Method and system for high throughput blockwise independent encryption/decryption

• US 8,737,606 B2
• Filed: 02/05/2013
• Issued: 05/27/2014
• Est. Priority Date: 03/23/2006
• Status: Active Grant

• Current Assignee: Ip Reservoir, LLC
• Original Assignee: Ip Reservoir, LLC
• Inventors: Taylor, David E., Indeck, Ronald S., White, Jason R., Chamberlain, Roger D.
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US13/759,227
• Publication Number:
  US 20130148802A1
• Time in Patent Office: 476 Days
• Field of Search: None
• US Class Current: 380/28
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

An encryption technique is disclosed for encrypting a plurality of data blocks of a data segment where the encryption selectively switches between a blockwise independent randomized (BIR) encryption mode and a cipher block chaining (CBC) encryption mode based on a configurable feedback stride. A corresponding decryption technique is also disclosed.

Claims

1. An apparatus comprising:

an encryption circuit for encrypting a plurality of data blocks of a data segment, the encryption circuit configured to selectively switch between a blockwise independent randomized (BIR) encryption mode and a cipher block chaining (CBC) encryption mode based on a configurable feedback stride;

wherein the encryption circuit comprises a combiner circuit, a block cipher circuit, and a sequence generator circuit;

the block cipher circuit comprising a plurality m of pipelined stages for simultaneously processing, in a pipelined fashion, a plurality m of different bit vector-data block combinations corresponding to m data blocks of the data segment that are generated by the combiner circuit to thereby generate a plurality of encrypted data blocks, the value for m being configurable to define the feedback stride; and

the sequence generator configured to selectively switch between the BIR encryption mode and the CBC encryption mode, wherein the sequence generator is further configured to (1) generate and output a plurality of randomized blockwise independent bit vectors while in the BIR encryption mode, and (2) generate and output a plurality of blockwise dependent bit vectors while in the CBC encryption mode, the blockwise dependent bit vectors being based on a previously encrypted bit vector-data block combination fed back from the block cipher circuit;

the combiner circuit being configured to (1) receive a streaming input of the data blocks, (2) receive an input of the bit vectors output by the sequence generator circuit, and (3) reversibly combine the received bit vectors with the received streaming data blocks to generate a plurality of bit vector-data block combinations for delivery to the block cipher circuit; and

wherein the sequence generator is further configured to (1) operate in the BIR encryption mode while the block cipher circuit is processing the bit vector-data block combinations corresponding to the first m data blocks of the same data segment, and (2) switch to the CBC encryption mode in response to the block cipher circuit completing encryption of at least the bit vector-data block combination corresponding to the first of the m data blocks, the block cipher circuit thereby being configured to generate the plurality of encrypted data blocks wherein at least the first m encrypted data blocks of the same data segment are encrypted in combination with blockwise independent bit vectors and wherein a plurality of the other encrypted data blocks of the same data segment are encrypted in combination with blockwise dependent bit vectors.

2. The apparatus of claim 1 wherein the encryption circuit is resident on a reconfigurable logic device.

3. The apparatus of claim 2 wherein the reconfigurable logic device comprises a field programmable gate array (FPGA).

4. The apparatus of claim 1 wherein the encryption circuit is resident on a chip multi-processor (CMP).

5. The apparatus of claim 1 wherein the encryption circuit is resident on an application-specific integrated circuit (ASIC).

6. A method comprising:

an encryption circuit encrypting a plurality of data blocks of a data segment, wherein the encryption circuit comprises a combiner circuit, a block cipher circuit, and a sequence generator circuit, wherein

the block cipher circuit comprises a plurality m of pipelined stages, and wherein the encrypting step comprises;

the m pipelined stages simultaneously processing, in a pipelined fashion, a plurality m of different bit vector-data block combinations corresponding to m data blocks of the data segment that are generated by the combiner circuit to thereby generate a plurality of encrypted data blocks, the value for m being configurable to define a feedback stride;

the sequence generator selectively switching between a blockwise independent randomized (BIR) encryption mode and a cipher block chaining (CBC) encryption mode based on the configurable feedback stride, the sequence generator (1) generating and outputting a plurality of randomized blockwise independent bit vectors while in the BIR encryption mode, and (2) generating and outputting a plurality of blockwise dependent bit vectors while in the CBC encryption mode, the blockwise dependent bit vectors being based on a previously encrypted bit vector-data block combination fed back from the block cipher circuit;

the combiner circuit (1) receiving a streaming input of the data blocks, (2) receiving an input of the bit vectors output by the sequence generator circuit, and (3) reversibly combining the received bit vectors with the received streaming data blocks to generate a plurality of bit vector-data block combinations for delivery to the block cipher circuit; and

the sequence generator (1) operating in the BIR encryption mode while the block cipher circuit is processing the bit vector-data block combinations corresponding to the first m data blocks of the same data segment, and (2) switching to the CBC encryption mode in response to the block cipher circuit completing encryption of at least the bit vector-data block combination corresponding to the first of the m data blocks, the block cipher circuit thereby generating the plurality of encrypted data blocks wherein at least the first m encrypted data blocks of the same data segment are encrypted in combination with blockwise independent bit vectors and wherein a plurality of the other encrypted data blocks of the same data segment are encrypted in combination with blockwise dependent bit vectors.

7. The method of claim 6 wherein the encryption circuit is resident on a reconfigurable logic device, the reconfigurable logic device performing the method steps.

8. The method of claim 7 wherein the reconfigurable logic device comprises a field programmable gate array (FPGA), the FPGA performing the method steps.

9. The method of claim 6 wherein the encryption circuit is resident on a chip multi-processor (CMP), the CMP performing the method steps.

10. The method of claim 6 wherein the encryption circuit is resident on an application-specific integrated circuit (ASIC), the ASIC performing the method steps.

11. An apparatus comprising:

a decryption circuit for decrypting a plurality of encrypted data blocks of a data segment, the decryption circuit configured to selectively switch between a blockwise independent randomized (BIR) decryption mode and a cipher block chaining (CBC) decryption mode based on a configurable feedback stride;

wherein the decryption circuit comprises a combiner circuit, a block cipher circuit, and a sequence generator circuit;

the block cipher circuit comprising a plurality m of pipelined stages for simultaneously processing, in a pipelined fashion, a plurality m of different bit vector-data block combinations corresponding to m data blocks of the data segment that are generated by the combiner circuit to thereby generate a plurality of decrypted data blocks, the value for m being configurable to define the feedback stride; and

the sequence generator configured to selectively switch between the BIR decryption mode and the CBC decryption mode, wherein the sequence generator is further configured to (1) generate and output a plurality of randomized blockwise independent bit vectors while in the BIR decryption mode, and (2) generate and output a plurality of blockwise dependent bit vectors while in the CBC decryption mode, the blockwise dependent bit vectors being based on a previously decrypted bit vector-data block combination fed back from the block cipher circuit;

the combiner circuit being configured to (1) receive a streaming input of the encrypted data blocks, (2) receive an input of the bit vectors output by the sequence generator circuit, and (3) reversibly combine the received bit vectors with the received streaming encrypted data blocks to generate a plurality of bit vector-data block combinations for delivery to the block cipher circuit; and

wherein the sequence generator is further configured to (1) operate in the BIR decryption mode while the block cipher circuit is processing the bit vector-data block combinations corresponding to the first m encrypted data blocks of the same data segment, and (2) switch to the CBC decryption mode in response to the block cipher circuit completing decryption of at least the bit vector-data block combination corresponding to the first of the m encrypted data blocks, the block cipher circuit thereby being configured to generate the plurality of decrypted data blocks wherein at least the first m decrypted data blocks of the same data segment are decrypted in combination with blockwise independent bit vectors and wherein a plurality of the other decrypted data blocks of the same data segment are decrypted in combination with blockwise dependent bit vectors.

12. The apparatus of claim 11 wherein the decryption circuit is resident on a reconfigurable logic device.

13. The apparatus of claim 12 wherein the reconfigurable logic device comprises a field programmable gate array (FPGA).

14. The apparatus of claim 11 wherein the decryption circuit is resident on a chip multi-processor (CMP).

15. The apparatus of claim 11 wherein the decryption circuit is resident on an application-specific integrated circuit (ASIC).

16. A method comprising:

a decryption circuit decrypting a plurality of encrypted data blocks of a data segment, wherein the decryption circuit comprises a combiner circuit, a block cipher circuit, and a sequence generator circuit, wherein the block cipher circuit comprises a plurality m of pipelined stages, and wherein the decrypting step comprises;

the m pipelined stages simultaneously processing, in a pipelined fashion, a plurality m of different bit vector-data block combinations corresponding to m encrypted data blocks of the data segment that are generated by the combiner circuit to thereby generate a plurality of decrypted data blocks, the value for m being configurable to define a feedback stride;

the sequence generator selectively switching between a blockwise independent randomized (BIR) decryption mode and a cipher block chaining (CBC) decryption mode based on the configurable feedback stride, the sequence generator (1) generating and outputting a plurality of randomized blockwise independent bit vectors while in the BIR decryption mode, and (2) generating and outputting a plurality of blockwise dependent bit vectors while in the CBC decryption mode, the blockwise dependent bit vectors being based on a previously decrypted bit vector-data block combination fed back from the block cipher circuit;

the combiner circuit (1) receiving a streaming input of the encrypted data blocks, (2) receiving an input of the bit vectors output by the sequence generator circuit, and (3) reversibly combining the received bit vectors with the received streaming encrypted data blocks to generate a plurality of bit vector-data block combinations for delivery to the block cipher circuit; and

the sequence generator (1) operating in the BIR decryption mode while the block cipher circuit is processing the bit vector-data block combinations corresponding to the first m encrypted data blocks of the same data segment, and (2) switching to the CBC decryption mode in response to the block cipher circuit completing decryption of at least the bit vector-data block combination corresponding to the first of the m encrypted data blocks, the block cipher circuit thereby generating the plurality of decrypted data blocks wherein at least the first m decrypted data blocks of the same data segment are decrypted in combination with blockwise independent bit vectors and wherein a plurality of the other decrypted data blocks of the same data segment are decrypted in combination with blockwise dependent bit vectors.

17. The method of claim 16 wherein the decryption circuit is resident on a reconfigurable logic device, the reconfigurable logic device performing the method steps.

18. The method of claim 17 wherein the reconfigurable logic device comprises a field programmable gate array (FPGA), the FPGA performing the method steps.

19. The method of claim 16 wherein the decryption circuit is resident on a chip multi-processor (CMP), the CMP performing the method steps.

20. The method of claim 16 wherein the decryption circuit is resident on an application-specific integrated circuit (ASIC), the ASIC performing the method steps.