System and method for securing data
View Patent ↗Systems and systems that protect data are provided. In one embodiment, a system may include, for example, a memory and a processor. The memory may store, for example, encrypted data. The processor may be coupled to the memory and may include, for example, a decryptor that decrypts the encrypted data. The decryptor may be adapted, for example, to variably bit roll the encrypted data, to fixedly bit shuffle the bit-rolled data, to add a first key to the bit-shuffled data and to process the added data with a second key.
1. A system for protecting data, comprising:
a memory in which encrypted data is stored; and
a processor coupled to the memory, the processor comprising a decryptor that decrypts the encrypted data, the decryptor being adapted to variably bit roll the encrypted data based on at least an original key, to fixedly bit shuffle the bit-rolled data, to add a first key to the bit-shuffled data and to process the added data with a second key,
wherein the decryptor receives the original key and the data address,
wherein the processor generates multiplexer selection bits and the first key, wherein the first key is a shifted version of the original key, wherein the shifting is based on at least the data address,
wherein the decryptor is adapted to variably bit roll the encrypted data by rotating bits within particular roll regions of encrypted data based on the multiplexer selection bits,
wherein the encrypted data is split into the particular roll regions,
wherein each roll region is characterized by the following characteristics: a respective roll skip, a respective roll length and a respective roll,
wherein each of the respective characteristics of the corresponding roll region is determined from different bits of the original key, and
wherein the respective roll skip determines where in the corresponding roll region to begin the roll and which portion of the roll region is not rolled, and
wherein the respective roll amount determines the number of bit positions that are rolled around a sub-region of the corresponding roll region defined by the roll length.
2. The system according to claim 1 , wherein the decryptor is adapted to perform a single pipeline stage decryption.
3. The system according to claim 1 , wherein the decryptor comprises a bit roller that rotates data in one or more roll regions of the incoming data based on the data address related to the received encrypted data and a key related to the first key.
4. The system according to claim 3 , wherein the key comprises a shifted version of the first key.
5. The system according to claim 3 , wherein the bit roller comprises a plurality of multiplexers.
6. The system according to claim 5 ,
wherein each multiplexer comprises a multiplexer selection input,
wherein multiplexer selection bits are input at the multiplexer selection input, and
wherein the multiplexer selection bits are generated based on the address related to the received encrypted data and the key related to the first key.
7. The system according to claim 1 , wherein the decryptor comprises a fixed bit shuffler.
8. The system according to claim 7 , wherein the fixed bit shuffler comprises a fixed, hard-coded bit shuffler.
9. The system according to claim 7 , wherein the fixed bit shuffler does not add a gate delay to the decryptor.
10. The system according to claim 1 , wherein the decryptor comprises one or more two-bit adders.
11. The system according to claim 10 , wherein each two-bit adder comprises three exclusive OR (XOR) gates and an AND gate.
12. The system according to claim 1 , wherein the decryptor comprises an XOR block.
13. The system according to claim 12 , wherein the XOR block comprises one or more XOR gates.
14. The system according to claim 13 , wherein each XOR gate comprises a first input and a second input, the first input receiving a bit of the second key, the second input receiving a bit of the added data.
15. The system according to claim 1 , wherein the first key is a shifted version of a key.
16. The system according to claim 15 , wherein an amount of shift in the first key is based on the data address related to the received encrypted data.
17. The system according to claim 15 , wherein the first key is generated substantially in parallel with the decrypting of the encrypted data.
18. The system according to claim 1 , wherein the decryptor does not add a latency to a processor pipeline.
19. The system according to claim 1 , wherein the decryptor does not add enough gate delays to exceed a clock cycle budget of the processor.
20. The system according to claim 1 , wherein the decryptor decrypts a word of the encrypted data in a single cycle.
21. The system according to claim 1 , wherein the word comprises a 64-bit word.
22. The system according to claim 1 , wherein the decryptor is adapted to receive encrypted data from the memory.
23. The system according to claim 1 ,
wherein memory and the processor are part of a set top box,
wherein the memory comprises a flash memory and an SDRAM,
wherein instructions are stored in the flash memory before being moved to the SDRAM for execution by the processor, and
wherein the instructions stored in the flash memory are compressed before being moved to the SDRAM for execution by the processor.
24. The system according to claim 1 , wherein the processor uses a single pipeline stage decryption algorithm.
25. The system according to claim 1 , wherein encrypted data stored in the memory has been encrypted using an encryption algorithm that varies periodically at address multiples such that repeated instructions are not encoded in the same way each time.
26. The system according to claim 1 ,
wherein the encrypted data stored in the memory is encrypted in a single clock cycle encryption scheme, and
wherein the processor decrypts the encrypted data in a single clock cycle decryption scheme.
27. The system according to claim 1 ,
wherein the memory and the processor are part of a set top box, and
wherein the processor that fixedly bit shuffles the bit-rolled data is configured as a fixed, hard-coded bit shuffler in which the fixed, hard-coded bit shuffling differs according to a class of the set top box such that different classes of set top boxes differ in their fixed, hard-coded bit shuffling.
28. The system according to claim 1 ,
wherein the memory and the processor are part of a device, and
wherein the processor that fixedly bit shuffles the bit-rolled data is configured as a fixed, hard-coded bit shuffler in which the fixed, hard-coded bit shuffling differs according to device class such that different classes of devices differ in their fixed, hard-coded bit shuffling.
29. The system according to claim 1 ,
wherein the decryptor comprises a series of two-bit adders that process incoming data bits, and
wherein values input to the series of two-bit adders relate to processing of first key and the data address.
30. The system according to claim 1 ,
wherein the decryptor comprises a bit swapper and a bit roller,
wherein the bit swapper is configured to provide fixed, hard-coded bit shuffling,
wherein the bit roller is configured to provide variable bit rolling,
wherein the decryptor comprises a plurality of two-bit adders,
wherein each two-bit adder receives two bits from a bit swapper that received two bits from the bit roller, and
wherein each two-bit adder receives two bits of the first key.
31. The system according to claim 1 ,
wherein a particular two-bit adder of the plurality of two-bit adders receives a different two bits of the first key based on different data addresses received by the processor.
32. The system according to claim 1 ,
wherein each two-bit adder outputs two bits that are received in an XOR block, and
wherein the XOR block receives two bits of the second key.
33. The system according to claim 32 , wherein an output of the XOR block is decrypted data.
34. The system according to claim 33 , wherein the decrypted data is stored in an internal memory of the processor.
35. The system according to claim 1 , wherein the second key is unrelated to the first key.
36. The system according to claim 1 , wherein a portion of the first key.
37. The system according to claim 35 ,
wherein the decryptor comprises a bit swapper that swaps bits output from the variable bit roller, and
wherein the decryptor comprises an adder that adds the shifted key to bits output from the bit swapper.
38. The system according to claim 35 ,
wherein the decryptor comprises an XOR block that processes bits output from the adder and bits from a hidden key that is unrelated to the shifted key, and
wherein bits output from the XOR block are decrypted.
39. The system according to claim 1 ,
wherein the encrypted data is partitioned into a plurality of roll regions, the roll regions being of variable length,
wherein each roll region is characterized by a roll skip, a roll region length and a roll amount,
wherein the roll skip, the roll region length and the roll amount are set through bits of a portion of the original key, and
wherein the bits of the portion of the original key, selected based on the data address, are used to set the roll skip, the roll region length and the roll amount.
40. The system according to claim 1 , wherein the bits of the portion of the original key used to set the roll skip, the roll region length and the roll amount are set using the bits of the portion of the original key which change as the data address changes.