Method and System for High Throughput Blockwise Independent Encryption/Decryption

• US 20070237327A1
• Filed: 03/22/2007
• Published: 10/11/2007
• Est. Priority Date: 03/23/2006
• Status: Active Grant

• Current Assignee: Ip Reservoir, LLC
• Original Assignee: Exegy Incorporated
• Inventors: White, Jason, Taylor, David, Chamberlain, Roger, Indeck, Ronald
• Granted Patent: US 8,379,841 B2
• Time in Patent Office: Days
• US Class Current: 380/37
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

An encryption technique is disclosed for encrypting a data segment comprising a plurality of data blocks, wherein the security and throughput of the encryption is enhanced by using blockwise independent bit vectors for reversible combination with the data blocks prior to key encryption. Preferably, the blockwise independent bit vectors are derived from a data tag associated with the data segment. Several embodiments are disclosed for generating these blockwise independent bit vectors. In a preferred embodiment, the data tag comprises a logical block address (LBA) for the data segment. Also disclosed herein is a corresponding decryption technique as well as a corresponding symmetrical encryption/decryption technique.

Claims

1. A method of encrypting a plurality of data blocks, each data block comprising a plurality of data bits, the method comprising;

combining each data block with a corresponding bit vector using a reversible combinatorial operation to thereby create a plurality of data block-bit vector combinations; and

encrypting each data block-bit vector combination using a key encryption operation; and

wherein each bit vector has a value that is independent of all key encryption operations that were previously performed on the data block-bit vector combinations created from the other data blocks of the plurality of data blocks.

2. The method of claim 1 wherein the plurality of data blocks are part of a data segment, the method further comprising:

generating each bit vector based at least in part upon a data tag associated with the data segment.

3. The method of claim 2 wherein the generating step further comprises (1) seeding a pseudo-random number generator with the data tag to generate a plurality of pseudo-random outputs, and (2) generating a plurality of the bit vectors corresponding to the data blocks based at least in part upon the pseudo-random outputs.

4. The method of claim 3 wherein the combining step comprises, combining a first data block of the data segment with the data tag using the reversible combinatorial operation.

5. The method of claim 4 wherein the step of generating the bit vectors comprises incrementing the bit vector used for a previous data block of the data segment by one of the pseudo-random outputs to generate the bit vector to be combined with a next data block of the data segment.

6. The method of claim 3 wherein the step of generating the bit vectors corresponding to the data blocks based at least in part upon the pseudo-random outputs comprises using the pseudo-random outputs as a plurality of the bit vectors.

7. The method of claim 2 wherein the generating step further comprises seeding a linear feedback shift register with the data tag to generate a plurality of the bit vectors.

8. The method of claim 2 wherein the generating step further comprises seeding a feedback counter with the data tag to generate a plurality of the bit vectors.

9. The method of claim 8 wherein the seeding step further comprises providing a constant increment to the feedback counter.

10. The method of claim 8 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, and wherein the generating step comprises, prior to processing a data block of the subset, (1) calculating a data tag value such that the data tag is uniquely associated with the data block of the subset, and (2) seeding the feedback counter with the calculated data tag.

11. The method of claim 2 wherein the data tag comprises a logical block address (LBA) for the data segment.

12. The method of claim 3 further comprising:

storing the encrypted data block-bit vector combinations on a disk at the LBA.

13. The method of claim 2 wherein the data tag comprises a file identifier associated with the data segment.

14. The method of claim 2 wherein the data tag comprises a physical memory address associated with the data segment.

15. The method of claim 2 wherein the data segment comprises network data traffic, and wherein the data tag comprises a packet sequence number associated with the data segment.

16. The method of claim 2 wherein the data segment has a plurality of associated data tags, wherein each data tag is uniquely associated with a different one of the data segment'"'"'s data blocks, the method further comprising:

generating the bit vectors based at least in part upon the plurality of data tags.

17. The method of claim 2 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, and wherein the generating step comprises, prior to processing a data block of the subset, cycling through and discarding any bit vectors corresponding to data blocks within the data segment that are not within the subset and that are prior to the data blocks within the subset.

18. The method of claim 1 wherein a plurality of the bit vectors comprise randomized bit vectors.

19. The method of claim 1 wherein each bit vector has a different value.

20. The method of claim 1 wherein the data segment comprises network data traffic.

21. The method of claim 1 further comprising:

combining each encrypted data block-bit vector combination with corresponding bit vector using a reversible combinatorial operation.

22. The method of claim 21 wherein the corresponding bit vector for each encrypted data block-bit vector combination is the same bit vector that was combined with the data block from which that encrypted data block-bit vector combination was created.

23. The method of claim 21 further comprising:

encrypting each encrypted data block-bit vector-bit vector combination using a key encryption operation.

24. The method of claim 1 wherein the reversible combinatorial operation comprises an XOR operation.

25. The method of claim 1 further comprising:

performing all of the method steps with reconfigurable logic.

26. The method of claim 1 further comprising:

performing all of the method steps with an application specific integrated circuit (ASIC).

27. A system for encrypting a plurality of data blocks, each data block comprising a plurality of data bits, the system comprising:

a bit vector generation stage configured to generate a plurality of blockwise independent bit vectors;

a reversible combinatorial operation stage configured to reversibly combine each data block with a corresponding one of the generated bit vectors to in turn generate a plurality of data block-bit vector combinations; and

an encryption stage configured to perform an encryption operation on the data block-bit vector combinations.

28. The system of claim 27 wherein the reversible combinatorial operation stage is further configured to sequentially reversibly combine each data block with its corresponding bit vector to generate the plurality of data block-bit vector combinations.

29. The system of claim 28 wherein the encryption stage is further configured to sequentially perform the key encryption operation on the data block-bit vector combinations.

30. The system of claim 27 further comprising a second reversible combinatorial operation stage configured to reversibly combine each encrypted data block-bit vector combination with the bit vector used to generate the data block-bit vector combination corresponding to that encrypted data block-bit vector combination.

31. The system of claim 27 wherein the bit vector generation stage is further configured to generate a plurality of randomized blockwise independent bit vectors.

32. The system of claim 27 wherein the plurality of data blocks are part of a data segment, and wherein the bit vector generation stage is further configured to generate the plurality of blockwise independent bit vectors based at least in part upon a data tag associated with the data segment.

33. The system of claim 32 wherein the bit vector generation stage comprises a pseudo-random number generator that is seeded by the data tag, and wherein the bit vector generation stage is further configured to generate a plurality of the bit vectors based at least in part upon a plurality of pseudo-random number outputs of the pseudo-random number generator.

34. The system of claim 33 wherein the bit vector generation stage is configured to output the pseudo-random number outputs as a plurality of the bit vectors.

35. The system of claim 33 wherein the data tag comprises a logical block address (LBA) for the data segment.

36. The system of claim 33 wherein the bit vector generation stage further comprises an adder for adding a pseudo-random number output of the pseudo-random number generator with a blockwise independent bit vector that was reversibly combined with a previous data block to thereby generate a current blockwise independent bit vector for reversible combination with a current data block.

37. The system of claim 32 wherein the bit vector generation stage comprises a linear feedback shift register (LFSR) that is seeded by the data tag to generate a plurality of the plurality blockwise independent bit vectors.

38. The system of claim 32 wherein the bit vector generation stage comprises a feedback counter that is seeded by the data tag and is configured to receive as a feedback input a previous blockwise independent bit vector to thereby generate a plurality of the plurality of blockwise independent bit vectors.

39. The system of claim 37 wherein the feedback counter is further configured to receive as an input a constant increment value therefor.

40. The system of claim 39 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, the system further comprising a data tag initialization stage that is configured to, prior to the reversible combinatorial operation stage processing a data block of the subset, (1) calculate a data tag value such that the data tag is uniquely associated with the data block of the subset, and (2) seed the feedback counter with the calculated data tag.

41. The system of claim 39 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, wherein the bit vector generation stage is further configured to, prior to the reversible combinatorial operation stage processing a data block of the subset, (1) calculate a data tag value such that the data tag is uniquely associated with the data block of the subset, and (2) seed the feedback counter with the calculated data tag.

42. The system of claim 32 wherein the bit vector generation stage comprises means for generating the plurality of bit vectors.

43. The system of claim 32 wherein the data tag comprises a file identifier associated with the data segment.

44. The system of claim 32 wherein the data tag comprises a physical memory address associated with the data segment.

45. The system of claim 32 wherein the data segment comprises network data traffic, and wherein the data tag comprises a packet sequence number associated with the data segment.

46. The system of claim 32 wherein the data segment has a plurality of associated data tags, wherein each data tag is uniquely associated with a different one of the data segment'"'"'s data blocks, and wherein the bit vector generation stage is further configured to generate the plurality of blockwise independent bit vectors based at least in part upon the plurality of data tags.

47. The system of claim 32 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, and wherein the bit vector generation stage is further configured to, prior to processing a data block of the subset, cycle through and discard any bit vectors corresponding to data blocks within the data segment that are not within the subset and that are prior to the data blocks within the subset.

48. The system of claim 27 further comprising:

a second reversible combinatorial operation stage configured to reversibly combine each encrypted data block-bit vector combination with a different one of the bit vectors to generate a plurality of encrypted data block-bit vector-bit vector combinations; and

a second encryption stage configured to perform an encryption operation on the encrypted data block-bit vector-bit vector combinations.

49. The system of claim 27 wherein each bit vector has a different value.

50. The system of claim 27 wherein the reversible combinatorial operation stage comprises XOR logic.

51. The system of claim 27 wherein the bit vector generation stage, the reversible combinatorial operation stage, and the block cipher key encryption stage are deployed in hardware.

52. The system of claim 51 wherein the hardware comprises a reconfigurable logic device.

53. The system of claim 52 wherein the bit vector generation stage, the reversible combinatorial operation stage, and the block cipher key encryption stage are deployed as a firmware pipeline on the reconfigurable logic device.

54. The system of claim 51 wherein the hardware comprises an application specific integrated circuit (ASIC).

55. The system of claim 51 wherein the hardware comprises part of a RAID controller.

56. The system of claim 27 further comprising a plurality of reversible combinatorial operation stages and a plurality of the encryption stages arranged in a plurality of parallel pipelines, each pipeline comprising a reversible combinatorial operation stage and an encryption stage, thereby allowing the data blocks to processed through the pipelines in parallel with each other.

57. The system of claim 56 wherein the bit vector generation stage is configured to provide the same bit vectors to each of the pipelines.

58. The system of claim 56 wherein each pipeline further comprises a bit vector generation stage.

59. A system for encrypting a stream of data blocks, each data block comprising a plurality of data bits, the system comprising:

a randomizer circuit for randomizing a plurality of the data blocks prior to encryption independently of the other data blocks; and

an encryptor circuit for encrypting each of the randomized data blocks.

60. The system of claim 59 wherein the randomizer circuit is further configured to randomize a plurality of the data blocks based at least in part upon a data tag associated with the data blocks.

61. The system of claim 60 wherein the randomizer circuit comprises a pseudo-random number generator that is seeded by the data tag, and wherein the randomizer circuit is further configured to generate a plurality of blockwise independent bit vectors for use to randomize a plurality of the data blocks based at least in part upon a plurality of pseudo-random number outputs of the pseudo-random number generator.

62. The system of claim 61 wherein the randomizer circuit further comprises an adder for adding a pseudo-random number output of the pseudo-random number generator with a blockwise independent bit vector that was used to randomize a previous data block to thereby generate a current blockwise independent bit vector for use to randomize a current data block.

63. The system of claim 61 wherein the randomizer circuit is further configured to output the pseudo-random number outputs as a plurality of the bit vectors.

64. The system of claim 60 wherein the randomizer circuit comprises a linear feedback shift register (LFSR) that is seeded by the data tag to generate a plurality blockwise independent bit vectors for use to randomize a plurality of the data blocks.

65. The system of claim 60 wherein the randomizer circuit comprises a feedback counter that is seeded by the data tag and is configured to receive as a feedback input a previous blockwise independent bit vector to thereby generate a plurality of the plurality of blockwise independent bit vectors for use to randomize a plurality of the data blocks.

66. The system of claim 65 wherein the feedback counter is further configured to receive as an input a constant increment value therefor.

67. The system of claim 66 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, the system further comprising calculation circuit that is configured to, prior to the randomizer circuit processing a data block of the subset, (1) calculate a data tag value such that the data tag is uniquely associated with the data block of the subset, and (2) seed the feedback counter with the calculated data tag.

68. The system of claim 66 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, wherein the randomizer circuit is further configured to, prior to processing a data block of the subset, (1) calculate a data tag value such that the data tag is uniquely associated with the data block of the subset, and (2) seed the feedback counter with the calculated data tag.

69. The system of claim 60 wherein the randomizer circuit comprises means for generating a plurality of blockwise independent bit vectors for use to randomize a plurality of the data blocks.

70. A method of decrypting a plurality of encrypted data block-bit vector combinations of a data segment, the data segment comprising a plurality of encrypted data block-bit vector combinations, each encrypted data block-bit vector combination comprising a plurality of data bits, the method comprising:

decrypting a plurality of the encrypted data block-bit vector combinations using a decryption operation to thereby generate a plurality of decrypted data block-bit vector combinations; and

combining each decrypted data block-bit vector combination with a corresponding bit vector using a reversible combinatorial operation to thereby create a plurality of decrypted data blocks; and

wherein each bit vector has a value that is independent of all decryption operations that were previously performed on the encrypted data block-bit vector combinations for the data segment, and wherein each corresponding bit vector is the same bit vector that was reversibly combined with the data block from which the encrypted data block-bit vector combination was derived during encryption thereof.

71. The method of claim 70 further comprising:

generating each bit vector based at least in part upon a data tag associated with the data segment.

72. The method of claim 71 wherein the generating step further comprises (1) seeding a pseudo-random number generator with the data tag to generate a plurality of pseudo-random outputs, and (2) generating a plurality of the bit vectors based at least in part upon the pseudo-random outputs.

73. The method of claim 72 wherein the step of generating the bit vectors comprises incrementing the bit vector used for a previous data block of the data segment by one of the pseudo-random outputs to generate the bit vector to be combined with a next data block of the data segment.

74. The method of claim 72 wherein the step of generating the bit vectors corresponding to the data blocks based at least in part upon the pseudo-random outputs comprises using the pseudo-random outputs as a plurality of the bit vectors.

75. The method of claim 71 wherein the generating step further comprises seeding a linear feedback shift register with the data tag to generate a plurality of the bit vectors.

76. The method of claim 71 wherein the generating step further comprises seeding a feedback counter with the data tag to generate a plurality of the bit vectors.

77. The method of claim 76 wherein the seeding step further comprises providing a constant increment to the feedback counter.

78. The method of claim 77 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, and wherein the generating step comprises, prior to processing a data block of the subset, (1) calculating a data tag value such that the data tag is uniquely associated with the data block of the subset, and (2) seeding the feedback counter with the calculated data tag.

79. The method of claim 71 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, and wherein the generating step comprises, prior to processing a data block of the subset, cycling through and discarding any bit vectors corresponding to data blocks within the data segment that are not within the subset and that are prior to the data blocks within the subset.

80. The method of claim 70 wherein the data segment comprises a sequence of encrypted data blocks, and wherein the plurality of encrypted data blocks decrypted during the decrypting step comprise any arbitrary subset of all of the encrypted data blocks of the data segment.

81. A system for decrypting a plurality of encrypted data block-bit vector combinations of a data segment, the data segment comprising a plurality of encrypted data block-bit vector combinations, each encrypted data block-bit vector combination comprising a plurality of data bits, the system comprising:

a bit vector generation stage configured to generate a plurality of blockwise independent bit vectors;

a decryption stage configured to perform a decryption operation on a plurality of the encrypted data block-bit vector combinations to thereby generate a plurality of decrypted data block-bit vector combinations; and

a reversible combinatorial operation stage configured to reversibly combine each decrypted data block-bit vector combination with a corresponding one of the bit vectors to generate a plurality of decrypted data blocks; and

wherein each corresponding bit vector is the same bit vector that was reversibly combined with the data block from which the encrypted data block-bit vector combination was derived during encryption thereof.

82. The system of claim 81 wherein the bit vector generation stage is further configured to generate the plurality of blockwise independent bit vectors based at least in part upon a data tag associated with the data segment.

83. The system of claim 82 wherein the bit vector generation stage comprises a pseudo-random number generator that is seeded by the data tag, and wherein the bit vector generation stage is further configured to generate a plurality of the bit vectors based at least in part upon a plurality of pseudo-random number outputs of the pseudo-random number generator.

84. The system of claim 83 wherein the bit vector generation stage further comprises an adder for adding a pseudo-random number output of the pseudo-random number generator with a blockwise independent bit vector that was reversibly combined with a previous data block to thereby generate a current blockwise independent bit vector for reversible combination with a current data block.

85. The system of claim 83 wherein the bit vector generation stage is further configured to output the pseudo-random number outputs as a plurality of the bit vectors.

86. The system of claim 82 wherein the bit vector generation stage comprises a linear feedback shift register (LFSR) that is seeded by the data tag to generate a plurality of the plurality blockwise independent bit vectors.

87. The system of claim 82 wherein the bit vector generation stage comprises a feedback counter that is seeded by the data tag and is configured to receive as a feedback input a previous blockwise independent bit vector to thereby generate a plurality of the plurality of blockwise independent bit vectors.

88. The system of claim 87 wherein the feedback counter is further configured to receive as an input a constant increment value therefor.

89. The system of claim 88 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, the system further comprising a data tag initialization stage that is configured to, prior to the reversible combinatorial operation stage processing a data block of the subset, (1) calculate a data tag value such that the data tag is uniquely associated with the data block of the subset, and (2) seed the feedback counter with the calculated data tag.

90. The system of claim 88 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, wherein the bit vector generation stage is further configured to, prior to the reversible combinatorial operation stage processing a data block of the subset, (1) calculate a data tag value such that the data tag is uniquely associated with the data block of the subset, and (2) seed the feedback counter with the calculated data tag.

91. The system of claim 82 wherein the bit vector generation stage comprises means for generating the plurality of bit vectors.

92. The system of claim 82 wherein the plurality of data blocks to be encrypted comprises a subset of the data blocks within the data segment, and wherein the bit vector generation stage is further configured to, prior to processing a data block of the subset, cycle through and discard any bit vectors corresponding to data blocks within the data segment that are not within the subset and that are prior to the data blocks within the subset.

93. The system of claim 81 wherein the decryption stage is further configured to perform the decryption operation on any arbitrary subset of the encrypted data block-bit vector combinations without requiring decryption of any encrypted data block-bit vector combinations that is not a member of the arbitrary subset.

94. The system of claim 82 further comprising a plurality of reversible combinatorial operation stages and a plurality of the decryption stages arranged in a plurality of parallel pipelines, each pipeline comprising a reversible combinatorial operation stage and a decryption stage, thereby allowing the data blocks to processed through the pipelines in parallel with each other.

95. The system of claim 94 wherein the pipelines are deployed on at least one of the group consisting of a reconfigurable logic device and an application specific integrated circuit (ASIC).

96. A method for symmetrically encrypting/decrypting a plurality of data blocks of a data segment, each data block comprising a plurality of data bits, the method comprising:

receiving a plurality of the data blocks of the data segment;

reversibly combining each of the received data blocks with a corresponding bit vector to thereby generate a plurality of data block-bit vector combinations;

performing a block cipher operation on each of the data block-bit vector combinations to thereby generate a plurality of block ciphered data block-bit vector combinations; and

reversibly combining each of the block ciphered data block-bit vector combinations with a corresponding bit vector to thereby generate a plurality of encrypted/decrypted data blocks; and

wherein the bit vectors possess values that are independent of the block cipher operations performed on the different data block-bit vector combinations.

97. The method of claim 96 further comprising:

generating the bit vectors based at least in part upon a data tag associated with the data segment.

98. The method of claim 97 wherein the step of reversibly combining each of the block ciphered data block-bit vector combinations with a corresponding bit vector comprises reversibly combining each block ciphered data block-bit vector combination with the same bit vector value that was reversibly combined with the data block from which that block ciphered data block-bit vector combination was generated.

99. The method of claim 98 further comprising:

synchronizing a delivery of the bit vectors to the step of reversibly combining each of the block ciphered data block-bit vector combinations with a corresponding bit vector to account for a latency of the block cipher operation performing step.

100. The method of claim 96 wherein the receiving step comprises receiving only a defined subset of the data blocks of the data segment.

101. A system for symmetrically encrypting/decrypting a plurality of data blocks of a data segment, each data block comprising a plurality of data bits, the system comprising:

a first reversible combinatorial operation circuit that is configured to receive a plurality of the data blocks of the data segment and reversibly combine each of the received data blocks with a corresponding bit vector to thereby generate a plurality of data block-bit vector combinations;

a block cipher operation circuit in communication with the first reversible combination operation circuit, wherein the block cipher operation circuit is configured to perform a block cipher operation on each of the data block-bit vector combinations to thereby generate a plurality of block ciphered data block-bit vector combinations; and

a second reversible combinatorial operation circuit in communication with the block cipher operation circuit, wherein the second reversible combinatorial operation circuit is configured to reversibly combine each of the block ciphered data block-bit vector combinations with a corresponding bit vector to thereby generate a plurality of encrypted/decrypted data blocks; and

wherein the bit vectors possess values that are independent of the block cipher operations performed on the different data block-bit vector combinations.

102. The system of claim 101 further comprising:

a bit vector generation circuit for generating the bit vectors based at least in part upon a data tag associated with the data segment.

103. The system of claim 102 wherein the second reversible combinatorial operation circuit is further configured to reversibly combine each block ciphered data block-bit vector combination with the same bit vector value that was reversibly combined with the data block from which that block ciphered data block-bit vector combination was generated.

104. The system of claim 103 wherein the bit vector generation circuit is further configured to synchronize a delivery of the bit vectors to the second reversible combinatorial operation circuit to account for a latency of the block cipher operation circuit.

105. The system of claim 102 wherein the bit vector generation circuit comprises means for generating the bit vectors.

106. The system of claim 101 wherein first reversible combinatorial operation circuit is further configured to receive only a defined subset of the data blocks of the data segment.

107. A method of encrypting a data segment, the data segment comprising a plurality of data blocks, each data block comprising a plurality of data bits, the method comprising:

encrypting a first plurality of data blocks of the data segment by (1) generating a first plurality of bit vectors, (2) reversibly combining each of the first plurality of data blocks with a corresponding one of the first plurality of bit vectors to thereby generate a first plurality of data block-bit vector combinations, and (3) performing an encryption operation on the first plurality of data block-bit vector combinations, wherein the first plurality of bit vectors have values that are independent of the encryption operations performed on the first plurality of data blocks; and

encrypting a second plurality of data blocks of the data segment by (1) generating a second plurality of bit vectors based at least in part upon a value of one of the first plurality of encrypted data block-bit vector combinations, (2) reversibly combining each of the second plurality of data blocks with a corresponding one of the second plurality of bit vectors to thereby generate a second plurality of data block-bit vector combinations, and (3) performing an encryption operation on the second plurality of data block-bit vector combinations.

108. The method of claim 107 wherein the step of generating a second plurality of bit vectors comprises generating the second plurality of bit vectors based at least in part upon a value of a first one of the first plurality of encrypted data block-bit vector combinations, wherein each encryption operation requires a plurality m of pipeline stages, wherein a feedback stride defines a first one of the second plurality of data blocks, and wherein the feedback stride has a value greater than or equal to the value of m.

109. The method of claim 107 wherein the step of generating the first plurality of bit vectors comprises generating the first plurality of bit vectors based at least in part upon a data tag associated with the data segment.

110. The method of claim 109 wherein the step of generating the first plurality of bit vectors further comprises randomizing the values of the first plurality of bit vectors.

111. A method of encrypting a data segment, said data segment comprising a plurality of data block groups, each of said data block groups comprising a plurality of data blocks, the method comprising:

encrypting the data blocks of a first data block group based at least in part upon a first plurality of bit vectors that are combined with the data blocks of the first data block group, wherein the bit vectors of the first plurality of bit vectors comprise blockwise independent bit vectors;

creating a second plurality of bit vectors based at least at part on one of the previously encrypted data blocks; and

encrypting the data blocks of a data block group after the first data block group based at least in part upon the second plurality of bit vectors that are combined with the data blocks of the data block group after the first data block group.

112. A system for encrypting a plurality of data block groups, at least some of said data block groups comprising a plurality of data blocks, said system comprising:

an encryptor circuit; and

a sequence generator circuit configured to generate at least two types of bit vectors for use by the encryptor circuit, a first type of bit vector being blockwise independent and a second type of bit vector being dependent on at least one encrypted data block of a prior data block group;

wherein the encryptor circuit is configured to (1) reversibly combine the data blocks of at least one of the data groups comprising a plurality of data blocks with a plurality of bit vectors of the first type to thereby generate a first plurality of data block-bit vector combinations, and (2) encrypt the first plurality of data block-bit vector combinations.

113. The system of claim 112 wherein the encryptor circuit is further configured to (1) reversibly combine the data blocks of a different one of the data groups with a plurality of bit vectors of the second type to thereby generate a second plurality of data block-bit vector combinations, and (2) encrypt the second plurality of data block-bit vector combinations.