Memory encryption for digital video
A method for protecting data between a circuit and a memory is disclosed. The method generally includes the steps of (A) generating a particular address among a plurality of addresses for accessing a particular area among a plurality of areas in the memory, (B) determining a particular key among a plurality of keys associated with the particular area, (C) generating a cipher stream from both the particular address and the particular key and (D) modifying a data item with the cipher stream such that the data item is encrypted during a transfer between the circuit and the memory.
1. A method for protecting data between a circuit and a memory, comprising the steps of:
(A) generating a particular address among a plurality of addresses based on a parameter received in a first signal, said particular address accessing a particular area among a plurality of areas in said memory, wherein said particular address is different than said parameter;
(B) generating a second signal using said parameter directly from said first signal, wherein (i) said second signal carries a particular key among a plurality of keys, (ii) said particular key is associated with said particular area and (iii) said particular address and said second signal are generated in parallel;
(C) generating an encrypted address by a block encryption of said particular address using as an encryption key a concatenation of (i) said particular key and (ii) at least part of said address; and
(D) logical exclusive ORing a data item with said encrypted address such that said data item is encrypted during a transfer between said circuit and said memory.
2. The method according to claim 1 , wherein said logical exclusive ORing of said data item with said encrypted address is performed before said data item leaves from said circuit to said memory.
3. The method according to claim 1 , wherein said logical exclusive ORing of said data item with said encrypted address is performed after said data item is received into said circuit from said memory.
4. The method according to claim 1 , further comprising the step of:
altering said keys over time such that said encrypted address of said particular area is dynamic.
5. The method according to claim 1 , further comprising the step of:
allocating at least one of said keys to each of said areas in said memory used as a frame store of video data.
6. The method according to claim 1 , further comprising the steps of:
allocating a first key of said keys to chrominance data of video data; and
allocating a second key of said keys to luminance data of said video data.
7. The method according to claim 1 , further comprising the step of:
allocating at least two of said keys to each of said areas in said memory used as a field store of video data.
8. The method according to claim 1 , further comprising the step of:
allocating one of said keys to each of said areas in said memory used in a block transfer of data within a range of said addresses, wherein said particular address is in said range.
9. The method according to claim 1 , wherein step (B) comprises the sub-step of:
determining said particular key of said particular area using an associative lookup of said parameter identifying said particular area.
10. The method according to claim 1 , wherein said keys form a hierarchical partitioning of a memory map for said memory.
11. A circuit comprising:
an address generator module configured to generate a particular address among a plurality of addresses based on a parameter received in a first signal, said particular address accessing a particular area among a plurality of areas in a memory, wherein said particular address is different than said parameter; and
a cipher module configured to (i) generate a second signal using said parameter directly from said first signal, wherein (a) said second signal carries a particular key among a plurality of keys, (b) said particular key is associated with said particular area and (c) said particular address and said second signal are generated in parallel, (ii) generate an encrypted address by a block encryption of said particular address using as an encryption key a concatenation of (a) said particular key and (b) at least part of said address and (iii) logical exclusive OR a data item with said encrypted address such that said data item is encrypted during a transfer between said circuit and said memory.
12. The circuit according to claim 11 , wherein said circuit and said memory are formed in separate dies.
13. The circuit according to claim 11 , wherein said cipher module comprises:
an encryption module configured to generate said encrypted address using said particular address as a plaintext input.
14. The circuit according to claim 13 , wherein a write latency of said memory is at least as long as a delay through said encryption module.
15. The circuit according to claim 11 , wherein said cipher module comprises:
a key selection module configured to generate said particular key based directly on said parameter associated with said particular area.
16. The circuit according to claim 11 , wherein said cipher module comprises:
a conversion module configured to perform said logical exclusive OR between said encrypted address and said data item (i) before said data item is written to said memory and (ii) after said data item is read from said memory.
17. The circuit according to claim 16 , wherein said cipher module further comprises:
an alignment module coupling said conversion module to a bus, said alignment module configured to adjust an alignment of said data item between said conversion module and said bus.
18. The circuit according to claim 11 , wherein said data item is decoded video data in digital form.
19. A circuit comprising:
an address generation module for generating a particular address among a plurality of addresses based on a parameter received in a first signal, said particular address accessing a particular area among a plurality of areas in a memory, wherein said particular address is different than said parameter;
means for generating a second signal using said parameter directly from said first signal, wherein (i) said second signal carries a particular key among a plurality of keys˜ m˜ (ii) said particular key is associated with said particular area and (iii) said particular address and said second signal are generated in parallel;
means for generating an encrypted address by a block encryption of said particular address using as an encryption key a concatenation of (i) said particular key and (ii) at least part of said address; and
means for logical exclusive ORing a data item with said encrypted address such that said data item is encrypted during a transfer between said circuit and said memory.