Hierarchical key management encoding and decoding

• US 6,907,127 B1
• Filed: 07/10/2000
• Issued: 06/14/2005
• Est. Priority Date: 06/18/1999
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Digital Video Express LP
• Inventors: Goldshlag, David Moshe, Kravitz, David William
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US09/613,284
• Time in Patent Office: 1,800 Days
• Field of Search: 380/277, 380/30, 380/44, 380/45, 380/283, 380/273, 380/239, 380/286, 713200-202, 713/156, 713165-166, 705/51, 705/171
• US Class Current: 380/277
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

The present invention discloses a construction for key management module functionality which provides for secure encoding and decoding of messages which are up to two blocks long. A method for generating an encoded value having a first encoded value part and a second encoded value part from an unencoded value having a first unencoded value part and a second unencoded value part, comprising the steps of: obtaining an initialization vector; and generating the first and second encoded value parts. The first encoded value part is generated by: generating a first result by encrypting the first unencoded value part; generating a second result by performing an exclusive or operation on the first result and the second unencoded value part; generating a third result by performing an exclusive or operation on the second result and the initialization vector; generating a fourth result by encrypting the third result; generating a fifth result by performing an exclusive or operation on the fourth result and the first unencoded value part; and encrypting the fifth result. The second encoded value part is generated by encrypting the second result.

Claims

1. An apparatus for key management comprising:

(a) a multitude of key registers, said multitude of key registers having a hierarchy with levels;

(b) a multitude of type fields, wherein each type field is associated with a key register;

(c) a key management controller, said key management controller having a multitude of modes;

(d) at least one initialization vector;

(e) key management algorithms; and

(f) key management functions;

wherein said mode is determined by the hierarchical level of the key register, and the key management algorithm used is determined by the key management function being used and said mode.

2. The apparatus according to claim 1 wherein said multitude of modes includes a Cipher Block Chaining Prime (CBC′

) mode.

3. The apparatus according to claim 2 wherein said multitude of modes further includes a Cipher Block Chaining (CBC) mode.

4. The apparatus according to claim 2 wherein said multitude of modes further includes an Electronic Codebook (ECB) mode.

5. The apparatus according to claim 4 wherein said ECB mode uses a deterministic non-identity function.

6. The apparatus according to claim 4 wherein said ECB mode uses swapped key blocks.

7. The apparatus according to claim 3 wherein said CBC mode uses a firmware specified initialization vector.

8. The apparatus according to claim 2 wherein said CBC′

mode uses an initialization vector to wrap level i red key bits, said initialization vector determined by level i.

9. The apparatus according to claim 2 wherein said CBC′

mode uses an initialization vector to unwrap black bits to level j, said initialization vector determined by level j.

10. The apparatus according to claim 4 wherein at level 0 said mode is ECB mode and said multitude of functions include:

(a) an encode function; and

(b) a decode function.

11. The apparatus according to claim 4 wherein at level 1 said multitude of functions includes:

(a) an unwrap black bits to level 0 function, wherein said mode is a CBC mode with a firmware specified initialization vector; and

(b) an encode data function, wherein said mode is an ECB mode using a swapped key blocks.

12. The apparatus according to claim 4 wherein at level 2 said multitude of functions includes:

(a) a wrap level i red key bits, wherein said mode is a CBC′

mode with an initialization vector determined by the level i;

(b) an export black bits function;

(c) an unwrap black bits to level j as determined by firmware, wherein said mode is CBC′

mode with an initialization vector determined by the level j; and

(d) an import red key bits as level 0 function.

13. A method for generating an encoded value having a first encoded value part and a second encoded value part from an unencoded value having a first unencoded value part and a second unencoded value part, comprising the steps of:

(a) obtaining an initialization vector;

(b) generating the first encoded value part by;

(i) generating a first result by encrypting the first unencoded value part;

(ii) generating a second result by performing an exclusive or operation on the first result and the second unencoded value part;

(iii) generating a third result by performing an exclusive or operation on the second result and the initialization vector;

(iv) generating a fourth result by encrypting the third result;

(v) generating a fifth result by performing an exclusive or operation on the fourth result and the first unencoded value part; and

(vi) encrypting the fifth result; and

(c) generating the second encoded value part by encrypting the second result.

14. A method according to claim 13, wherein said step of obtaining an initialization vector further includes the steps of:

(a) determining a hierarchical level for the encoded value; and

(b) obtaining the initialization vector determined by the hierarchical level.

15. A method for generating an unencoded value having a first unencoded value part and a second unencoded value part from an encoded value having a first encoded value part and a second encoded value part, comprising the steps of:

(a) obtaining an initialization vector;

(b) generating the first unencoded value part by;

(i) generating a first result by decrypting the second encoded value part;

(ii) generating a second result by performing an exclusive or operation on the first result and the initialization vector;

(iii) generating a third result by encrypting the second result;

(iv) generating a fourth result by decrypting the second encoded value part; and

(v) performing an exclusive or operation on the third result and the fourth result;

(c) generating the second unencoded value part by;

(i) generating a fifth result by encrypting the first unencoded value part; and

(ii) generating a sixth result by decrypting the second encoded value part; and

(d) performing an exclusive or operation on the fifth result and the sixth result.

16. A method according to claim 15, wherein said step of obtaining an initialization vector further includes the steps of:

(a) determining a hierarchical level for the encoded value; and

(b) obtaining the initialization vector determined by the hierarchical level.