Method and system for protecting data
Methods and systems for protecting data may include controlling encryption and/or decryption, utilizing an encryption/decryption algorithm, rights related to the source and destination addresses, and encryption/decryption keys. The source location and/or destination of the data may comprise protected or unprotected memory. One or more of a plurality of algorithms may be utilized for the encryption and/or decryption. The rights may be stored in a key table, which may be stored on-chip, and may be reprogrammable. One or more keys for the encryption and/or decryption may be received from an external source or generated within the chip. The encryption/decryption algorithm may be selected based on two or more encryption/decryption algorithms, and additionally based on the source address, destination address, source rights, and destination rights.
1. A method for data communication, comprising:
storing a descriptor in a memory, wherein the descriptor comprises a source address, a destination address, a first encryption/decryption algorithm, and a key pointer;
storing a key slot in a key table, wherein the key slot comprises source rights, destination rights, a second encryption/decryption algorithm, and a key;
encrypting or decrypting data located at the source address using the first encryption/decryption algorithm, the second encryption/decryption algorithm, and the key; and
storing the encrypted or decrypted data to the destination address.
2. A method for data communication according to claim 1 , further comprising:
receiving the key from an external source.
3. A method for data communication according to claim 1 , further comprising generating the key using the key table.
4. A method for data communication according to claim 1 , wherein the key pointer points to the key slot in the key table.
5. A method for data communication according to claim 1 , further comprising:
determining if the first encryption/decryption algorithm matches the second encryption/decryption algorithm.
6. A method for data communication according to claim 5 , wherein the determining compares the source address and source rights.
7. A method for data communication according to claim 5 , wherein the determining compares the destination address and destination rights.
8. A method for data communication according to claim 1 , further comprising:
determining if encryption is requested, and, if so, encrypting the data using the first encryption/decryption algorithm and the key.
9. A method for data communication according to claim 1 , further comprising:
determining if decryption is requested, and, if so, decrypting the data using the first encryption/decryption algorithm and the key.
10. A method for data communication according to claim 1 , further comprising:
determining the source rights based on a location of the source address in memory.
11. A method for data communication according to claim 1 , further comprising determining the destination rights based on a location of the destination address in memory.
12. A system for data communication, comprising:
a memory configured to store a descriptor;
a key table configured to store a key slot connected to the memory;
a security logic block, connected to both the memory and the key table, configured to select a final encryption/decryption algorithm; and
an encryption/decryption block, connected to the security logic block, the memory, and the key table, configured to generate an output data by encrypting/decrypting an input data using the final encryption/decryption algorithm;
wherein:
the descriptor includes a source address, a destination address, a first encryption/decryption algorithm, and a key pointer;
the key slot includes source rights, destination rights, a second encryption/decryption algorithm, and a key;
the input data used by the encryption/decryption block is read from the source address; and
the output data is stored in the destination address.
13. A system for data communication according to claim 12 , wherein the key table is configured to receive the key from an external source.
14. A system for data communication according to claim 12 , wherein the key table is configured to generate the key.
15. A system for data communication according to claim 12 , wherein the key pointer is configured to point to the key slot in the key table.
16. A system for data communication according to claim 12 , wherein the security logic block is configured to compare the first and second encryption/decryption algorithms to select the final encryption/decryption algorithm.
17. A system for data communication according to claim 16 , wherein the security logic is further configured to compare the source address and source rights to select the final encryption/decryption algorithm.
18. A system for data communication according to claim 16 , wherein the security logic is further configured to compare the destination address and destination rights to select the final encryption/decryption algorithm.
19. A system for data communication according to claim 12 , further comprising:
a security system connected to the encryption/decryption block and configured to indicate if encryption or decryption has been requested.
20. A system for data communication according to claim 12 , wherein the key table is configured to determine the source rights based on the source address.
21. A system for data communication according to claim 12 , wherein the key table is configured to determine the destination rights based on the destination address.