Encryption key management system for an integrated circuit

• US 5,687,237 A
• Filed: 11/13/1995
• Issued: 11/11/1997
• Est. Priority Date: 11/13/1995
• Status: Expired due to Term

• Current Assignee: Pitney Bowes Incorporated (Böwe Systec AG)
• Original Assignee: Pitney Bowes Incorporated (Böwe Systec AG)
• Inventors: Naclerio, Edward J.
• Primary Examiner(s): Cain, David C.
• Application Number:
  US08/556,685
• Time in Patent Office: 729 Days
• Field of Search: 380/21, 380/23, 380/25, 380/49, 380/29, 380/45
• US Class Current: 380/29
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A microcontroller is in bus communication with an improved integrated circuit for providing data to the integrated circuit and reading data from the integrated circuit. The integrated circuit selectively processes data by encrypting or decrypting the data. The integrated circuit includes a data register for receiving data from the microcontroller via the data bus and storing the data. A DES key register is also provided for receiving and storing a key (Ks) from the controller via the data bus and a DES control register is provided for receiving and storing control signal from the controller via the data bus. The integrated circuit has a digital encryption engine module for reading the data from the data register and the DES key register in response to specific control signal stored in as DES control register and for processing the data utilizing the key (Ks) and outputting the encrypted data. A second DES key register (Kv) isolated from the data bus stores second key(Kv). A multiplexer is used for selectively enabling the first DES key (Ks) from the DES Key register or the second DES key (Kv) from the second DES Key register in response to the data in the DES control register. In addition, a internal key register stories an internal key (Ki) and a results register is provided for storing the processed data and directing the processed data to the data bus. A demultiplexer is for receiving the processed data from the DES engine and directing the processed data to the internal key register or the results register allow as a further alternative use of the internal key to encrypt or decrypt data.

Claims

1. An improved integrated circuit for selectively processing data by encrypting or decrypting said data having:

a data bus,

a controller in bus communication with said integrated circuit via said data bus for providing data to said integrated circuit and reading data from said integrated circuit,

a data register for receiving data from said controller via said data bus and storing said data,

a DES key register for receiving and storing first key data (Ks) from said controller via said data bus,

a DES control register for receiving and storing control signal from said controller via said data bus,

an encryption engine module for reading said data from said data register and said DES key register in response to a specific control signal stored in as DES control register and for processing said data utilizing said first key data (Ks) and outputting said processed data,

wherein the improvement comprises;

said integrated circuit further having,

a second DES key register (Kv) isolated from said data bus and having stored therein a second key data (Kv),

first selection means for selecting a selected key data from said first key data (Ks) in said DES Key register or said second key data (Kv) in said second DES Key register in response to said data in said DES control register and directing said selected key data to said encryption engine module.

2. An improved integrated circuit as claimed in claim 1 wherein said encryption engine module includes means for selectively processing said data by encrypting said data or decrypting said data in response to said control signal stored in said DES control register.

3. An improved integrated circuit as claimed in claim 2 further comprising:

a internal key register for storing an internal key (Ki) data

a results register for storing said processed data and directing said processed data to said data bus,

second selection means for receiving said processed data from said encryption engine module and directing said processed data to said internal key register or said results register.

4. An improved integrated circuit as claimed in claim 3 wherein said first selection means further comprises means from receiving said internal key (Ki) data stored in said internal key register and selectively directing said internal key (Ki) to said encryption engine module in response to said control signals in said DES control register.

5. An improved integrated circuit as claimed in claim 4 further comprising means for causing said second selection means to direct said output of said DES engine to said internal key register when said first selection means selects said second key data (Kv) in response to said control signals.