MULTIPLE-MODE CRYPTOGRAPHIC MODULE USABLE WITH MEMORY CONTROLLERS

• US 20110255689A1
• Filed: 04/15/2010
• Published: 10/20/2011
• Est. Priority Date: 04/15/2010
• Status: Active Application

• Current Assignee: Avago Technologies General IP PTE Limited (Broadcom, Inc.)
• Original Assignee: LSI Corporation (Broadcom, Inc.)
• Inventors: Hoglund, Timothy E., Ivanovic, Lav D., Bolotov, Anatoli, Grinchuk, Mikhail I., Filseth, Paul G.
• Application Number:
  US12/761,024
• Publication Number:
  US 20110255689A1
• Time in Patent Office: Days
• US Class Current: 380/42
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]

Abstract

In one embodiment, a multi-mode Advanced Encryption Standard (MM-AES) module for a storage controller is adapted to perform interleaved processing of multiple data streams, i.e., concurrently encrypt and/or decrypt string-data blocks from multiple data streams using, for each data stream, a corresponding cipher mode that is any one of a plurality of AES cipher modes. The MM-AES module receives a string-data block with (a) a corresponding key identifier that identifies the corresponding module-cached key and (b) a corresponding control command that indicates to the MM-AES module what AES-mode-related processing steps to perform on the data block. The MM-AES module generates, updates, and caches masks to preserve inter-block information and allow the interleaved processing. The MM-AES module uses an unrolled and pipelined architecture where each processed data block moves through its processing pipeline in step with correspondingly moving key, auxiliary data, and instructions in parallel pipelines.

Claims

1. A multi-mode cryptography (MM-C) module, wherein:

the MM-C module is adapted to process an input string-data block using corresponding key data and corresponding mask data to generate an output string-data block; and

the MM-C module comprises;

a data-stream (D-S) processing module adapted to process a corresponding input data block in accordance with the corresponding key data and corresponding mask data to generate an output data block, wherein the input data block is derived from at least one of the corresponding input string-data block and the corresponding mask data;

a key expansion and selection (E&

S) module adapted to provide the corresponding key data to the D-S processing module;

a mask generation/updating (G/U) module adapted to provide the corresponding mask data to the D-S processing module; and

a controller adapted to control operations of the D-S processing module, the E&

S module, and the G/U module such that the MM-C module processes, in an interleaved manner, a first data stream in a first cryptographic mode and a second data stream in a second cryptographic mode.

2. The MM-C module of claim 1, wherein the first cryptographic mode is different from the second cryptographic mode.

3. The MM-C module of claim 1, wherein, for the interleaved processing:

(1) the MM-C module processes a first set of one or more string-data blocks of the first data stream and stores first mask data generated from the processing of the first set;

(2) the MM-C module then processes one or more string-data blocks of the second data stream; and

(3) the MM-C module then processes a second set of one or more string-data blocks of the first data stream using the stored first mask data to process the second set.

4. The MM-C module of claim 1, wherein:

the MM-C module is a multi-mode advanced encryption standard (MM-AES) module; and

each of the first and second cryptography modes is an AES operational mode.

5. The MM-C module of claim 1, wherein the MM-C module enables any of (i) electronic codebook (ECB) mode, (ii) cipher block chaining (CBC) mode, (iii) cipher feedback (CFB) mode, (iv) output feedback (OFB) mode, (v) counter (CTR) mode, (vi) Galois/counter (GCM) mode, (vii) Liskov, Rivest, and Wagner (LRW) mode, (viii), XOR-Encrypt-XOR-based tweaked codebook mode with ciphertext stealing (XTS) mode, and (ix) counter-mode encryption with cipher-block-chaining message-authentication-code (CCM) mode to be selected for each of the first and second cryptographic modes.

6. The MM-C module of claim 5, wherein:

the first cryptographic mode is the ECB mode; and

the D-S processing module does not use mask data for the processing of the first data stream.

7. The MM-C module of claim 1, wherein the MM-C module is adapted to process, in an interleaved manner with at least one of the first and second data streams, a third data stream in a transparent mode, wherein, for each string-data block of the third data stream, the D-S processing module is adapted to generate an output data block identical to the string-data block.

8. The MM-C module of claim 1, wherein:

the D-S processing module is adapted to process the input data block by performing one of (i) a forward cipher function based on the key data and (ii) an inverse cipher function based on the key data; and

the input string-data block is part of one of (i) the first data stream and (ii) the second data steam.

9. The MM-C module of claim 1, wherein:

the controller is adapted to receive a corresponding set of control instructions for each input string-data block of the first and second data streams received by the MM-C module;

each input string-data block corresponds to an input data block processed by the D-S processing module; and

the control instructions for each input string-data block indicate (i) a corresponding cryptographic mode, (ii) encryption or decryption processing, and (ii) the corresponding key and mask data to be used by the D-S processing module in processing the corresponding input data block.

10. The MM-C module of claim 1, wherein the key data for an input data block corresponds to an expanded key schedule derived from a cryptographic key for the data stream of the corresponding input string-data block.

11. The MM-C module of claim 10, wherein:

the MM-C module is adapted to initially;

receive the cryptographic key for the data stream along with (i) an input string-data block of the data stream and (ii) a corresponding cryptographic-key identifier (key ID); and

cache the cryptographic key; and

the MM-C module is further adapted to subsequently;

receive input string-data blocks of the data stream along with the corresponding key ID and without the cryptographic key; and

provide the cached cryptographic key that corresponds to the key ID to the key E&

S module.

12. The MM-C module of claim 1, further adapted to:

store mask data corresponding to the first data stream in a memory external to the MM-C module; and

retrieve the externally stored mask data for processing an input string-data block of the first data stream.

13. The MM-C module of claim 1, wherein the MM-C module further comprises an interface and buffers (I&

B) module adapted to;

receive a cryptographic key and a corresponding cryptographic-key identifier (key ID);

cache the cryptographic key;

associate the cached cryptographic key with the corresponding key ID; and

respond to receipt of an input string-data block and a corresponding key ID by synchronously providing both (i) the cached cryptographic key corresponding to the key ID to the key E&

S module and (ii) the input string-data block to at least one of the D-S processing module and the mask G/U module.

14. The MM-C module of claim 1, wherein:

the D-S processing module comprises a main data-processing block, which is a partially unrolled pipeline comprising e linearly connected data-processing segments, each adapted to perform cipher-function transformation of a transitory data block;

the key data for an input data block corresponds to an expanded key schedule derived by the key E&

S module from a cryptographic key for the data stream of the corresponding input string-data block;

the key E&

S module is a partially unrolled pipeline comprising e key-provision segments;

each key-provision segment is connected to a corresponding data-processing segment of the main data-processing block;

each key-provision segment is adapted to generate an appropriate segment of the expanded key schedule for provision to the corresponding data-processing segment; and

the controller comprises a finite state machine (FSM) comprising e control segments, each connected to control (i) a corresponding data-processing segment of the D-S processing module and (ii) the corresponding key-provision segment of the key E&

S module so that the corresponding data-processing segment performs the transfer-function transformation of the transitory data block using the appropriate segment of the expanded key schedule.

15. The MM-C module of claim 14, wherein:

the D-S processing module further comprises a shift-register pipeline for shifting auxiliary data synchronously with corresponding transitory data blocks in the main data-processing block; and

the auxiliary data is derived from at least one of the corresponding input string-data block and the corresponding mask data.

16. The MM-C module of claim 14, wherein:

the controller further comprises a shift-register pipeline comprising e shift-register segments, each connected to a corresponding control segment of the FSM for controlling the corresponding data-processing and key-provision segments;

the shift-register pipeline comprises a first shift-register segment adapted to receive a corresponding set of control instructions for each input string-data block received by the MM-C module;

the shift-register pipeline is adapted to shift the control instructions synchronously with the corresponding data block in the main data-processing block; and

the control instructions for each input string-data block indicate (i) a corresponding cryptographic mode, (ii) encryption or decryption processing, and (ii) the corresponding key and mask data to be used by the D-S processing module in processing the corresponding input data block.

17. The MM-C module of claim 14, wherein:

the main data-processing block includes a feed-back path from data-processing segment e to a first data-processing segment for providing the processed transitory data block from data-processing segment e to the first data-processing segment;

the first data-processing segment is adapted to receive auxiliary data;

the first data-processing segment is adapted to receive and transform the input data block; and

the first data-processing segment is adapted to provide the output string-data block.

18. A multi-mode cryptography (MM-C) method for processing input string-data blocks using corresponding key data and corresponding mask data to generate output string-data blocks, wherein:

the method comprises, for each corresponding input data block;

(a) providing the corresponding key data and the corresponding mask data; and

(b) processing the corresponding input data block in accordance with the corresponding key data and corresponding mask data to generate an output data block, wherein the input data block is derived from at least one of the corresponding input string-data block and the corresponding mask data; and

the method comprises processing, in an interleaved manner, a first data stream in a first cryptographic mode and a second data stream in a second cryptographic mode.

19. A storage controller comprising a multi-mode cryptography (MM-C) module, wherein:

the MM-C module is adapted to process an input string-data block using corresponding key data and corresponding mask data to generate an output string-data block; and

the MM-C module comprises;

a data-stream (D-S) processing module adapted to process a corresponding input data block in accordance with the corresponding key data and corresponding mask data to generate an output data block, wherein the input data block is derived from at least one of the corresponding input string-data block and the corresponding mask data;

a key expansion and selection (E&

S) module adapted to provide the corresponding key data to the D-S processing module;

a mask generation/updating (G/U) module adapted to provide the corresponding mask data to the D-S processing module; and

a controller adapted to control operations of the D-S processing module, the E&

S module, and the G/U module such that the MM-C module processes, in an interleaved manner, a first data stream in a first cryptographic mode and a second data stream in a second cryptographic mode.