Integrated cryptographic circuits in space applications
Cryptographic integrated circuits include an input module configured to receive a stream of input data packets, a plurality of cryptographic modules coupled to the input module, where each cryptographic module includes an input port for receiving an input data packet and an output port for transmitting an output data packet, and is configured to encrypt or decrypt the received input data packet to generate an output data packet, and an output module configured to receive output data packets from the plurality of cryptographic modules and to generate an output data stream comprising the output data packets, where the input and output modules and the plurality of cryptographic modules are mounted on a single integrated circuit board, and wherein the input module is configured to distribute the input data packets among the plurality of cryptographic modules.
1. A cryptographic integrated circuit, comprising:
an input module configured to receive a stream of input data packets;
a plurality of cryptographic modules coupled to the input module, wherein each cryptographic module comprises an input port for receiving an input data packet and an output port for transmitting an output data packet, and is configured to encrypt or decrypt the received input data packet to generate an output data packet; and
an output module configured to receive output data packets from the plurality of cryptographic modules and to generate an output data stream comprising the output data packets,
wherein the input and output modules and the plurality of cryptographic modules are mounted on a single integrated circuit board; and
wherein the input module is configured to replace a header of each input data packet with an encryption header comprising a designation of one of the plurality of cryptographic modules to which the input data packet is distributed by the input module, and to distribute the input data packets among the plurality of cryptographic modules.
2. The circuit of claim 1 , wherein the plurality of cryptographic modules comprises 2 or more cryptographic modules.
3. The circuit of claim 1 , wherein the plurality of cryptographic modules comprises 4 or more cryptographic modules.
4. The circuit of claim 1 , wherein each of the plurality of cryptographic modules is configured with an encryption key to encrypt or decrypt the received input data packet.
5. The circuit of claim 4 , wherein each of the plurality of cryptographic modules is configured with a common encryption key.
6. The circuit of claim 4 , wherein a first group of the plurality of cryptographic modules are configured with a first encryption key, and a second group of the plurality of cryptographic modules are configured with a second encryption key different from the first encryption key.
7. The circuit of claim 4 , wherein each of the plurality of cryptographic modules is configured with a different encryption key.
8. The circuit of claim 1 , wherein the output module is configured to replace an encryption header of each output data packet with an output header.
9. A cryptographic system, comprising:
the cryptographic integrated circuit of claim 1 ; and
an electronic processor coupled to the cryptographic integrated circuit,
wherein the electronic processor is configured to selectively activate or de-activate a subset of the plurality of cryptographic modules to encrypt or decrypt data packets of the stream of input data packets using activated cryptographic modules of the cryptographic integrated circuit.
10. The system of claim 9 , wherein:
the system is connected to a power source of a space vehicle; and
the electronic processor is configured to measure an amount of power remaining in the power source, and to adjust the number of activated cryptographic modules used to encrypt or decrypt data packets of the stream of input data packets based on the amount of power remaining in the power source.
11. The system of claim 9 , wherein:
the system is coupled to a power source of a space vehicle; and
the electronic processor is configured to measure a power consumption rate of the space vehicle, and to adjust the number of activated cryptographic modules used to encrypt or decrypt data packets of the stream of input data packets based on the power consumption rate.
12. The system of claim 9 , wherein the electronic processor is configured to determine a bandwidth of the stream of input data packets, and to adjust the number of activated cryptographic modules used to encrypt or decrypt data packets of the stream of input data packets so that a data throughput rate of the cryptographic integrated circuit is at least as large as the bandwidth of the stream of input data packets.
13. The system of claim 12 , wherein the electronic processor is configured to adjust the number of activated cryptographic modules used to encrypt or decrypt data packets of the stream of input data packets to a minimum number of activated cryptographic modules so that the data throughput rate of the cryptographic integrated circuit exceeds the bandwidth of the stream of input data packets.
14. The system of claim 9 , further comprising a temperature sensor coupled to the electronic processor, wherein the electronic processor is configured to measure a temperature of the cryptographic integrated circuit, and to adjust the number of activated cryptographic modules so that the measured temperature does not exceed a threshold temperature value.
15. The system of claim 9 , further comprising a plurality of temperature sensors, wherein each temperature sensor of the plurality of temperature sensors contacts one of the plurality of cryptographic modules, wherein the electronic processor is configured to measure a temperature of each cryptographic integrated circuit, and to de-activate cryptographic modules for which the measured temperature exceeds a threshold temperature value.
16. The system of claim 9 , wherein at least one of the electronic processor and the input module is configured to de-activate cryptographic modules of the plurality of cryptographic modules that have failed.
17. The system of claim 9 , wherein the electronic processor is configured to determine that a cryptographic module of the plurality of cryptographic modules has failed if the cryptographic module receives a input data packet and goes not generate an output data packet.
18. The system of claim 9 , wherein the electronic processor is configured to measure an electrical property of a cryptographic module of the plurality of cryptographic modules, and to determine that the cryptographic module has failed if a value of the measured electrical property is outside an accepted range of values for the measured electrical property.
19. The system of claim 18 , wherein the measured electrical property comprises a resistance or impedance of the cryptographic module.
20. The system of claim 18 , wherein the measured electrical property comprises a voltage drop across the cryptographic module or a current through the cryptographic module.
21. The system of claim 9 , wherein the input module is configured to distribute the input data packets among the plurality of cryptographic modules based on an availability of each of the plurality of cryptographic modules.
22. The system of claim 21 , wherein each cryptographic module of the plurality of cryptographic modules is configured to transmit a signal to the input module to indicate an availability of the cryptographic module to receive an input data packet from the input module.
23. The system of claim 9 , wherein the input module is configured to distribute the input data packets among the plurality of cryptographic modules based on a size of each input data packet.
24. The system of claim 23 , wherein:
(a) the input module is configured to distribute a first plurality of f input data packets among f different cryptographic modules in a first order of the modules according to sizes of the f input data packets; and
(b) the input module is configured to distribute a second plurality of f input data packets among the f different cryptographic modules in a second order of the modules that is opposite to the first order of the modules.
25. The system of claim 24 , wherein the input module is configured to repeat steps (a) and (b) with additional pluralities of f input data packets.
26. The system of claim 9 , wherein the input module is configured to distribute the input data packets among the plurality of cryptographic modules based on an accumulated data processing load for each of the plurality of cryptographic modules.
27. The system of claim 26 , wherein the input module is configured to distribute each successive input data packet to a cryptographic module among the plurality of cryptographic modules for which the accumulated data processing load is smallest.
28. The system of claim 9 , wherein the input module is configured to distribute the input data packets among the plurality of cryptographic modules based on an encryption or decryption protocol associated with each input data packet.
29. The system of claim 28 , wherein the input module is configured to distribute input data packets associated with a first encryption protocol to a first subset of the plurality of cryptographic modules, and to distribute input data packets associated with a second encryption protocol different from the first encryption protocol to a second subset of the plurality of cryptographic modules that is different from the first subset.