an articulated in addressable storage units Chers (12), wherein the addressable units (12b) in groups, to sides (12a) are summarized the predetermined addressable unit a unique address (30) is made up of a page address (30a) which indicates the page that belongs to the addressable unit, and a unit address (30b), which identifies the addressable unit among the other addressable units that belong to the page composed with the following features:
an apparatus for producing according to any of claims 1 to 10; and means for encrypting data to be stored on the basis of the individual key and writing the encrypted data to be written in the predetermined addressable unit.
13. A method for generating an individual key for accessing a predetermined addressable unit (12b) in an addressable units (12b) articulated memory (12), wherein the addressable units (12b) as group are combined to form sides (12a), wherein a unique address (30) associated with the predetermined addressable unit derived from a page address (30a) which indicates the page that belongs to the addressable unit, and a unit address (30b), the addressable unit addressable by the other units, the side members identified, composed, with the following steps:
Calculating a Seitenvorschlüssels based on the address side (30a), and
Determining the individual key on the basis of Seitenvorschlüssels and the word address (30b).
14. Computer program having a program code for performing the method of claim 13 when the computer program runs on a computer.
PCT/EP2004/009054 2003-09-30 2004-08-12 Word-individual key generation WO2005043396A3 (en)
DE2003145454 DE10345454A1 (en) 2003-09-30 2003-09-30 Private key generator for access to storage device e.g. chip card, has page pre-key calculating device and determines private key based on pre-key and word address
DE10345454.3 2003-09-30
EP20040741411 EP1668515B8 (en) 2003-09-30 2004-08-12 Word-individual key generation
US11396211 US7451288B2 (en) 2003-09-30 2006-03-30 Word-individual key generation
US11396211 Continuation US7451288B2 (en) 2003-09-30 2006-03-30 Word-individual key generation
WO2005043396A2 true true WO2005043396A2 (en) 2005-05-12
WO2005043396A3 true WO2005043396A3 (en) 2005-07-07
ID=34399089
PCT/EP2004/009054 WO2005043396A3 (en) 2003-09-30 2004-08-12 Word-individual key generation
US (1) US7451288B2 (en)
EP (1) EP1668515B8 (en)
DE (1) DE10345454A1 (en)
WO (1) WO2005043396A3 (en)
CN101086769B (en) 2006-06-07 2012-05-09 三星电子株式会社 Encrypting system for encrypting input data and operation method
CN102169465B (en) * 2010-02-26 2013-08-21 银灿科技股份有限公司 Data encryption device for storage media
US8412954B2 (en) * 2010-05-19 2013-04-02 Innostor Technology Corporation Data encryption device for storage medium
US20160062920A1 (en) * 2014-08-29 2016-03-03 The Boeing Company Address-dependent key generation with a substitution-permutation network
US9633219B2 (en) * 2015-08-26 2017-04-25 International Business Machines Corporation Providing secure indexes for searching encrypted data
GB2264373A (en) * 1992-02-05 1993-08-25 Eurologic Research Limited Data encryption.
WO2000055736A1 (en) * 1999-03-15 2000-09-21 Koninklijke Philips Electronics N.V. Copy-protection on a storage medium by randomizing locations and keys upon write access
US20040184607A1 (en) * 2003-03-14 2004-09-23 Chih-Pen Chang Crypto-system with an inverse key evaluation circuit
ITOH K ET AL: "DPA countermeasure based on the "masking method"" INFORMATION SECURITY AND CRYPTOLOGY - ICISC 2001. 4TH INTERNATIONAL CONFERENCE. PROCEEDINGS (LECTURE NOTES IN COMPUTER SCIENCE VOL.2288) SPRINGER-VERLAG BERLIN, GERMANY, Dezember 2001 (2001-12), Seiten 440-456, XP002322028 ISBN: 3-540-43319-8 *
LABBE A ET AL: "DES-SRAM IP-core: a SRAM embedding DES feature" SOC CONFERENCE, 2003. PROCEEDINGS. IEEE INTERNATIONAL [SYSTEMS-ON-CHIP] 17-20 SEPT. 2003, PISCATAWAY, NJ, USA,IEEE, 17. September 2003 (2003-09-17), Seiten 11-14, XP010665813 ISBN: 0-7803-8182-3 *
PANATO A ET AL: "A low device occupation IP to implement Rijndael algorithm" DESIGN, AUTOMATION AND TEST IN EUROPE CONFERENCE AND EXHIBITION, 2003 MUNICH, GERMANY 3-7 MARCH 2003, LOS ALAMITOS, CA, USA,IEEE COMPUT. SOC, US, 3. März 2003 (2003-03-03), Seiten 20-25, XP010674193 ISBN: 0-7695-1870-2 *
EP1668515B8 (en) 2012-03-21 grant
DE10345454A1 (en) 2005-04-28 application
WO2005043396A3 (en) 2005-07-07 application
US20060265563A1 (en) 2006-11-23 application
EP1668515B1 (en) 2011-10-05 grant
US7451288B2 (en) 2008-11-11 grant
EP1668515A2 (en) 2006-06-14 application