Single-pass cryptographic processor and method

• US 20020191790A1
• Filed: 05/13/2002
• Published: 12/19/2002
• Est. Priority Date: 06/13/2001
• Status: Active Grant

• Current Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Original Assignee: ITT Manufacturing Enterprises, Inc. (ITT, Inc.)
• Inventors: Anand, Satish N., Bhatnagar, Hemanshu, Admusumilli, Swaroop, Parker, James Darren
• Granted Patent: US 7,266,703 B2
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 2209/20 Manipulating the length of blocks of bits, e.g. padding or block truncation
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A cryptographic processing system includes a cipher circuit and hash circuit. An input control unit and output control unit work together to process data packets in a pipelined manner wherein the data packets move through the processing system in a single-pass. The input control unit manages data received from a read interface and the initiation of cipher processing of the data in the cipher circuit. The output control unit manages data output to a write interface and the hash processing of the data in the hash circuit. Data moves through the cipher circuit in clear data and cipher data form so that the output control unit may selectively send clear data and/or cipher data to the hash circuit and to an output FIFO memory buffer, which handles final processing under the control of the output control unit prior to sending fully processed data to the write interface.

Claims

1. A cryptographic processing system, comprising:

a cipher circuit coupled for receiving incoming data;

a hash circuit coupled to receive data from the cipher circuit;

an input control circuit coupled to control the cipher circuit; and

an output control circuit coupled to control the hash circuit, wherein the input control circuit and output control circuit cooperate to coordinate cipher and/or hash operations on each of a plurality of data packets processed by the processing system.

2. The processing system of claim 1 wherein the input control circuit comprises a plurality of state machines for controlling pipeline processing of the plurality of data packets.

3. The processing system of claim 2 wherein:

each of the plurality of state machines operates in states corresponding to previous, current, and next states that each correspond to the extent of processing of the incoming data by the processing system, wherein each of the plurality of state machines is operable to switch from the current state to the previous state as the incoming data is processed by the cipher circuit;

processing of the data packet in the cipher circuit is controlled by a state machine of the plurality of state machines operating in the current state, wherein the state machine switches to the previous state after the processing of the data packet in the cipher circuit is complete; and

the state machine that switched to the previous state switches to the next state after the processing system has completed processing of the data packet.

4. The processing system of claim 1 further comprising a security association data buffer, coupled to the input control circuit and the output control circuit, for storing security association data.

5. The processing system of claim 4 further comprising an interface for receiving the security association data from an off-chip security association data cache.

6. The processing system of claim 4 further comprising a security association data cache, coupled to provide security association data to the security association data buffer, for storing security association data for at least two different security protocols.

7. The processing system of claim 6 wherein the processing system is operable to read cipher information from the cipher circuit after cipher processing of a portion of the incoming data in the cipher circuit and to store the cipher information in the security association data cache.

8. The processing system of claim 6 wherein the security association data cache comprises a on-chip data cache on the same chip as the processing system and an off-chip data cache on a different chip than the processing system.

9. The processing system of claim 7 wherein:

the cipher information comprises initialization vector or state information; and

the processing system is operable to later read the cipher information from the security association data cache and to restore the cipher information to the cipher circuit for use in additional encryption processing by the cipher circuit.

10. The processing system of claim 1 further comprising a clear register coupled to an output side of the cipher circuit and a cipher register coupled to the output side of the cipher circuit.

11. The processing system of claim 10 further comprising:

an output memory coupled to receive data from the cipher circuit; and

wherein;

(i) the clear register stores data passed through the cipher circuit without encryption processing by the cipher circuit; and

(ii) the processing system is operable to selectively send data stored in the clear register to either the hash circuit or to the output memory.

12. The processing system of claim 11 wherein the selective sending of data stored in the clear register is performed on a byte-by-byte basis.

13. The processing system of claim 10 wherein the cipher circuit is adapted to process the incoming data, using at least two different encryption algorithms, under the control of the input control circuit.

14. The processing system of claim 13 wherein the hash circuit is adapted to process data, using at least two different hash algorithms, under the control of the output control circuit.

15. The processing system of claim 14 wherein the hash circuit comprises at least two hashing sub-channels.

16. The processing system of claim 15 wherein each of the two hashing sub-channels is operable to process data using a secure hash algorithm and a message digest algorithm.

17. The processing system of claim 16 wherein the secure hash algorithm is the SHA1 algorithm and the message digest algorithm is the MD5 algorithm.

18. The processing system of claim 15 wherein the hash circuit further comprises a common hash memory, having at least two storage areas, coupled to receive the data from the cipher circuit and to provide the data to the hashing sub-channels for hash processing.

19. The processing system of claim 10 wherein the processing system is operable to selectively couple the clear register or the cipher register to the hash circuit.

20. The processing system of claim 19 further comprising:

an output memory coupled to receive data from the cipher circuit; and

wherein the processing system is further operable to selectively couple the clear register or the cipher register to the output memory.

21. The processing system of claim 20 wherein the output memory is a FIFO buffer.

22. The processing system of claim 20 wherein the output control circuit is coupled to control the output memory.

23. The processing system of claim 22 further comprising an input align/padding circuit coupled between the input memory and the cipher circuit.

24. The processing system of claim 20 wherein the input control circuit is adapted to control the selective coupling of the clear register or the cipher register to the hash circuit.

25. The processing system of claim 24 wherein the output control circuit is adapted to control the timing of the unloading of data from the clear register and the cipher register.

26. The processing system of claim 19 further comprising:

an input memory coupled to store the incoming data; and

wherein the input control circuit is coupled to control the input memory.

27. The processing system of claim 4 further comprising:

a command buffer, coupled to the input control circuit and the output control circuit, for storing a plurality of commands each corresponding to a type of cryptographic processing to be performed in the processing system; and

wherein the input control circuit and the output control circuit are operable to read the plurality of commands from the command buffer.

28. The processing system of claim 27 wherein the command buffer is operable to store a command for each of the number of pipelined stages of processing that the processing system is operable to handle.

29. The processing system of claim 27 wherein:

the input control circuit is operable to program the cipher circuit using a first command of the plurality of commands for processing a first data packet in the cipher circuit; and

the output control circuit is operable to program the hash circuit using the first command for processing the first data packet in the hash circuit.

30. The processing system of claim 29 wherein the input control circuit is operable to request incoming data for a second data packet during the processing of the first data packet in the cipher circuit.

31. The processing system of claim 30 further comprising:

an output memory coupled to receive data from the cipher circuit; and

wherein the input control circuit does not request the incoming data for the second data packet until the output control circuit signals that a previous data packet has been fully written out of the output memory.

32. The processing system of claim 31 wherein the output control circuit is operable to append a status word to outgoing data packets.

33. The processing system of claim 32 wherein the status word comprises a hash digest.

34. The processing system of claim 29 further comprising a randomizer coupled to provide a random number to the processing system for programming the cipher circuit in preparation for encryption processing.

35. The processing system of claim 1 further comprising:

a read interface coupled to the cipher circuit;

a host memory, coupled to the read interface, for providing the incoming data to the cipher circuit and receiving processed data from the cipher circuit; and

a host processor, coupled to the read interface, operable to send a processing command to the input control circuit to initiate the sending of the incoming data from the host memory to the cipher circuit.

36. The processing system of claim 35 further comprising a security association data cache for storing security association data for at least two different security protocols and coupled for providing the security association data to the cipher circuit.

37. The processing system of claim 1 further comprising:

an input memory, coupled to an input of the cipher circuit, to store the incoming data wherein the input control circuit is coupled to control the transfer of the incoming data from the input memory to the cipher circuit; and

wherein;

(i) the hash circuit is operable to calculate a message authentication code corresponding to a data packet of the plurality of data packets; and

(ii) the processing system is operable to hold a last portion of the data packet in the input memory and to append the message authentication code to the last portion of the data packet for processing in the cipher circuit.

38. The processing system of claim 37 wherein the output control circuit initiates the appending of the message authentication code to the last portion of the data packet.

39. The processing system of claim 37 wherein a portion of the input memory is operable to act as a feedback buffer for holding the last portion of the data packet.

40. The processing system of claim 37 wherein the processing in the cipher circuit of the data packet having the message authentication code appended is done to implement the transport layer security or secure sockets layer protocols.

41. The processing system of claim 37 further comprising an input align/padding circuit coupled between the input memory and the input of the cipher circuit.

42. The processing system of claim 37 wherein:

the input control circuit comprises a plurality of state machines operating in states corresponding to previous, current, and next states, wherein each of the plurality of state machines is operable to switch from the current state to the previous state as the incoming data is processed by the cipher circuit;

processing of the data packet having the message authentication code appended is controlled by a state machine of the input control circuit operating in the current state; and

the state machine operating in the current state does not switch to the previous state until after the last portion of the data packet having the message authentication code appended has completed processing in the cipher circuit.

43. A cryptographic processing system, comprising:

a cipher circuit coupled for receiving incoming data;

a clear register and a cipher register coupled to an output side of the cipher circuit;

a hash circuit coupled to receive data from the cipher circuit; and

wherein the processing system performs cipher and hash operations on each of a plurality of data packets.

44. The processing system of claim 43 further comprising:

an output memory coupled to receive data from the cipher circuit; and

wherein;

(i) the clear register stores data passed through the cipher circuit without encryption processing by the cipher circuit; and

(ii) the processing system is operable to selectively send data stored in the clear register to either the hash circuit or to the output memory.

45. The processing system of claim 44 wherein the processing system is operable to selectively send data stored in the cipher register to either the hash circuit or to the output memory.

46. The processing system of claim 45 further comprising a first multiplexer coupled between the clear register and the hash circuit and between the cipher register and the hash circuit for selecting data from the clear register or the cipher register to send to the hash circuit.

47. The processing system of claim 46 further comprising a second multiplexer coupled between the clear register and the output memory and between the cipher register and the output memory for selecting data from the clear register or the cipher register to send to the output memory.

48. The processing system of claim 44 wherein the selective sending of data stored in the clear register is performed on a byte-by-byte basis.

49. The processing system of claim 44 wherein the hash circuit comprises at least two hashing sub-channels.

50. The processing system of claim 49 wherein the hash circuit further comprises a common hash memory, having at least two storage areas, coupled to receive the data from the cipher circuit and to provide the data to the hashing sub-channels for hash processing.

51. The processing system of claim 44 further comprising a security association data cache, for storing security association data for at least two different security protocols, coupled to provide security association data to the cipher circuit and the hash circuit in preparation for cipher and hash processing.

52. The processing system of claim 51 further comprising:

a command buffer for storing a plurality of commands each corresponding to a type of cryptographic processing to be performed for a data packet in the processing system; and

wherein the processing system is operable to read the plurality of commands from the command buffer for programming the cipher circuit and hash circuit in preparation for the cipher and hash processing.

53. A cryptographic processing system, comprising:

a cipher circuit coupled for receiving incoming data;

a hash circuit coupled to receive data from the cipher circuit; and

wherein the incoming data moves through the processing system substantially in a single pass from an input side to an output side of the processing system.

54. The processing system of claim 53 further comprising a security association data cache coupled for providing security association data to the cipher circuit.

55. The processing system of claim 54 further comprising a command buffer for storing commands corresponding to encryption protocols to use in processing the incoming data.

56. The processing system of claim 54 wherein the processing system is operable to receive a command from a host processor, corresponding to a data packet in the incoming data and corresponding to an encryption protocol, and to configure the cipher circuit and the hash circuit for processing appropriate for the encryption protocol.

58. The processing system of claim 57 wherein at least a first one of the plurality of encryption processing circuits is operable to perform encryption processing using substantially the same type of encryption algorithm on data packets from each of the plurality of data packet processing channels.

59. The processing system of claim 58 wherein the first one of the plurality of encryption processing circuits is operable to perform the encryption processing on the data packets from each of the plurality of data packet processing channels substantially simultaneously.

60. The processing system of claim 59 wherein the encryption algorithm implemented by at least two of the plurality of encryption processing circuits is selected from the group consisting of the AES algorithm, the ARCFOUR or RC4 algorithm, the TDEA algorithm, and the DES algorithm.

61. The processing system of claim 59 wherein the first one of the plurality of encryption processing circuits uses time division multiplexing to handle processing for the data packets from each of the plurality of data packet processing channels.

62. The processing system of claim 59 wherein the first one of the plurality of encryption processing circuits uses multiple-stage pipelining to handle processing for the data packets from each of the plurality of data packet processing channels.

63. The processing system of claim 59 further comprising a security association data cache, for storing security association data for the different encryption algorithms, coupled to provide security association data to the cipher circuit in preparation for encryption processing.

64. The processing system of claim 63 wherein the security association data can be shared by the processing system for use in encryption processing of incoming data packets from at least two of the plurality of data packet processing channels.

65. The processing system of claim 57 wherein each of the plurality of data packet processing channels comprises:

a hash circuit coupled to a first output of the cipher circuit;

a control circuit for loading the appropriate security association data into one of the plurality of encryption processing circuits in preparation for processing of a data packet; and

an input memory, for receiving and accumulating incoming data packets, coupled to the common interface of the cipher circuit.

66. The processing system of claim 65 wherein each of the plurality of data packet processing channels further comprises an output memory coupled to a second output of the cipher circuit.

68. The cipher circuit of claim 67 wherein the common input interface is coupled to each of the plurality of encryption processing circuits using a common set of input signals.

69. The cipher circuit of claim 67 wherein the common input interface comprises a bus using time division multiplexing.

70. The cipher circuit of claim 67 further comprising a common output interface coupled to an output of each of the encryption processing circuits.

71. The cipher circuit of claim 70 wherein the common output interface is coupled to each of the plurality of encryption processing circuits using a common set of output signals.

72. The cipher circuit of claim 70 wherein the common output interface is coupled to a clear register for storing clear data and to a cipher register for storing cipher data.

73. The cipher circuit of claim 72 wherein the clear register and cipher register are each coupled to a multiplexer for selecting the clear data or the cipher data for outputting to a hash circuit.

74. The cipher circuit of claim 67 wherein the command comprises a pointer to security association data.

57. A multiple-channel cryptographic processing system for processing incoming data for a plurality of data packet processing channels, wherein each of the processing channels handles cryptographic processing for one or more data packets independently of the other channels, comprising:

a cipher circuit having a common interface for receiving incoming data packets from the plurality of data packet processing channels; and

wherein;

(i) the cipher circuit comprises a plurality of encryption processing circuits;

(ii) each of the plurality of encryption processing circuits is operable to implement an encryption algorithm;

(iii) at least two of the plurality of encryption processing circuits implement different encryption algorithms; and

(iv) the processing system is operable to route each incoming data packet to one of the plurality of encryption processing circuits appropriate for the encryption processing corresponding to the incoming data packet.

67. A cipher circuit for handling encryption processing for a plurality of incoming data packets, comprising:

a common input interface for receiving the incoming data packets; and

a plurality of encryption processing circuits, each having an input coupled to the common input interface, wherein;

(i) each of the plurality of encryption processing circuits is operable to implement an encryption algorithm;

(ii) at least two of the plurality of encryption processing circuits implement different encryption algorithms; and

(iii) the cipher circuit is operable to receive a command used to route each of the incoming data packets to one of the plurality of encryption processing circuits appropriate for the encryption processing corresponding to the incoming data packet.

75. A cipher circuit for handling encryption processing for a plurality of data packets, comprising:

an input interface for receiving the data packets; and

an encryption processing circuit having an input coupled to the input interface,

wherein the encryption processing circuit comprises a clear data pipeline and a cipher data pipeline so that clear data and cipher data corresponding to each of the data packets moves substantially in tandem through the encryption processing circuit.

76. The cipher circuit of claim 75 further comprising an output interface wherein the clear data and the cipher data are available for outputting from the output interface at substantially the same time.

77. The cipher circuit of claim 76 wherein the cipher circuit is operative to output the clear data and cipher data in the same clock cycle.

78. The cipher circuit of claim 75 wherein:

the clear data is stored in a clear register; and

the cipher data is stored in a cipher register.

79. The cipher circuit of claim 78 wherein the clear register and the cipher register are coupled to a multiplexer for selecting the clear data or the cipher data for outputting from the cipher circuit for hash processing.

80. A cryptographic processing system, comprising:

a cipher circuit coupled for receiving incoming data;

a hash circuit coupled to receive data from the cipher circuit, wherein the hash circuit comprises a first hash sub-channel and a second hash sub-channel; and

a control circuit coupled to control the hash circuit, wherein the processing system performs hash operations in the hash circuit on a plurality of data packets corresponding to the incoming data.

81. The processing system of claim 80 wherein the processing system processes incoming data for a plurality of data packet processing channels, wherein each of the processing channels handles cryptographic processing for one or more data packets independently of the other channels and wherein the hash circuit handles hash processing for one of the processing channels.

82. The processing system of claim 80 wherein:

the control circuit comprises a first controller and a second controller;

the first controller is coupled to control the first hash sub-channel; and

the second controller is coupled to control the second hash sub-channel.

83. The processing system of claim 80 further comprising a common hash memory wherein the first hash sub-channel and the second hash sub-channel are each coupled to receive data for hash processing from the common hash memory.

84. The processing system of claim 83 wherein the first hash sub-channel and the second hash sub-channel are each operable to perform hash operations using at least two different hash algorithms.

85. The processing system of claim 84 wherein the at least two different hash algorithms comprise a secure hash algorithm and a message digest algorithm.

86. The processing system of claim 85 wherein the secure hash algorithm is the SHA1 algorithm and the message digest algorithm is the MD5 algorithm.

87. The processing system of claim 83 wherein the common hash memory comprises at least two storage areas.

88. The processing system of claim 87 wherein the common hash memory is operable to receive and store data from the cipher circuit into a first storage area of the at least two storage areas.

89. The processing system of claim 88 wherein the common hash memory is operable to receive and store data from the cipher circuit into a second storage area of the at least two storage areas while data stored in the first storage area is being hashed.

90. The processing system of claim 88 wherein the data stored in the first storage area and the data stored in the second storage area each correspond to a common data packet.

91. A cryptographic processing system, comprising:

a cipher circuit coupled for receiving a plurality of incoming data packets;

a hash circuit coupled to receive data from the cipher circuit for hash processing;

a first control circuit coupled to control the cipher circuit; and

wherein;

(i) the first control circuit comprises a plurality of controllers each for controlling a different one of the incoming data packets;

(ii) each of the plurality of controllers is operable to rotate through a next state, a current state, and a prior state for controlling the incoming data packets in a data packet pipeline.

92. The processing system of claim 91 wherein the first control circuit is operable to permit only one of the plurality of controllers to be in the current state at any given time.

93. The processing system of claim 92 wherein the current state corresponds to processing in the cipher circuit.

94. The processing system of claim 93 wherein the previous state corresponds to processing in the hash circuit.

95. The processing system of claim 94 wherein the prior state corresponds to a data packet waiting in the data packet pipeline prior to processing in the cipher circuit.

96. The processing system of claim 91 further comprising a second control circuit coupled to control the hash circuit, wherein the first control circuit and the second control circuit cooperate to coordinate cipher and/or hash operations on each of the plurality of incoming data packets.

97. The processing system of claim 96 wherein the second control circuit comprises at least two controllers each for independently controlling the hash operations for at least two of the incoming data packets wherein the at least two controllers are each coupled to the first control circuit.