Parallel encryption/decryption

• US 8,355,499 B2
• Filed: 12/12/2008
• Issued: 01/15/2013
• Est. Priority Date: 12/12/2008
• Status: Active Grant

• Current Assignee: Micron Technology, Inc.
• Original Assignee: Micron Technology, Inc.
• Inventors: Asnaashari, Mehdi, Sarno, Robin
• Primary Examiner(s): Patel, Nirav B
• Application Number:
  US12/333,822
• Publication Number:
  US 20100153747A1
• Time in Patent Office: 1,495 Days
• Field of Search: 380 28- 30, 380/37, 380 42- 44, 713/193
• US Class Current: 380/28
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]

Abstract

The present disclosure includes methods and devices for parallel encryption/decryption. In one or more embodiments, an encryption/decryption device includes an input logic circuit, an output logic circuit, and a number of encryption/decryption circuits arranged in parallel between the input logic circuit and the output logic circuit. For example, each encryption/decryption circuit can be capable of processing data at an encryption/decryption rate, and the number of encryption/decryption circuits can be equal to or greater than an interface throughput rate divided by the encryption/decryption rate.

Claims

1. An encryption/decryption device, comprising

an input logic circuit;

an output logic circuit; and

a number of encryption/decryption circuits arranged in parallel between the input logic circuit and the output logic circuit, each encryption/decryption circuit being capable of processing data at a respective encryption/decryption rate,

wherein initialization vectors are combined with a first number of groups parsed from an input data stream to each parallel encryption/decryption circuit, the initialization vectors are incremented for a first parallel encryption/decryption circuit, and the incremented initialization vectors are used as initialization vectors for a second parallel encryption/decryption circuit, and

wherein the number of encryption/decryption circuits is equal to or greater than an interface throughput rate divided by the encryption/decryption rate, and the input logic circuit operates to parse an input data stream into a number of groups, and distribute the number of groups to at least some of the number of encryption/decryption circuits according to a distribution order.

2. The encryption/decryption device of claim 1, wherein the distribution order is a round robin sequence.

3. The encryption/decryption device of claim 1, wherein each encryption/decryption circuit includes:

at least one input buffer;

at least one output buffer; and

an encryption/decryption engine coupled between the input buffer and the output buffer,

wherein the encryption/decryption engine is configured to process data a group at a time.

4. The encryption/decryption device of claim 3, wherein the group consists of 128 bits.

5. The encryption/decryption device of claim 4, wherein the encryption/decryption engine operates to process the group of data according to an advanced encryption/decryption standard (AES) algorithm.

6. The encryption/decryption device of claim 5, wherein the encryption/decryption engine operates to process the group of data according to the AES algorithm in an electronic code book mode.

7. The encryption/decryption device of claim 5, wherein the encryption/decryption engine operates to process the group of data according to an AES algorithm in a cipher block chaining mode.

8. The encryption/decryption device of claim 3, wherein each encryption/decryption engine is configured to receive a key, and wherein a key received by one of the encryption/decryption engines is different than a key received by another one of the encryption/decryption engines.

9. The encryption/decryption device of claim 3, wherein each encryption/decryption engine is configured to receive a same key as another encryption/decryption engine.

10. The encryption/decryption device of claim 3, wherein the output logic circuit operates to assemble groups from encryption/decryption circuit outputs into an encrypted output data stream corresponding to an arrangement of the input data stream.

11. The encryption/decryption device of claim 3, wherein each of the at least one input buffer and the at least one output buffer is configured to store a group of data.

12. The encryption/decryption device of claim 1, wherein at least one encryption/decryption circuit is capable of processing data at a respective encryption/decryption rate that is substantially different from another one of the number of encryption/decryption circuits.

13. The encryption/decryption device of claim 1, wherein the number of encryption/decryption circuits is less than an interface throughput rate divided by the encryption/decryption rate.

14. A solid state memory system, comprising

at least one memory device;

and

a controller communicatively coupled to the at least one memory device, and having an encryption/decryption device, the encryption/decryption device including;

a input multiplexer;

an output multiplexer; and

a number of encryption/decryption circuits arranged in parallel between the input multiplexer and the output multiplexer, each encryption/decryption circuit being capable of processing data at a respective encryption/decryption rate,

wherein the number of encryption/decryption circuits is equal to or greater than an interface throughput rate divided by the encryption/decryption rate, and

wherein initialization vectors are combined with a first number of groups parsed from an input data stream to each parallel encryption/decryption circuit, the initialization vectors are incremented for a first parallel encryption/decryption circuit, and the incremented initialization vectors are used as initialization vectors for a second parallel encryption/decryption circuit,

wherein the input multiplexer operates to parse an input data stream into a number of groups, and distribute the number of groups to at least some of the number of encryption/decryption circuits according to a distribution order.

15. The solid state memory system of claim 14, wherein:

the interface throughput rate is P bits per second;

the encryption/decryption rate is an uppermost rate of E bits per second; and

the number of encryption/decryption circuits is equal to or greater than P divided by E.

16. The solid state memory system of claim 15, wherein the number of encryption/decryption circuits is equal to P divided by E.

17. The solid state memory system of claim 14, wherein the interface throughput rate corresponds to a SATA specification data rate and each encryption/decryption circuit is configured to process data at an uppermost rate of at least 75 MB per second.

18. The solid state memory system of claim 17, wherein the interface throughput rate is 300 MB/s and four encryption/decryption circuits are arranged in parallel.

19. The solid state memory system of claim 17, wherein the interface throughput rate is 600 MB/s and eight encryption/decryption circuits arranged in parallel.

20. The solid state memory system of claim 17, wherein the number of encryption/decryption circuits is equal to P divided by E, plus one.

21. A memory controller, comprising

a host interface configured to be communicatively coupled to a host through a communication interface having a throughput rate;

a front end direct memory access (DMA) communicatively coupled to the host interface;

a number of back end memory channels communicatively coupled to the front end DMA; and

an encryption/decryption device communicatively coupled between the host interface and the number of back end memory channels, the encryption/decryption device including a number of encryption/decryption circuits arranged in parallel, each encryption/decryption circuit being capable of processing data at an encryption/decryption rate,

wherein the number of parallel encryption/decryption circuits is at least the throughput rate divided by the encryption/decryption rate, and

wherein initialization vectors are combined with a first number of groups parsed from an input data stream to each parallel encryption/decryption circuit, the initialization vectors are incremented for a first parallel encryption/decryption circuit, and the incremented initialization vectors are used as initialization vectors for a second parallel encryption/decryption circuit, and

wherein the encryption/decryption device is configured to parse an input data stream into a number of groups, and distribute the number of groups to at least some of the number of encryption/decryption circuits according to a distribution order.

22. A encryption/decryption method, comprising

parsing an input data stream into a number of groups, the input data stream having an interface uppermost throughput rate;

and

distributing the number of groups in a round robin sequence among a number of parallel encryption/decryption circuits operating in an electronic codebook mode, one group being distributed per each selection of a particular encryption/decryption circuit in the round robin sequence; and

processing a particular group at a time through one of the number of parallel encryption/decryption circuits at an encryption/decryption rate,

wherein the number of parallel encryption/decryption circuits is at least the uppermost throughput rate divided by the encryption/decryption rate, and

wherein initialization vectors are combined with a first number of groups parsed from an input data stream to each parallel encryption/decryption circuit, the initialization vectors are incremented for a first parallel encryption/decryption circuit, and the incremented initialization vectors are used as initialization vectors for a second parallel encryption/decryption circuit.

23. The encryption/decryption method of claim 22, wherein the round robin sequence excludes at least one of the number of parallel encryption/decryption circuits.

24. The encryption/decryption method of claim 22, wherein the number of groups are distributed to the number of parallel encryption/decryption circuits such that transfer of a next group to a particular encryption/decryption circuit is completed just as processing of the preceding group by the encryption/decryption circuit is completed.

25. The encryption/decryption method of claim 22, wherein the encryption/decryption circuit implements an Advanced Encryption Standard (AES) algorithm in electronic code book mode.

26. The encryption/decryption method of claim 25, wherein an encrypted output of each respective parallel encryption/decryption circuit is combined with a second number of groups to each respective parallel encryption/decryption circuit.

27. The encryption/decryption method of claim 26, wherein initialization vectors are combined with a first group to each parallel encryption/decryption circuit, and an encrypted output from a preceding group of each parallel encryption/decryption circuit is combined with a succeeding group to each respective parallel encryption/decryption circuit.

28. The encryption/decryption method of claim 26, wherein initialization vectors to each parallel encryption/decryption circuits are a hashed version of a logical block address (LBA) of a sector for a particular data packet being encrypted.

29. The encryption/decryption method of claim 28, including extending the LBA by a number of bits, and the number of bits are included in the hashed version of the LBA used for the initialization vectors.

30. The encryption/decryption method of claim 22, wherein:

the number of groups are distributed among N parallel encryption/decryption circuits;

distributing one of the number of groups to an encryption/decryption circuit takes T clock cycles; and

processing one of the number of groups at a time through an encryption/decryption circuit takes N times T clock cycles.

31. The encryption/decryption method of claim 30, wherein N equals 4, and T equals 4.

32. The encryption/decryption method of claim 22, including assembling the number of groups into an output data stream after processing from among the number of parallel encryption/decryption circuits sequentially in the round robin sequence in a same order by which the number of groups were distributed.

33. A encryption/decryption method, comprising

parsing an input data stream into a number of groups, the input data stream having an interface uppermost throughput rate;

and

distributing the number of groups in a round robin sequence among a number of parallel encryption/decryption circuits operating in a cipher block chaining mode, a plurality of the groups being distributed per each selection of a particular encryption/decryption circuit in the round robin sequence;

processing one group of the plurality of groups at a time through one of the number of parallel encryption/decryption circuits at an encryption/decryption rate

combining initialization vectors with a first number of groups to each parallel encryption/decryption circuit;

incrementing the initialization vectors for a first parallel encryption/decryption circuit; and

using the incremented initialization vectors as initialization vectors for a second parallel encryption/decryption circuit,

wherein the number of parallel encryption/decryption circuits is at least the uppermost throughput rate divided by the encryption/decryption rate.

34. The encryption/decryption method of claim 33, wherein the number of groups are distributed to the number of parallel encryption/decryption circuits such that transfer of a next plurality of groups to a particular encryption/decryption circuit is completed just as processing of a preceding plurality of groups by the encryption/decryption circuit is completed.

35. The encryption/decryption method of claim 33, wherein:

the encryption/decryption circuit implements an Advanced Encryption Standard (AES) algorithm in cipher block chaining mode, and

four groups are distributed per each selection of a particular encryption/decryption circuit in the round robin sequence.