KR100845835B1 - Multi level scramble and descramble system - Google Patents

Abstract

The present invention relates to a multi-level scramble and desramble system for constructing multiple block encryption and decryption modules in a complex manner, and encrypting or decrypting block by block by different encryption and decryption algorithms. An encryption / decryption unit configured to configure a plurality of encryption and decryption modules in parallel; And an encryption controller configured to analyze the encryption / decryption module using the encryption / decryption module using order and information, such as the number of repetitions, to select an encryption and decryption module to perform actual encryption or decryption, and to repeat the encryption by a predetermined number of repetitions. It is characterized by the configuration. Therefore, according to the present invention, since the encryption or decryption step can be controlled according to the encryption strength desired by the user, the security strength can be increased, and real-time processing is possible by implementing the block encryption and decryption module in hardware, and the current transport stream By embedding most of the block encryption and decryption modules used in the module, it can be used as a descrambler or scrambler for a specific application.

Multilevel encryption and decryption, order of use, number of iterations

Description

Multi level scramble and descramble system

1 is a block diagram of a typical DES encryption and decryption module

2 is a block diagram of a typical AES encryption and decryption module

3 is a block diagram of a general CS encryption and decryption module

4 is a block diagram of a general MULTI2 encryption and decryption module

5 is a block diagram illustrating a multi-level encryption and decryption system according to the present invention.

6 is a detailed block diagram of the encryption control unit of FIG.

7 is a detailed configuration diagram of the crypt_mode unit of FIG.

* Explanation of symbols for the main parts of the drawings

100: encryption control unit 101: first selection unit

102: encryption / decryption unit 103: second selection unit

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an encryption and decryption system, and more particularly, to a multilevel encryption and decryption system that can increase encryption strength by using multiple block encryptions.

Recently, as the processing and exchange of information based on the Internet has become more active and the importance of protecting personal information has increased, the importance of cryptography and decoders is increasing day by day. Various technical devices for managing and protecting such information have been proposed, and various security systems based on block encryption or public key encryption algorithms are currently being introduced.

In the related art, encryption modules using respective block encryption algorithms have been designed as shown in FIGS. 1 to 4, and the common point is that encryption and decryption are performed on a block basis.

FIG. 1 shows an encryption and decryption module using Data Encryption Standard (DES) encryption and decryption algorithms, which are primarily used in US satellite digital TVs (eg, Direc TVs).

FIG. 2 shows an encryption and decryption module using AES (Advanced Encryption Standards) encryption and decryption algorithms, which are mainly used in US satellite digital TVs (eg, Direc TVs), like DES.

3 shows an encryption and decryption module using a common scramble (CS) encryption and decryption algorithm, which is mainly used in European digital TVs.

4 shows an encryption and decryption module using a multi 2 encryption and decryption algorithm, which is mainly used in Japanese digital TV.

That is, the DES encryption algorithm of FIG. 1 uses a 56-bit encryption scheme, while AES uses three schemes of 128, 192, and 256 bits.

Referring to the input / output signals of each encryption and decryption module in FIGS. 1 to 4, a signal input to each encryption and decryption module includes key_load for determining a key load time, encrypt_en for determining whether an encryption operation or a decryption operation, and key data. key_data, a wsel [1: 0] signal indicating the size of a key value, stream data (MPEG system stream, DSS stream, other streams) for encryption or decryption in units of blocks Data_in [7: 0], the data valid Signal Data_valid and the like. The output signal includes the output data Out_data [7: 0] and the output data valid signal Out_valid obtained by converting the encrypted or decrypted data back to the byte unit.
The encryption and decryption modules of FIGS. 1 to 4 are used independently.
However, due to an increase in computing power, an encryption system using a simple block encryption algorithm as shown in FIGS. 1 to 4 described above has a problem in that encryption is more likely to be broken.

delete

delete

The present invention is to solve the above problems, by using a combination of multiple block encryption module that can process a real-time input stream in multiple stages, it is possible to increase the encryption strength and implement an encryption function for each purpose An encryption and decryption system is provided.

An example of a multi-stage encryption and decryption system according to the present invention for achieving the above object is a signal that determines whether a plurality of encryption and decryption modules are configured in parallel, each encryption and decryption module is an encryption operation or decryption operation. An encryption / decryption unit that performs one of an encryption operation and a decryption operation on a block-by-block basis for the input data; And selecting an encryption and decryption module to perform actual encryption or decryption by analyzing information such as the use order and the number of repetition of the encryption and decryption module of the encryption / decryption unit, and controlling to repeat the encryption or decryption by a predetermined number of repetitions. It comprises a control unit.

In this case, the encryption / decryption unit includes at least two of a Data Encryption Standard (DES) encryption / decryption module, an Advanced Encryption Standards (AES) encryption / decryption module, a common scramble (CS) encryption / decryption module, and a MULTI2 encryption / decryption module in parallel. It consists of.
In addition, the order of use of the encryption and decryption module and the encryption and decryption module and the number of iterations to be used by the encryption / decryption unit may be set by the user or by the system itself.

delete

The encryption control unit may further include a control / status register unit for storing control data and indicating a current state of the system; A control unit for converting input data in byte units into data in block units or converting a result value in block units into data in byte units; And a host interface unit for communication with an external host.

In this case, the control / status register section includes: a key register for storing a key value and an initial vector value; A key_load register for determining when to load a key; An encrypt_en register for determining whether to encrypt or decrypt; A bypass register for determining whether to perform encryption / decryption operation or bypass for the currently input stream; A register for determining total_count, front_skip_count, and load_count to selectively encrypt / decrypt only the actual payload portion of the input stream; And a crypt_mode unit for determining encryption strength such as a user's desired encryption / decryption module selection, repetition frequency, and the like.

The crypt_mode unit may include a crypt_order register for storing an order of use of an encryption / decryption module of the encryption / decryption unit. And a crypt_repeat register that stores the number of repetitions of the encryption / decryption module of the encryption / decryption unit.

In addition, the encryption / decryption unit may decrypt by setting the key value set at the time of encryption and each register value of the crypt_mode unit.

Other objects, features and advantages of the present invention will become apparent from the following detailed description of embodiments taken in conjunction with the accompanying drawings.

Hereinafter, the configuration and operation of embodiments of the present invention will be described with reference to the accompanying drawings, and the configuration and operation of the present invention shown and described by the drawings will be described as at least one embodiment, whereby The technical spirit of the present invention and its core configuration and operation are not limited.

FIG. 5 is a block diagram illustrating a multi-level encryption and decryption system according to the present invention. The encryption / decryption unit 102 includes four block encryption and decryption modules DES, AES, CS, and MULTI2 in parallel. Selects an encryption and decryption module necessary for actual encryption or decryption by analyzing the encryption method, the number of repetitions, and the encryption strength set by the user, and then repeats the encryption and decryption using the result value. It comprises a cryptographic control unit 100 for controlling whether or not to use.

In this case, two selection units 101 and 103 are provided between the encryption control unit 100 and the encryption / decryption unit 102. The first selection unit 101 is a multiplexer and the encryption control unit 100. The block data In_block is input to the corresponding encryption and decryption module according to the crypt_sel signal output from. The second selector 103 is a demultiplexer and selects one of output data (out_block) of each encryption and decryption module according to the crypt_sel signal output from the encryption control unit 100 and outputs the selected output to the encryption control unit 100. do.

In this case, each module of the encryption / decryption unit 102 is implemented in hardware to enable real-time processing, and performs an encryption or decryption operation in units of blocks. Here, the unit of the block of the DES, CS, MULTI2 encryption module is 64 bits, AES is 128 bits.

The encryption control unit 100 stores the control data as shown in FIG. 6 and the control / status register unit 601 for indicating the current system state, and converts input data in units of bytes into data in units of blocks or results in units of blocks. The controller 602 converts the data into byte units and a host interface 603 for communication with an external host.

In FIG. 6, the control / status register unit 601 includes a key register for storing a key value and an initial_vector value (some kind of key value), a key_load for determining a key load time, an encrypt_en for determining whether an encryption operation or a decryption operation, and a current input. Bypass to decide whether to perform encryption or decryption operation on the stream or bypass, register to determine total_count, front_skip_count, load_count so that only actual payload portion of the input stream can be selectively encrypted or decrypted, And a crypt_mode unit for determining the encryption strength such as the module selection of the encryption desired by the user and the number of repetitions. That is, the user may determine the encryption strength such as the module selection of the encryption and the number of repetitions, or the encryption strength such as the module selection of the encryption and the number of repetitions may be determined by the system itself.

7 is a block diagram illustrating a crypt_mode unit for determining encryption strength.

A module usable in the crypt_mode unit is assumed to be four modules of DES, AES, CS, and MULTI2 as an example. Here, the usable module is not limited to the four encryption and decryption modules described above, and any encryption and decryption module using a block encryption algorithm may be used. In addition, the number of available modules may be smaller or larger than the four modules described above.

In this case, since each encryption module has different encryption strengths and results according to the order of use and the number of repetitions, the crypt_mode unit may include a crypt_order register for determining the order of use and a crypt_repeat register for determining the number of repetitions.

The crypt_order register is composed of the des_order / aes_order / cs_order / multi2_order register, and the user must set the order between 1 and 4 without overlapping. In this case, when the crypt_order register is 0, it means that the corresponding module is not used.

The crypt_repeat register is composed of the des_repeat / aes_repeat / cs_repeat / multi2_repeat register, and the number of repetitions can be set from 0 to a maximum of 255.
However, since the crypt_repeat register has a decisive influence on the encryption or decryption speed, the user should select an appropriate number of repetitions in consideration of the desired encryption strength and real-time processing.

When the crypt_order register is 0, that is, when the corresponding module is not used, the repeat register is don't care.

The above-described system basically uses a block encryption and decryption module to implement a system that can adjust the level in multiple levels according to the encryption or decryption strength desired by the user.

However, by selecting each encryption and decryption module and adjusting the number of repetitions, it is possible to perform a function of a descrambler or scrambler for a real-time transport stream.

For example, for DIRECTV-DES, the crypt_order register (des, aes, cs, multi2) = 1/0/0/0, and the crypt_repeat register (des, aes, cs, multi2) = 1/0/0/0 When set and implemented, the same result as in FIG. 1 may be obtained.

ATSC-3DES can be implemented by setting the crypt_order register (des, aes, cs, multi2) = 1/0/0/0 and the crypt_repeat register (des, aes, cs, multi2) = 3/0/0/0. have.

In the case of DVB-CS, the crypt_order register (des, aes, cs, multi2) = 0/0/1/0 and the crypt_repeat register (des, aes, cs, multi2) = 0/0/1/0 are set. Can be used.
In the case of ARIB-MULTI2, the crypt_order register (des, aes, cs, multi2) = 0/0/0/1 and the crypt_repeat register (des, aes, cs, multi2) = 0/0/0/1 can be used. have.
In case of AES proposed as next generation encryption algorithm, if you want to use TRIPLE_AES (3AES), crypt_order register (des, aes, cs, multi2) = 0/1/0/0, crypt_repeat register (des, aes, cs, multi2) Can be set to = 0/3/0/0.

That is, if the crypt_order register and the crypt_repeat register value are set as described above, the existing transport stream encryption and decryption function can be provided. Therefore, even a specific application can cope with the encryption and decryption system according to the present invention. Will be.

If the user uses all four algorithms to increase the strength of information protection and sets the number of encryption iterations to 3, the crypt_order register (des, aes, cs, multi2) = 1/2/3/4, the crypt_repeat register (des, aes, cs, multi2) = 3/3/3/3 or crypt_order register (des, aes, cs, multi2) = 2/1/4/3, crypt_repeat register (des, aes, cs, multi2) = 3 / It can be set to 3/3/3.

For example, if crypt_order register (des, aes, cs, multi2) = 2/1/4/3 and crypt_repeat register (des, aes, cs, multi2) = 3/3/3/3, the encryption The controller 100 generates and outputs a selection signal crypt_sel to select the encryption modules in the order described above to the first selector 101. At this time, since the block data of the module on which encryption has been performed should be output, the same selection signal crypt_sel is output from the second selection unit 103.
Therefore, the encryption / decryption unit 102 performs encryption or decryption in the order of the AES encryption module 102b, the DES encryption module 102a, the CS encryption module 102c, and the MULTI2 encryption module 102d. Each encryption module repeats the encryption or decryption process three times.

As in the example above, the system can control the strength and level of encryption by setting the encryption module to be used, the order of use of the encryption module, and the number of repetitions to the level desired by the user, and through the crypt_order and crypt_repeat register settings. It can also be used to implement descramblers and scramblers for specific applications.

At this time, since the crypt_mode part is important for security similarly to the key value, the crypt_mode part must be managed at the same level as the key value. When decrypting, the crypt_mode part is set by setting the key value and crypt_mode set at the time of encryption.

As described above, according to the multi-level encryption and decryption system according to the present invention, since the encryption or decryption step can be controlled according to the encryption strength desired by the user, the security strength can be increased.
In addition, the present invention enables real-time processing by implementing the block encryption and decryption module in hardware, and by using most block encryption and decryption modules used in the current transport stream, it can be used as a descrambler or scrambler for a specific application. Do.

Therefore, the present invention can be used for all information encryption devices requiring real time encryption, and in particular, it can be widely used for paid stream encryption and personal information encryption for limited reception systems.

Those skilled in the art will appreciate that various changes and modifications can be made without departing from the spirit of the present invention.

Therefore, the technical scope of the present invention should not be limited to the contents described in the embodiments, but should be defined by the claims.

Claims (10)

A plurality of encryption and decryption modules are configured in parallel, and each encryption and decryption module performs encryption / decryption operations on a block basis for input data according to a signal for determining whether the operation is an encryption operation or a decryption operation. A decoder; And An encryption control unit that selects an encryption and decryption module to perform actual encryption or decryption by analyzing information such as the use order and the number of repetition of the encryption and decryption module of the encryption / decryption unit, and controls to repeat encryption or decryption by a predetermined number of repetitions Multi-level encryption and decryption system comprising a. The method of claim 1, wherein the encryption / decryption unit And at least two of the DES encryption and decryption module, the AES encryption and decryption module, the CS encryption and decryption module, and the MULTI2 encryption and decryption module are configured in parallel. The method of claim 1, A first selection unit and a second selection unit are further provided between the encryption control unit and the encryption / decryption unit. The first selector selects and outputs block data output from the encryption controller to a corresponding encryption and decryption module according to a selection signal crypt_sel output from the encryption controller. The second selector selects and outputs encrypted or decrypted block data from one of a plurality of encryption and decryption modules according to the selection signal crypt_sel output from the encryption control unit, and outputs the block data to the encryption control unit. . The method of claim 1, Multi-level encryption and decryption system, characterized in that the information, such as the encryption and decryption module to be used in the encryption / decryption module, the order of use of the encryption and decryption module, and the number of iterations are set by the user or the system itself. The method of claim 1, The encryption control unit includes a control / status register unit for storing control data and indicating a current state of the system; A control unit for converting input data in byte units into data in block units or converting a result value in block units into data in byte units; And Multi-level encryption and decryption system comprising a host interface for communicating with an external host. The method of claim 5, The control / status register section includes a key register for storing a key value and an initial vector value, a key_load register for determining a key load time, an encrypt_en register for determining whether an encryption operation or a decryption operation is performed, an encryption or decryption operation for a currently input stream. And at least one of a bypass register for determining whether to execute or bypass, and a crypt_mode section for determining the encryption strength of information such as the user's desired encryption and decryption module selection and the number of repetitions. Multilevel encryption and decryption system. The method of claim 6, The crypt_mode unit includes a crypt_order register for storing an order of use of an encryption and decryption module of the encryption / decryption unit; And And a crypt_repeat register for storing the number of repetitions of the encryption and decryption module of the encryption / decryption unit. The method of claim 7, wherein The crypt_order register includes a des_order register for storing the order of use of the DES encryption and decryption module, an aes_order register for storing the order of use of the AES encryption and decryption module, and the order of use of the CS encryption and decryption module. Including the cs_order register for storing the second order and the multi2_order register for storing the order of use of the MULTI2 encryption and decryption module, but not the encryption and decryption module for a register having a zero value in the crypt_order register. Multi-level encryption and decryption system characterized by. The method of claim 7, wherein The crypt_repeat register includes a des_repeat register that stores the number of repetitions of the DES encryption and decryption module, an aes_repeat register that stores the number of repetitions of the AES encryption and decryption module, a cs_repeat register that stores the number of repetitions of the CS encryption and decryption module, and MULTI2 encryption and decryption. And a multi2_repeat register to store the number of repetitions of the module. The method of claim 1, And encrypting and decrypting the encryption / decryption unit by setting the key value set at the time of encryption and each register value of the crypt_mode unit.

Images