Encryption apparatus and method therefor
View Patent ↗An encryption apparatus ( 14 ) includes an integrated circuit ( 34 ) having a secure processing section ( 30 ). A plaintext reset epoch key ( 154 ) is stored in the secure processing section ( 30 ) and configured to have a short life. A plaintext master key ( 160 ) is stored in the secure processing section ( 30 ) and configured to have a long life. A multiplicity of active keys ( 172 ) are generated, encrypted using a weaker but faster cryptographic algorithm ( 68 ) and the reset epoch key ( 154 ), then stored in a high-capacity key magazine ( 86 ) portion of unsecured memory ( 16, 18, 28 ). Some keys and data are also encrypted using a stronger but slower cryptographic algorithm ( 70 ) and the master key ( 160 ), then stored in unsecured memory ( 16, 18, 28 ). Keys ( 272, 372 ) may be converted between weaker, faster encryption and stronger, slower encryption.
1. An encryption apparatus having a reset port at which a reset signal is applied, said apparatus comprising:
a memory for storing a first ciphertext key;
a first key register, configured as a volatile register, for storing a first plaintext key;
a second key register for storing a second plaintext key;
a third key register, configured as a non-volatile register, for storing a third plaintext key;
an encryption processor coupled to said first, second, and third key registers;
a random number generator coupled to said first key register; and
a controller coupled to said random number generator, said memory, and said encryption processor, said encryption processor and said controller being configured to cause said first plaintext key to be formed using said random number generator and stored in said first key register in response to activation of said reset signal, configured to cause said second plaintext key to be generated by said encryption processor from said first ciphertext key using said first plaintext key and to be stored in said second key register, configured to apply first and second cryptographic algorithms, wherein said first cryptographic algorithm requires more processing time than said second cryptographic algorithm, said first cryptographic algorithm being applied using said third plaintext key, and said second cryptographic algorithm being applied using said first plaintext key, and configured to convert said first ciphertext key into a second ciphertext key using said second then said first cryptographic algorithms to allow said second plaintext key to be recoverable after said activation of said reset signal.
2. An encryption apparatus as claimed in claim 1 wherein said second cryptographic algorithm and said first plaintext key are applied to said first ciphertext key to generate said second plaintext key.
3. An encryption apparatus as claimed in claim 1 wherein said second cryptographic algorithm includes an encryption process and a decryption process which is complimentary to said encryption process, said decryption process being configured to execute in the same or less processing time than said encryption process.
4. An encryption apparatus having a reset port at which a reset signal is applied, said apparatus comprising:
a memory for storing a first ciphertext key;
a first key register, configured as a volatile register, for storing a first plaintext key;
a second key register for storing a second plaintext key;
a third key register, configured as a non-volatile register, for storing a third plaintext key;
an encryption processor coupled to said first and second key registers;
a random number generator coupled to said first key register; and
a controller coupled to said random number generator, said memory, and said encryption processor, said encryption processor and said controller being configured to cause said first plaintext key to be formed using said random number generator and stored in said first key register in response to activation of said reset signal, configured to cause said second plaintext key to be generated by said encryption processor from said first ciphertext key using said first plaintext key and to be stored in said second key register, configured to apply first and second cryptographic algorithms, wherein said first cryptographic algorithm requires more processing time than said second cryptographic algorithm, said first cryptographic algorithm being applied using said third plaintext key, and said second cryptographic algorithm being applied using said first plaintext key, configured to form a second ciphertext key using said first cryptographic algorithm, and configured to convert said first ciphertext key into said second plaintext key using said second cryptographic algorithm.
5. An encryption apparatus as claimed in claim 1 additionally comprising a tamper detection circuit coupled to said first key register and configured to destroy said first plaintext key upon the detection of a tamper event.
6. An encryption apparatus as claimed in claim 1 wherein:
said first key register, said second key register, said random number generator, and said controller reside within an integrated circuit; and
said memory resides outside said integrated circuit.
7. An encryption apparatus as claimed in claim 1 wherein:
said first key register, said second key register, said encryption processor, and said random number generator are located in a secure processing section of said encryption apparatus; and
said memory resides outside said secure processing section.
8. An encryption apparatus as claimed in claim 1 wherein said controller is further configured to:
generate, after said first plaintext key is stored in said first key register, an original second plaintext key;
encrypt said original second plaintext key using said first plaintext key to form said first ciphertext key; and
store said first ciphertext key in said memory.
9. An encryption apparatus as claimed in claim 1 wherein said first key register is configured so that said first plaintext key is destroyed in response to a power-off event.
10. An encryption apparatus as claimed in claim 1 wherein said first key register is configured so that said first plaintext key is destroyed in response to a reset event.
11. An encryption apparatus as claimed in claim 1 wherein said first key register is configured so that said first plaintext key is destroyed in response one of a power-off event, a reset event, and a temper event.
12. An encryption apparatus having a reset port at which a reset signal is applied, said apparatus comprising:
a memory for storing a ciphertext key;
a first key register, configured as a volatile register, for storing a first plaintext key;
a second key register for storing a second plaintext key;
a third key register, configured as a non-volatile register, for storing a third plaintext key;
an encryption processor coupled to said first and second key registers;
a random number generator coupled to said first key register; and
a controller coupled to said random number generator, said memory, and said encryption processor, said encryption processor and said controller being configured to cause said first plaintext key to be formed using said random number generator and stored in said first key register in response to activation of said reset signal, configured to cause said second plaintext key to be generated by said encryption processor from said ciphertext key using said first plaintext key and to be stored in said second key register, configured to apply first and second cryptographic algorithms, wherein said first cryptographic algorithm requires more processing time than said second cryptographic algorithm, said first cryptographic algorithm being applied using said third plaintext key, and said second cryptographic algorithm being applied using said first plaintext key, configured to encrypt said second plaintext key using said first cryptographic algorithm and said third plaintext key to form an alternate ciphertext key, and configured to store said alternate ciphertext key in said memory to allow said second plaintext key to be recoverable after a reset.
13. An encryption apparatus having a reset port at which a reset signal is applied, said apparatus comprising:
a memory for storing a first ciphertext key;
a first key register, configured as a volatile register, for storing a first plaintext key;
a second key register for storing a second plaintext key;
a third key register, configured as a non-volatile register, for storing a third plaintext key;
an encryption processor coupled to said first and second key registers;
a random number generator coupled to said first key register; and
a controller coupled to said random number generator, said memory, and said encryption processor, said encryption processor and said controller being configured to cause said first plaintext key to be formed using said random number generator and stored in said first key register in response to activation of said reset signal, configured to cause said second plaintext key to be generated by said encryption processor from said first ciphertext key using said first plaintext key and to be stored in said second key register, configured to apply first and second cryptographic algorithms, wherein said first cryptographic algorithm requires more processing time than said second cryptographic algorithm, said first cryptographic algorithm being applied using said third plaintext key, and said second cryptographic algorithm being applied using said first plaintext key, configured to generate, before said first plaintext key is stored in said first key register, an original second plaintext key, configured to encrypt
said original second plaintext key using said first cryptographic algorithm and said third plaintext key to form an alternate ciphertext key, configured to store said alternate ciphertext key in said memory, and configured to convert, after said first plaintext key is stored in said first key register, said alternate ciphertext key into said second ciphertext key using said first cryptographic algorithm and said third plaintext key then said second cryptographic algorithm and said first plaintext key.
14. An encryption apparatus as claimed in claim 12 wherein said second cryptographic algorithm is also applied to said ciphertext key.
15. An encryption apparatus as claimed in claim 1 wherein said first ciphertext key is one of a multiplicity of ciphertext keys stored in a key magazine formed in said memory.
16. An encryption apparatus as claimed in claim 4 wherein said first key register is configured so that said first plaintext key is destroyed in response one of a power-off event, a reset event, and a temper event.
17. An encryption apparatus as claimed in claim 13 wherein said second cryptographic algorithm and said first plaintext key are applied to said first ciphertext key to generate said second plaintext key.
18. An encryption apparatus as claimed in claim 12 wherein said second cryptographic algorithm and said first plaintext key are applied to said ciphertext key to generate said second plaintext key.
19. An encryption apparatus as claimed in claim 12 wherein said first key register is configured so that said first plaintext key is destroyed in response one of a power-off event, a reset event, and a temper event.