CN104717053B - Data decryption circuit and method - Google Patents

Abstract

The present invention discloses a data decryption circuit and method, which are used to decrypt a current encrypted data packet, wherein the current encrypted data packet includes a header data and a bearer data. The data decryption circuit includes: a computing unit, which is used to generate a first data according to the header data and a pseudo random number, generate a second data according to a session key and a constant, and generate a length information and a starting position information of the bearer data according to the header data; wherein the computing unit generates the first data, the second data, the length information and the starting position information by executing a program code; and a decryption calculation circuit, which is coupled to the computing unit, which is used to generate a decryption key according to the first data and the second data, obtain the bearer data from the current encrypted data packet according to the starting position information and the length information, and decrypt the bearer data using the decryption key.

Description

Data decryption circuit and method

technical field

The present invention relates to a data decryption circuit and method, in particular to a data decryption circuit and method utilizing software and hardware to cooperate with each other.

Background technique

Please refer to FIG. 1 , which is a schematic diagram of a data decryption process of conventional High-Bandwidth Digital Content Protection (HDCP for short). Please also refer to FIG. 2 , which is a schematic diagram of a conventional transport stream (TS) packet. As shown in FIG. 2 , a transport stream packet 200 includes TS header data, elementary packet stream (packetized elementary streams, hereinafter referred to as PES) header data, and elementary bit stream (elementary stream, ES), or called bearer data ( payload). In the HDCP standard, the TS header data includes a flag named payload unit start indicator, which is used to indicate whether the transport stream packet contains PES header data. The PES header data includes private data for decryption, and the private data mainly includes streamCtr (flow control) data and inputCtr (input control) data. Please note that not every transport stream packet contains PES header data, which can be judged by the bearer data unit start indicator flag during implementation. When the transport stream packet contains PES header data, the inputCtr data can be extracted from the private data to perform the decryption process; when the transport stream packet does not contain PES header data, the inputCtr data can be based on the data segment currently being decrypted (eg The length is 16 bytes), it is inferred that the inputCtr data is incremented by the data segment decrypted each time by HDCP. Please refer to Figure 1, the 32-bit streamCtr data and the lower 32 bits of the 64-bit virtual random number (pseudo-random number) r _iv do an exclusive OR (XOR) operation, and then the pseudo-random number r _iv The higher 32 bits are combined to obtain 64-bit intermediate data, and the intermediate data is combined with the 64-bit inputCtr data to form 128-bit intermediate data p. The 128-bit session key (session key) K _s and the 128-bit constant lc ₁₂₈ are XORed together with the intermediate data p to generate 128 bits after being operated by Advanced Encryption Standard (hereinafter referred to as AES) key. The original data of the encrypted data (including 128-bit or 16-byte data) can be obtained after the encrypted data of a block length (128 bits or 16 bytes) is XORed with the key. The virtual random number r _iv and the session key K _s mentioned above are the results obtained after the transmission end and the receiving end of the transmission stream communicate with each other.

As shown in Figure 2, the length of a transport stream packet is 188 bytes, in which the length of the TS header data is 4 bytes, and the PES header data may or may not exist, and there is no fixed length, as mentioned above, Whether the PES header data exists can be judged by the bearer data unit start indication flag. If PES header data is present, it contains information about its length. Therefore, the length of the bearer data is the length of the transport stream packet (188 bytes) minus the length of the TS header data (4 bytes) and the length of the PES header data (if the PES header data exists). length. As mentioned above, the data segment decrypted by HDCP each time is 16 bytes, and the bearer data may include several data segments, but the data volume of the bearer data may not be an integer multiple of 16 bytes. Therefore, in the process of data decryption, a small piece of data (less than 16 bytes) may remain undecrypted in a transport stream packet, and the undecrypted data must be combined with part of the data carrying data in the next transport stream packet , to form a complete data segment for HDCP data decryption procedure.

If the HDCP decryption program shown in Figure 1 is completely executed by hardware, due to the lack of flexibility of the hardware, the above-mentioned action of combining two data-carrying packets originally belonging to different transport stream packets will cause difficulties in hardware design, and additional circuit design is necessary To cope with different situations, it is easy to cause time-consuming design and increased circuit cost; and if the HDCP decryption program is completely executed by software, that is, executed by the processing unit (processing unit) through program code, the HDCP decryption program It will occupy many computing unit resources, causing a burden on the computing unit, and possibly dragging down the performance of the electronic device.

Contents of the invention

In view of the shortcomings of the prior art, an object of the present invention is to provide a data decryption circuit and a data decryption method, so as to speed up the decryption speed and increase the flexibility of the decryption process.

The present invention discloses a data decryption circuit, which is used to decrypt a currently encrypted data packet, the currently encrypted data packet includes a header data and a bearer data, and the data decryption circuit includes: an arithmetic unit, used for according to the header data and a virtual random number to generate a first data, generate a second data according to a session key and a constant, and generate a length information and a starting position information of the bearer data according to the header data; wherein, the operation The unit generates the first data, the second data, the length information and the start position information by executing the program code; and a decryption calculation circuit, coupled to the calculation unit, for according to the first data and the first data A decryption key is generated from the second data, and the bearer data is obtained from the current encrypted data packet according to the initial location information and the length information, and the bearer data is decrypted by using the decryption key.

The present invention also discloses a data decryption method for decrypting a currently encrypted data packet, the currently encrypted data packet includes a header data and a bearer data, the data decryption method includes: using an arithmetic unit to execute program codes Execute the following procedures in a manner: (1) generate a first data according to the header data and a virtual random number; (2) generate a second data according to a session key and a constant; and (3) generate a second data according to the header data generating a length information and a starting position information of the carrying data; transmitting the first data, the second data, the length information and the starting position information to a decryption calculation circuit; and controlling the decryption calculation circuit to execute the following program : (1) generating a decryption key according to the first data and the second data; (2) obtaining the bearer data from the currently encrypted data packet according to the starting position information and the length information; and (3) using The decryption key decrypts the bearer data.

The present invention also discloses a data decryption circuit for decrypting a currently encrypted data packet, the currently encrypted data packet includes a header data and a bearer data, the data decryption circuit includes: an arithmetic unit, used to The header data generates a length information and a starting position information of the bearer data; wherein, the operation unit generates the length information and the starting position information by executing program code; and a decryption calculation circuit, coupled to the operation unit, It is used to generate a decryption key, obtain the bearer data from the current encrypted data packet according to the initial location information and the length information, and use the decryption key to decrypt the bearer data.

The present invention also discloses a data decryption method for decrypting a currently encrypted data packet, the currently encrypted data packet includes a header data and a bearer data, the data decryption method includes: controlling an arithmetic unit to execute program codes way, generating a length information and a starting position information of the bearing data according to the header data; transmitting the length information and the starting position information to a decryption calculation circuit; and controlling the decryption calculation circuit to execute the following program: (1 ) generating a decryption key; (2) obtaining the bearer data from the currently encrypted data packet according to the initial location information and the length information; and (3) decrypting the bearer data by using the decryption key.

The data decryption circuit and the data decryption method of the present invention use software and hardware to decrypt data. The advantage of the software is that it is flexible and easy to modify. The design of the software can be adjusted according to the format of different encrypted data packets, so it is easy to find out the location of the encrypted data packets carrying data. The hardware can speed up the decryption process, so that the decryption process can be completed more quickly to improve the performance of the circuit. Although the conventional technology uses pure software to execute the decryption program, although it is flexible, it consumes the resources of the computing unit, which will cause a burden to the embedded system with limited hardware resources (such as the computing speed of the computing unit is relatively slow); However, in the prior art, although the pure hardware method is used to execute the decryption program, although it is fast, it lacks flexibility. When the bearer data of the encrypted data packet is not an integer multiple of the minimum unit for decryption, an error will be caused. Compared with the conventional technology, the present invention has the advantages of both software and hardware, and can quickly complete decryption and is flexible.

Regarding the characteristics, implementation and effects of the present invention, preferred embodiments are described in detail below in conjunction with the drawings.

Description of drawings

Fig. 1 is the schematic diagram of the data decryption process of conventional HDCP;

FIG. 2 is a schematic diagram of the composition of a conventional transport stream packet;

Fig. 3 is the schematic diagram of an embodiment of HDCP data decryption circuit of the present invention;

Fig. 4 is a flowchart of an embodiment of the data decryption method of the present invention; and

FIG. 5 is a schematic diagram of another embodiment of the HDCP data decryption circuit of the present invention.

Detailed ways

The technical terms in the following description refer to the customary terms in this technical field. If some terms are explained or defined in this manual, the explanations of these terms shall be based on the descriptions or definitions in this manual.

The disclosed content of the present invention includes a data decryption circuit and a data decryption method, which can process bearer data whose data length is not an integer multiple of a data segment. The circuit and method can be applied to the packets of the transmission stream. On the premise that the implementation is possible, those skilled in the art can select equivalent components or steps to realize the present invention according to the content disclosed in this specification, that is, The implementation of the present invention is not limited to the examples described below. Since some of the components included in the data decryption circuit of the present invention may be known components individually, the details of the known components will be omitted in the following description without affecting the full disclosure and implementability of the device invention . In addition, the data decryption method of the present invention can be executed by the data decryption circuit of the present invention or its equivalent device. On the premise of not affecting the full disclosure and implementability of the method invention, the description of the following method invention will focus on the steps content, not hardware.

Please refer to FIG. 3 , which is a schematic diagram of an embodiment of the HDCP data decryption circuit of the present invention. The HDCP data decryption circuit 300 is used for decrypting continuous transport stream packets, and includes a computing unit 310 and an AES computing circuit 320 . The operation unit 310 obtains the PES header data of a transport stream packet, parses (parses) the PES header data to obtain streamCtr data and inputCtr data, and performs an XOR operation on the streamCtr data, inputCtr data and the virtual random number r _iv and After the combination, the intermediate data p shown in FIG. 1 is obtained; in addition, the operation unit 310 also performs an XOR operation on the session key K _s and the constant lc ₁₂₈ to generate the intermediate data q. The intermediate data p and the intermediate data q are combined in a simple manner to form keys keys and output to the AES calculation circuit 320 . In addition, when the transport stream packet includes PES header data, the computing unit 310 also parses the PES header data to obtain length information of the PES header data. According to the length information of the PES header data, the computing unit 310 can calculate the starting position P and the length L of the data carried in the transport stream packet 200 in FIG. 2 . In more detail, since the transport stream packet 200 has a fixed length of 188 bytes, and the TS header data of the transport stream packet 200 also has a fixed length of 4 bytes, assuming that the length of the PES header data is n bytes (n is an integer, if the PES header data does not exist, then n is 0), then the starting position P of the bearer data is the (4+n+1)th byte, and the length L of the bearer data is (188-4 -n) bytes. After obtaining the information of the starting position P and the length L of the carrying data, the computing unit 310 transmits the information to the AES computing circuit 320 . After the above information such as the keys, the starting position P of the loaded data, and the length L of the loaded data are all output to the AES computing circuit 320 , the computing unit 310 sends a control signal Ctrl to trigger the decryption procedure of the AES computing circuit 320 .

The AES calculation circuit 320 is a circuit that supports multiple encryption and decryption algorithms, and the AES-CTR module contained therein can be used for the data decryption operation of the HDCP of the present invention. The AES-CTR module performs AES operations on the intermediate data p and intermediate data q contained in the key keys to obtain a 128-bit key that is finally used to decrypt the encrypted data. The AES calculation circuit 320 then obtains the data segment to be decrypted from the transport stream packet according to the initial position P and length L of the carried data, and performs an XOR operation on the data segment to be decrypted and the final key to obtain an unencrypted of the original data. When the bearer data contained in the current transport stream packet exceeds the length of one data segment (ie 16 bytes), the AES calculation circuit 320 decrypts the next data segment immediately after completing the decryption of the current data segment. If the bearer data contained in the current transport stream packet is a multiple of 16 bytes, the AES calculation circuit 320 will decrypt the next transport stream packet after decrypting all the data segments of the bearer data; if the current transport stream packet The bearer data contained in the stream packet is not a multiple of 16 bytes, that is, in the process of decrypting the current bearer data, there will be less than 16 bytes of data left at the end. At this time, the AES calculation circuit 320 can use the data provided by the operation unit 310 The starting position P and length L of the bearer data of the next transport stream packet to obtain part of the data bearer of the next transport stream packet, and combine the part of data with the bearer data of the previous transport stream packet The remaining data constitutes a 16-byte data segment for decryption operations. To sum up, even if bearer data whose data length is not a multiple of 16 bytes is encountered during the decryption process, the HDCP data decryption circuit 300 of the present invention can continue to decrypt without error. It should be noted that the operation unit 310 can operate in the manner of executing program codes, and the AES calculation circuit 320 can be a hardware calculation circuit. This makes the present invention cooperate with software and hardware to complete the decryption program.

Please refer to FIG. 4 , which is a flowchart of an embodiment of the data decryption method of the present invention. In addition to the aforementioned data decryption circuit, the present invention also correspondingly discloses a data decryption method for decrypting transport stream packets, capable of decrypting transport stream packets with different data lengths. The method utilizes the AES calculation circuit to be responsible for the AES-CTR encryption and decryption algorithm required by the HDCP data decryption program. The method can be implemented by the aforementioned HDCP data decryption circuit 300 or its equivalent device. The data decryption method of the present invention is used to decrypt consecutive transport stream packets, including the current transport stream packet currently being decrypted and the next transport stream packet immediately after the current transport stream packet. Both the current transport stream packet and the next transport stream packet include PES header data and bearer data. As shown in Figure 4, an embodiment of the present invention comprises the following steps:

Step S410: Generate intermediate data p according to the PES header data and the virtual random number r _iv of the current transport stream packet. This step is implemented in the form of software, more specifically, it is implemented by using the computing unit of the electronic device to execute program codes. The PES header data contains private data used for decryption. Private data mainly includes streamCtr data and inputCtr data. In this step, the streamCtr data, inputCtr data and virtual random number r _iv are used for calculation to obtain the intermediate data p. The details of its operation have been described in detail in the previous disclosure, so it will not be repeated;

Step S420: Generate intermediate data q according to the session key K _s and the constant lc ₁₂₈ . This step is also implemented in the form of software, that is, it is completed by using the computing unit of the electronic device to execute program codes. The session key K _s and the constant lc ₁₂₈ are necessary data in the HDCP decryption process, and the method for generating them is well known to those skilled in the art, so details will not be repeated here. The intermediate data q is generated after the operation of the session key K _s and the constant lc _128. The details of the operation have been detailed in the previous disclosure, so they will not be repeated;

Step S430: Generate length information and starting position information of bearer data according to the PES header data. This step is also implemented in the form of software, that is, it is completed by using the computing unit of the electronic device to execute program codes. As shown in FIG. 2 , the length of the Transport Stream packet processed by the method is fixed, and includes TS header data, PES header data and bearer data. The length of the TS header data is fixed, and the length of the PES header data is not fixed, but the PES header data contains its length information. Therefore, according to the length information of the PES header data, the start position information and length information of the bearer data can be known;

Step S440: Send the intermediate data p, intermediate data q, length information and initial position information to the AES calculation circuit. This step provides the intermediate data p, intermediate data q and the length information and starting position information of the bearer data required for decryption to the AES calculation circuit; and

Step S450: Control the AES computing circuit to execute the following decryption program:

A decryption key is generated according to the intermediate data p and the intermediate data q. The AES computing circuit includes an AES-CTR module, which is used to perform AES operations on the intermediate data p and intermediate data q to generate a decryption key for final decryption. The details of the operation are well known to those skilled in the art, so it is not necessary repeat;

The bearer data is obtained from the current transport stream packet according to the start position information and the length information. After obtaining the current transmission stream packet, the AES calculation circuit can obtain the bearer data of the current transport stream packet according to the initial position information and length information of the bearer data; and

The bearer data is decrypted using the decryption key. After the AES calculation circuit operates the decryption key and the bearer data together, the bearer data can be decrypted to obtain unencrypted original data. The calculation method has been disclosed in the previous description, so it will not be described again.

It should be noted that the decryption program in step S450 operates in units of one data segment, and in a preferred embodiment, the length of a data segment is set to 16 bytes. A bearer data usually includes more than one data segment. When a data segment is decrypted, the AES calculation circuit will decrypt the next data segment. If the bearer data contains an integer number of data segments, that is, the length of the bearer data is a multiple of 16 bytes, the AES calculation circuit can completely decrypt the entire bearer data, and there will be no undecrypted data remaining in the current transport stream packet ; However, if the bearer data does not contain an integer number of data segments, that is, the length of the bearer data is not an integer multiple of 16 bytes, then the data less than 16 bytes will inevitably remain in the current transport stream packet and cannot be decrypted. The bearer data in the next transport stream packet of the current transport stream packet must be combined with the remaining data in the current transport stream packet to form a complete data segment, so that the AES calculation circuit can do it Decryption operation. The initial position information and length information of the carrying data of the next transport stream packet are also obtained by the calculation unit of the electronic device through software calculation.

The present invention uses software and hardware to cooperate with each other to complete the decryption program. The advantage is that the AES calculation circuit can obtain the appropriate data segment for decryption as long as the initial position and length information given by the calculation unit are used. Therefore, the AES calculation circuit can be designed. In order to speed up the decryption process, the decryption is performed in an all-hardware manner, and the AES calculation circuit does not need to be responsible for finding out the carrying data of the transmission stream packet, which can simplify the design of the hardware. On the other hand, using software to find out the initial position information and length information of the carried data can make the present invention more flexible. The format of the stream is transmitted, and the program can be applied only by slightly modifying the program.

Please note that the above description is only one of the preferred embodiments of the present invention in which software is combined with hardware to perform decryption operations. The work is implemented by increasing the hardware function of the AES calculation circuit. For example, please refer to FIG. 5 , which is a schematic diagram of another embodiment of the HDCP data decryption circuit of the present invention. The HDCP data decryption circuit 500 includes a computing unit 510 and an AES computing circuit 520 . The AES calculation circuit 520 generates intermediate data p and intermediate data q according to the virtual random number r _iv , the session key K _s and the constant lc ₁₂₈ , and then takes the intermediate data p and intermediate data q for calculation to obtain the final 128 yuan for decryption bit key. The calculation unit 510 obtains the initial position information P and the length data L of the bearer data according to the PES header data, outputs the information to the AES calculation circuit 520 , and sends a control signal Ctrl to trigger the decryption process of the AES calculation circuit 520 . The subsequent decryption procedure of the AES computing circuit 520 is the same as the embodiment of the previous device item, so it will not be described again. The method steps corresponding to this embodiment are similar to the steps disclosed in the flow chart of FIG. It is implemented by means of hardware; and step S430 is still implemented by means of software.

In other embodiments, the work or steps of the decryption program may be allocated in other ways between software and hardware, but in order to maintain the flexibility of decrypting bearer data of different lengths, that is, to handle when the length of bearer data is different In order to decrypt the integer multiple of the length of the data segment (the aforementioned embodiment is 16 bytes), the computing unit of the present invention should at least perform step S430, that is, generate the length information and the starting position of the carried data according to the PES header data information. The rest of the work or steps can be flexibly allocated and designed between software and hardware without departing from the scope of the present invention.

Since those skilled in the art can understand the implementation details and changes of the method invention in FIG. 4 through the disclosure of the device invention in FIG. Under the premise of practicality, repeated descriptions are omitted here. Please note that the shapes, sizes, proportions, and sequence of steps of the components in the preceding illustrations are only illustrative, and are for those skilled in the art to understand the present invention, and are not intended to limit the present invention. In addition, those skilled in the art can selectively implement some or all of the technical features of any embodiment according to the disclosure of the present invention and their own needs, or selectively implement a combination of some or all of the technical features of multiple embodiments, In this way, the flexibility of the implementation of the present invention is increased. Furthermore, although the above-disclosed embodiments take transport stream packets as an example, this is not a limitation of the present invention. Persons skilled in the art can appropriately apply the present invention to encrypted data transmitted in other formats according to the disclosure of the present invention.

Although the embodiments of the present invention are as described above, these embodiments are not intended to limit the present invention, and those skilled in the art can make changes to the technical characteristics of the present invention according to the explicit or implicit content of the present invention. All these changes may belong to the scope of patent protection sought by the present invention. In other words, the scope of patent protection of the present invention shall be subject to what is defined in the claims of this specification.

Claims (16)

1. a kind of data deciphering circuit, for decrypting current encryption data package, which includes the first mark Head data and carrying data, the data deciphering circuit include：

Arithmetic element is used for generating the first data according to first header data and pseudorandom numbers, according to session key and often Number generates the second data, and the length information and start position information of the carrying data are generated according to first header data；Its In, which generates first data, second data, the length information and the start bit by program code is executed Confidence ceases；And

Counting circuit is decrypted, the arithmetic element is coupled, is used for generating decruption key according to first data and second data, with And the carrying data are obtained from the current encryption data package according to the start position information and the length information, utilize the solution The close secret key decryption carrying data, and a part for the carrying data is decrypted with preset data length every time；Wherein

Immediately secondary encryption data package after the current encryption data package, and when the non-decryption portion of carrying data is less than should Preset data length, carrying data of the decryption counting circuit according to the current encryption data package, secondary encryption data package Carrying data and secondary encryption data package carrying data start position information, generation meet the preset data length Data to be decrypted are simultaneously decrypted.

2. data deciphering circuit as described in claim 1, which is characterized in that the length of the current encryption data package is fixed simultaneously And the second header data is further included, the length of second header data is fixed, and first header data includes that header data is long Information is spent, which generates the length information and initial position of the carrying data according to the header data length information Information.

3. data deciphering circuit as described in claim 1, which is characterized in that the decryption program of the decryption counting circuit meets The specification of HDCP.

4. data deciphering circuit as described in claim 1, which is characterized in that the encryption data package is transmission stream format Package.

5. a kind of data decryption method, for decrypting current encryption data package, which includes the first mark Head data and carrying data, the data decryption method include：

Following procedure is executed in the way of executing program code by arithmetic element：

The first data are generated according to first header data and pseudorandom numbers；

The second data are generated according to session key and constant；And

The length information and start position information of the carrying data are generated according to first header data；

First data, second data, the length information and the start position information are sent to decryption counting circuit；And

It controls the decryption counting circuit and executes following procedure：

Decruption key is generated according to first data and second data；

The decryption counting circuit is controlled to take from the current encryption data package according to the start position information and the length information Obtain the carrying data；And

The decryption counting circuit is controlled using the decryption key decryption carrying data, and every time should with the decryption of preset data length Carry a part for data；Wherein

Immediately secondary encryption data package, the data decryption method also include after the current encryption data package：

When the non-decryption portion of carrying data be less than the preset data length, control the decryption counting circuit according to the current encryption The carrying data of the carrying data of data packet, the carrying data of secondary encryption data package and secondary encryption data package rise Beginning location information generates the data to be decrypted for meeting the preset data length and is decrypted.

6. data decryption method as claimed in claim 5, which is characterized in that the length of the current encryption data package is fixed simultaneously And the second header data is further included, the length of second header data is fixed, and first header data includes that header data is long Information is spent, wherein this generates the length information of the carrying data and the step of the start position information according to first header data Suddenly it is length information and the start position information that the carrying data are generated according to the header data length information.

7. data decryption method as claimed in claim 5, which is characterized in that the decryption program of the decryption counting circuit meets The specification of HDCP.

8. data decryption method as claimed in claim 5, which is characterized in that the encryption data package is transmission stream format Package.

9. a kind of data deciphering circuit, for decrypting current encryption data package, which includes the first mark Head data and carrying data, the data deciphering circuit include：

Arithmetic element, for generating the length information and start position information of the carrying data according to first header data；Its In, which generates the length information and the start position information by program code is executed；And

Counting circuit is decrypted, the arithmetic element is coupled, for generating decruption key, and according to the start position information and the length Degree information obtains the carrying data from the current encryption data package, and using the decryption key decryption carrying data, and A part for the carrying data is decrypted with preset data length every time；Wherein

Immediately secondary encryption data package after the current encryption data package, and when the non-decryption portion of carrying data is less than should Preset data length, carrying data of the decryption counting circuit according to the current encryption data package, secondary encryption data package Carrying data and secondary encryption data package carrying data start position information, generation meet the preset data length Data to be decrypted are simultaneously decrypted.

10. data deciphering circuit as claimed in claim 9, which is characterized in that the length of the current encryption data package is fixed And the second header data is further included, the length of second header data is fixed, and first header data includes header data Length information, the arithmetic element generate length information and the start bit of the carrying data according to the header data length information Confidence ceases.

11. data deciphering circuit as claimed in claim 9, which is characterized in that the decryption program of the decryption counting circuit meets The specification of HDCP.

12. data deciphering circuit as claimed in claim 9, which is characterized in that the encryption data package is transmission stream format Package.

13. a kind of data decryption method, for decrypting current encryption data package, which includes the first mark Head data and carrying data, the data decryption method include：

Arithmetic element is controlled in a manner of executing program code, the length letter of the carrying data is generated according to first header data Breath and start position information；

The length information and the start position information are sent to decryption counting circuit；And

It controls the decryption counting circuit and executes following procedure：

Generate decruption key；

According to the start position information and the length information carrying data are obtained from the current encryption data package；And

Using the decryption key decryption carrying data, and a part for the carrying data is decrypted with preset data length every time； Wherein

Immediately secondary encryption data package, the data decryption method also include after the current encryption data package：

When the non-decryption portion of carrying data be less than the preset data length, control the decryption counting circuit according to the current encryption The carrying data of the carrying data of data packet, the carrying data of secondary encryption data package and secondary encryption data package rise Beginning location information generates the data to be decrypted for meeting the preset data length and is decrypted.

14. data decryption method as claimed in claim 13, which is characterized in that the length of the current encryption data package is fixed And the second header data is further included, the length of second header data is fixed, and first header data includes header data Length information, the wherein length information and the start position information that the carrying data are generated according to first header data Step is that the length information and the start position information of the carrying data are generated according to the header data length information.

15. data decryption method as claimed in claim 13, which is characterized in that the decryption program of the decryption counting circuit meets The specification of HDCP.

16. data decryption method as claimed in claim 13, which is characterized in that the encryption data package is transmission stream format Package.