DE10161769A1 - Method and device for providing key fields for an encryption or decryption module for real-time encryption of data, in particular multimedia data - Google Patents

Abstract

The invention relates to a method for providing key fields (10, 11) for an encryption or decryption device (3) for real-time encryption of data, in particular multimedia data, with the steps: alternating provision of a respective key field (10, 11 ) in a first and second area (8, 9) of a memory module (19) by means of a key calculation module (21) and alternately accessing the respective key field (10, 11) in the first and second area (8, 9) of the memory module (19 ) by the encryption or decryption module (3); wherein during access to the key field (10, 11) in one of the two areas (8, 9) the key field (10, 11) is provided in the other of the two areas (8, 9). The invention also relates to a device by means of which the method can be carried out.

Description

The present invention relates to methods and a Device for providing key fields for a connection or Decryption module for real-time encryption of data, especially multimedia data.

The encryption of audiovisual data, primarily for Protection of content by their providers, for example for Avoiding unauthorized copies of DVDs or the controller access to certain program content by one limited number of paying subscribers to pay TV is one Need.

In the case of DVD, there are mainly two Encryption procedure used: The CSS procedure (CSS Content Scrambling System) is used to encrypt the data on the DVD, while the DTCP process (DTCP Digital Transmission Content Protection) to encrypt DVD content whose transmission is via digital bus systems. In doing so different cryptographic algorithms, e.g. B. Signature process, symmetrical and asymmetrical Encryption algorithms used.

In the case of symmetrical processes, the respective (secret) Key or the key field or the procedure to get out common initialization values these keys generate, both on the sending and the receiving side be known.

A problem that arises is the necessary exchange this key, which is a potential target represents such symmetrical cryptosystems. To the To increase the security of such systems and thus the requirements modern standards for the distribution of multimedia data the keys can be renewed at certain intervals become. This key change then has to be done additionally be signaled. It is also a secured one Transfer of new keys necessary or (for practice relevant) transmission and reception side have in advance over agreed an algorithm, which from the old key (field) generated a new key or a new key field.

One problem in this case, however, is that the Generation of new key fields and real-time encryption the audio-visual data must run completely in parallel.

Fig. 3 shows a conventional encryption algorithm with cyclically changing keys, such as in the DTCP system. The plain text data 1 are fed to an encryption hardware 3 , which forwards the encrypted data 2 to a decryption hardware 4 for decryption in order to generate plain text data 1 therefrom. Authentication and key exchange take place once at the beginning of the data transmission via the initialization key 5 . Both the encryption hardware 3 and the decryption hardware 4 can perform a cyclic recalculation 7 of the keys, provided that a key change is signaled on the transmitter side within the data stream.

It is an object of the present invention to provide a method for Generation of key fields for real-time encryption of data to provide the disadvantages and targets the previous method described above for Eliminate key calculation.

According to the invention, this object is achieved in claim 1 specified methods for generating key fields for Encryption of data solved in real time.

The idea on which the present invention is based exists in it the actual encryption of the multimedia data from the recalculation of the keys in different modules separate. This separation makes it possible to do both tasks by execution on separate processing units parallelize. The exchange of key fields between the module responsible for their generation and the actual one Encryption module is done via a shared Storage area.

In the present invention, this is mentioned Problem solved in particular that an encryption of the Multimedia data and parallel to it (thus also complete decouples) the periodic change of the keys is carried out. The key fields to be generated are included generated in a separate module.

Are now the two processing units that the Perform encryption or key field generation, coupled by a suitable medium or method so that they can exchange their (key) data, so that's it Encryption unit possible, periodically and in real time to new ones generated by the key calculation module Switch key. This new key field can then from the encryption module to further encryption without Time delay can be used.

By decoupling key generation and Key calculation achieves an uninterrupted Encryption and thus the real-time capability of the process. Since the actual calculation of the keys now parallel to Encryption process takes place, the key calculation it is not time-critical and can also be used on one less powerful processing unit can be realized. So that can Key calculation module either turn out smaller or still take on additional functions that were previously not possible.

The procedure for generating key fields for Data encryption consists of calculating the Key field in a key calculation module, the exchange of Key fields between the key calculation module and Encryption module via a shared module and the Encrypt the data in an encryption module together.

There are advantageous ones in the subclaims Developments and improvements to the subject matter of the invention.

According to a preferred development, the calculation of the Key field and the encryption of the data in parallel.

According to a further preferred development, this is shared module to exchange key fields shared storage area.

According to a further preferred development, the data which are encrypted, multimedia data, especially video and / or audio data.

According to a further preferred development, this is Process essentially using software or hardware or a Mixed form of software and hardware modules implemented.

According to a further preferred development, the encrypted data via an electrical or optical Bus system forwarded.

Embodiments of the invention are in the drawings shown and in the description below explained.

Show it

Fig. 1 is a schematic representation of the data exchange via a dual-port memory device for explaining a first embodiment of the present invention;

Fig. 2 is a block diagram of the modules involved in the procedure for explaining an embodiment of the present invention; and

3 is a block diagram of a conventional encryption algorithm with cyclically changing keys. (Example: DTCP) system.

In the figures, the same reference symbols denote the same or functionally identical components.

Fig. 1 shows the schematic representation of the data exchange via a dual port memory device as a first embodiment of the present invention.

A data exchange shown in FIG. 1 is explained on the basis of a chronological sequence of repeating states (phases) of a data exchange module 19 . This data exchange module 19 must be designed in such a way that the key calculation module 13 , 21 can both gradually store the newly calculated key field 11 on the one hand in the data exchange module 19 and the encryption algorithm on the other hand can still access the old keys 10 .

After the key calculation module 13 , 21 has calculated a new key field 11 , it signals this to an encryption unit 12 , 3 . This encryption unit 12 , 3 is then responsible for switching over to the new key field 11 itself. Physically, this can be done, for example, by switching the memory banks 8 , 9 of the dual-port memory module 19 . While in phase A the encryption algorithm reads its keys from the key field 10 stored in memory bank 18 , the key calculation module 13 , 21 writes the newly generated keys 11 into memory bank 29 .

After the key calculation module 13 , 21 has informed the encryption algorithm of the successful calculation of the new key field 11 , the encryption algorithm can switch to memory bank 29 at the right time, with which phase B begins. The encryption algorithm now reads its keys from the key field 10 stored in memory bank 29 , and the key calculation module writes the new key field 11 in bank 18 . Then he can switch back to bank 19 . Phase A begins again.

While the encryption module 12 , 3 uses the key field 10 stored in a bank 8 , 9 of the dual-port memory module 19 , the key calculation module 13 , 21 is busy generating the new key field 11 in the second bank 8 , 9 . The shared memory 19 can be used to switch to the new key field 11 , and the key calculation module 13 , 21 and the encryption module 12 , 3 can work in parallel.

Fig. 2 is a block diagram of the modules involved in the procedure and their relationship to each other shows according to a preferred embodiment. The method for generating key fields according to the present invention is based on a split into three functional blocks. This splitting enables real-time capability of the method to be achieved on the one hand, and on the other hand the actual (re) calculation of the keys becomes time-uncritical and can thus be implemented in software, for example in a microprocessor 21 .

The microprocessor 21 receives an initialization key 5 from the communication counterpart via a corresponding interface. Starting from this initialization key 5 , a key field calculation algorithm implemented in software on the microcontroller 21 is started. This key field calculation algorithm calculates a key field 11 from the initialization key 5 . Since this calculation is independent of the encryption process due to the partitioning of the blocks, this is not time-critical within certain limits. Depending on the selected encryption method and the resulting times between a change of keys 10 , 11 , the calculation of the new key field 11 only has to be completed within the time between two key changes.

The keys 10 , 11 calculated by the key calculation module by software must now be stored in the module 19 for the data exchange between the key calculation module 13 , 21 and the encryption module 12 , 3 . This data exchange module 19 must be designed in such a way that the key calculation module 13 , 21 can both gradually store the newly calculated key field 11 on the one hand in the data exchange module 19 and the encryption algorithm on the other hand can still access the old keys 10 . A conceivable type of implementation in hardware is a dual-port memory module. In software, a shared memory area could be considered. After the key calculation module 13 , 21 has calculated the new key field 11 , it signals this to the encryption module 12 , 3 . The encryption module 12 , 3 is then responsible for switching over to the new key field 11 itself. The data flow in the encryption module 3 is dependent on the input data stream 16 , an input clock 14 and a clock 18 for the encryption algorithm, from which the output data stream 17 and the associated output clock 15 result. The encrypted output data stream 17 can now be forwarded to a bus system, in particular of an electrical or optical type.

Although the present invention is based on the above preferred embodiments has been described, it is on it not limited, but in a variety of ways modifiable. In particular, the method for generating Key fields for encrypting data in real time completely in software, for example on a general Purpose processor (e.g. Pentium) is running, or completely in Hardware or, as in the present exemplary embodiment, partly realizable in hardware and partly in software.

The invention is also not limited to the application possibilities mentioned. REFERENCE SIGN LIST 1 plain text data
2 Encrypted data
3 encryption module
4 decryption module
5 initialization key
6 Authentication and key exchange (once at the start of data transfer)
7 Cyclic recalculation of the keys (key change is signaled on the transmitter side within the data stream)
8 bank 1
9 bank 2
10 key field "old"
11 key field "new"
12 To the encryption module
13 From the key calculation module
A phase "A"
B phase "B"
t timeline "t"
14 input clock
15 output clock
16 input data
17 output data
18 clock for encryption algorithm
19 dual-port RAM (key exchange module)
20 handshake signals
21 Key generation / calculation

Claims (9)

1. A method for providing key fields ( 10 , 11 ) for an encryption or decryption module ( 3 ) for real-time encryption of data, in particular multimedia data, with the steps:
alternately providing a respective key field ( 10 , 11 ) in a first and second area ( 8 , 9 ) of a memory module ( 19 ) by a key breaking module ( 21 ); and
alternate access to the respective key field ( 10 , 11 ) in the first and second area ( 8 , 9 ) of the memory module ( 19 ) by the encryption or decryption module ( 3 );
wherein during access to the key field ( 10 , 11 ) in one of the two areas ( 8 , 9 ) the key field ( 10 , 11 ) is provided in the other of the two areas ( 8 , 9 ). 2. The method according to claim 1, characterized in that the calculation of the key field ( 10 , 11 ) and the encryption of the data run in parallel. 3. The method according to claim 1 or 2, characterized in that the shared memory module ( 19 ) is a shared memory area, in particular a dual-port RAM module. 4. The method according to claim 1, characterized, that the encryption process runs without interruption. 5. The method according to one or more of the preceding claims, characterized, that multimedia data, in particular audio and / or video data, is encrypted become. 6. The method according to one or more of the preceding claims, characterized in that in the encryption or decryption module ( 12 , 3 ) further functions that are independent of the encryption or decryption process are carried out. 7. Device for providing key fields ( 10 , 11 ) for an encryption or decryption device ( 3 ) for real-time encryption of data, in particular multimedia data, with:
a key calculation device ( 21 ) for alternately providing a respective key field ( 10 , 11 ) in a first and second area ( 8 , 9 ) of a memory device ( 19 );
an encryption or decryption device ( 3 ) for alternately accessing the respective key field ( 10 , 11 ) in the first and second area ( 8 , 9 ) of the storage device ( 19 );
a memory device ( 19 ) for providing the key field ( 10 , 11 ) in one of the areas ( 8 , 9 ) during access to the key field ( 10 , 11 ) in the other of the two areas ( 8 , 9 ). 8. The device according to claim 7, characterized in that the memory device ( 19 ) is a shared memory area, in particular a dual-port RAM module. 9. The device according to claim 7, characterized in that said device Multimedia data, in particular audio and / or video data, encrypted.