Method and apparatus for encryption and decryption6778670Abstract A method and apparatus are provided for encrypting a stream of data transmitted within a frame. The method includes determining a first initialization state in a first preselected interval, and determining the first initialization state in a second preselected interval, wherein the second preselected interval is less than the first preselected interval. The method includes generating a key stream in response to determining the first initialization state in the second preselected interval, and encrypting at least one bit of the stream of data with at least one bit of the key stream. Claims What is claimed: Description BACKGROUND OF THE INVENTION
TABLE 1
Technical Characteristics for DECT protocol
Frequency Band 1880-1900 MHz
Number of Carriers 10
Carrier Spacing 1.728 MHz
Peak Transmit Power 250 mW
Carrier Multiplex TDMA; 24 slots per frame
Frame Length 10 ms
Basic Duplexing TDD using 2 slots on same RF carrier
Gross Bit Rate 1152 kbit/sec
Net Channel Rates 32 kbit/sec B-field (traffic) per slot
Packet Data (effective bit 552 kbit/sec
rate)
FIG. 4a illustrates a stylized block diagram of one embodiment of the WSU 310 in accordance with the present invention. The data processing system 350, the phone 335, and the modem 340 provide packet data, voice data, and modem data, respectively, to the WSU 310, which then transmits the data to the BTS 320. The data processing system 350 is capable of providing packet data to a network controller 420 of the WSU 310 through a network card (not shown), such as a token ring card, an Ethernet card, a PCnet card, and the like. A Subscriber Line Interface Circuit (SLIC) 430 of the WSU 310 provides the voice/modem 335, 340 interface. A WLL controller 440 formats the packet, voice, and modem data according to the DECT protocol and then interfaces it to a radio module 450 for transmission and reception. Similarly, the WLL controller 440 is also responsible for processing received DECT frames, decoding and storing protocol messages, and directing the user information to an appropriate destination. The packet data is provided by the data processing system 350 to the network controller 420, which formats the packet data into smaller sized protocol data units (PDUs) and stores the PDUs in an external memory 460 of the WSU 310. The external memory 460 acts as a buffer to the WLL controller 440 because the WLL controller 440 is generally unable to transmit the packet data at the rate the data is provided to the WLL controller 440 by the data processing unit 350. Accordingly, the PDUs are stored in the external memory 460 by the network controller 420, and later retrieved by the WLL controller 440 for transmission on an as needed basis. The DECT protocol currently defines packet data support as standard U-plane service, LU2 class 1 with Medium Access Control (MAC) layer I.sub.P error correction (commonly referred to as MOD2-ARQ). The Data Link Control (DLC) layer U-plane utilizes the I.sub.P channel with the protected mode MAC layer procedure. The protection mode specified is the modulo-2 I.sub.P retransmission scheme for the forward channels and error detection based on the acknowledgement provided by a reverse bearer. There are two types of data bearers, a duplex and double simplex bearer. The flow of data in a duplex bearer slot is bi-directional, while the flow of the data for double simplex bearers is unidirectional. The functionality of the WLL controller 440 may be controlled by software, hardware, or any combination thereof. Although not so limited, in the illustrated embodiment, the software handles the higher levels of functionality that include portions of the Medium Access Control (MAC) layer, the Data Link Control (DLC) layer. The software may also perform other control functions for the WLL controller 440, such as defining the modes of operation, ascertaining the slots and frequencies that are to be utilized, and determining the timing configurations for the radio control signals. FIG. 5a illustrates a DECT (TDMA) frame 500 that may be utilized by the present invention. It is contemplated that the present invention is applicable to a variety of communications systems employing TDMA technology. However, for illustrative purposes, the present invention is described with respect to the DECT TDMA frame 500. The frame 500 is of a 10 millisecond duration and is divided into 24 slots, grouped as twelve receive and twelve transmit slots. FIG. 5b illustrates a slot (commonly referred to as "full" slot) 504 of the frame 500. The slot 504 of the frame 500 includes a first guard band 505, an S-field 507, an A-field 509, a B-field 510, an X and Z field 512, 514, and a second guard band 516. The first guard band 505 includes 32 bits, whereas the second guard band 516 comprises 24 bits. The X and Z fields 512, 514 are each 4 bits, and the S-field, A-field, and B-field 507, 509, 510 are 32, 64, 320 bits, respectively. The DECT protocol, in addition to the "full" slot, is also capable of supporting a "double" slot, wherein the double slot includes larger number of bits than the "full" slot. For example, the B-field of the double slot comprises 800 bits. FIG. 5c illustrates a more detailed diagram of the B-field 510 that is utilized for transferring packet data in the protected mode. Specifically, the B-field 510 of the frame 500 includes four sub-fields 530(a-d) (hereinafter referred to as "data fields"), wherein a corresponding error detection field 535(a-d) protects each data field 530(a-d). Although not so limited, in the illustrated embodiment, the error detection fields 535(a-d) are Cyclic Redundancy Code (CRC) fields. Cyclic redundancy checking is a method of checking for errors in data that has been transmitted on a communications link. The transmitting device (i.e., either the WSU 310 or BTU 320) applies a 16- or 32-bit polynomial to each data field 530(a-d) that is to be transmitted and appends the resulting cyclic redundancy code (CRC) to each data field 530(a-d). The receiving end (i.e., either the WSU 310 or BTU 320) applies the same polynomial to the data and compares its result with the result appended by the sender. If they agree, the data within the data fields 530(a-d) has been received successfully. If not, the sender can be notified to retransmit the data. The data fields 530(a-d) hold packet data that is transferred to and from the WSU 310, and the CRC fields 535(a-d) are utilized to determine the integrity of the packet data stored in the data fields 530(a-d). Each data field 530(a-d) in the illustrated embodiment, as defined by the ETSI, comprises 64 bits, and each CRC field 535(a-d) comprises 16 bits. The terms "field" and "data field," as utilized herein, refer to at least a portion of the frame 500, and thus may include one or more bits of the frame 500. The WLL controller 440 is capable of supporting voice, analog data, and packet data communications. According to the DECT protocol, the voice and analog data communications are full duplex, and packet data communications is simplex. Accordingly, for voice and analog data communications, the first-half of the frame 500 data is typically utilized for receiving data from the BTS 320, and the second-half of the frame 500 is utilized for transmitting data to the BTS 320. Thus, data received within slots 0 through 11 is decrypted, whereas data for slots 12-24 is encrypted before it is transmitted. For packet data communications, it is possible to negotiate an asymmetric connection where up to 23 slots may be allocated for either an upstream or a downstream connection. Although the present invention will generally be described with respect to encryption/decryption of voice and analog data, the instant invention is equally applicable to encryption/decryption of packet data. Whenever helpful, occasional references to encryption/decryption of packet data will be made. FIG. 6 illustrates one embodiment of the WLL controller of FIG. 4 in accordance with the present invention. In the interest of clarity and to avoid obscuring the invention, only that portion of the WLL controller 440 that is helpful in understanding the invention is illustrated. More specifically, FIG. 6 illustrates a portion of the WLL controller 440 that is utilized for encrypting (i.e., during the encryption mode) data that is subsequently transmitted to the BTS 320 or decrypting (i.e., during the decryption mode) data received from the BTS 320. The WLL controller 440 includes encryption/decryption (E/D) logic 600 that encrypts and decrypts data transmitted and received within the frame 500 by the WLL controller 440. In the decryption mode, the E/D logic 600 decrypts encrypted data received from BTS 320, and in the encryption mode, the E/D logic 600 encrypts data for transmission to the BTS 320. The WLL controller 440 of the WSU 310 and the BTS 320 encrypt and decrypt data in accordance with the encryption/decryption algorithm of the DECT protocol. The E/D logic 600 comprises a first, second, third, and fourth linear feedback shift register (LFSR) 604, 605, 606, 607, wherein the LFSRs 604-607 are utilized to implement a random generating function, .function.. An example of a random generating function is supplied ETSI for at least the DECT protocol. Generally, function f can be factored into prime factors, where each LFSR 604-607 implements one of the prime factors of function .function.. It is contemplated that number of LFSRs 604-607 employed in a given embodiment may vary from one application to another, depending on the random generating function to be implemented. In the instant embodiment, the LSFRs 604-607 comprise of a plurality of D-flip flops (not shown) and XOR gates (not shown), although other logic circuitry may also be employed without deviating from the spirit and scope of the invention. LFSRs 604-607 are well-known in the art, and, accordingly, will not be described in detail herein. A serial stream of bits are provided to the LFSRs 604-607 on line 620, which are then shifted by the LFSRs 604-607 in response to a shift signal provided by a control logic on line 630. The control logic 625 controls the LFSRs 604-607. A bit counter signal is provided to the control logic 625 on line 627. The E/D logic 600 includes a key stream generator (KSG) 640 that selects output of selected D-flip flops (not shown) of the LFSRs 604-607 to compute the desired function .function.. The E/D logic 600 further includes an exclusive OR (XOR) gate 645. The KSG 640, based on output from selected D-flip flops of the LFSRs 604-607, provides a key stream to a first input terminal of the XOR gate 645, and a data stream requiring encryption or decryption is provided to a second input terminal of the XOR gate 645 on line 650. For encryption, the data processing system 350, the telephone 335 or the modem 340 provides the data stream to the second input terminal of the XOR gate 645. For decryption, the data stream provided to the second input terminal of the XOR gate 645 is received from the BTS 320. The XOR gate 645 performs an exclusive OR of the data stream with the key stream that provided to its two input terminals. The encrypted data stream is subsequently transmitted to the BTS 320, and the decrypted data stream is ultimately forwarded to the data processing unit 350, the telephone 335, or the modem 340. In accordance with the DECT protocol, to decrypt data received in the first-half (slots 0 to 11) of the frame 500, the KSG 640 generates the key stream by first initializing the LFSRs 604-607 with a cipher key and an initialization vector. Cipher key is a programmed variable and is unique to each channel, where each channel comprises a pair of slots 504 that are spaced twelve slots 504 apart. The initialization vector is derived from variables related to the slot and frame counters (not shown). The cipher key and initialization vector, each being 64 bits, are serially shifted into the LFSRs 604-607 from the line 620. Initializing the LFSRs 604-607 with the cipher key and initialization vector takes 128 clock cycles. Next, the LFSRs 604-607 are pre-clocked for 120 clock cycles while zeros are provided to the LFSRs 604-607 on the line 620. After preclocking, the LFSRs 604-607, or more specifically the flip-flops of the LFSRs 604-607, achieve a particular state, a state that is hereinafter referred to as a "first" state. So far, 248 (120+128) clock cycles have been expended in achieving the "first" state of the LFSRs 604-607. After the "first" state is achieved, the control logic 600 supplies two clock cycles to the LFSRs 604-607 for each bit to be decrypted. After the two clock cycles, the control logic 600 computes a function, .alpha..sub.n, for each LFSR 604-607 based on the output of selected flip-flops of the LFSRs 604-607. Accordingly, in the illustrated embodiment, .alpha..sub.1, .alpha..sub.2, .alpha..sub.3, and .alpha..sub.4 are calculated for the first, second, third, and fourth LRSR 604, 605, 606, 607, respectively. The fourth LFSR 607 is supplied a third clock cycle, and if, .alpha..sub.1, .alpha..sub.2, or .alpha..sub.3 equal one, then the respective LFSR 604, 605, 606 for which .alpha.=1 is also supplied a third clock cycle. If .alpha..sub.1, .alpha..sub.2, or .alpha..sub.3 do not equal one, then the none of the LFSRs 604-607 are supplied the third clock cycle. Therefore, the decryption requires at most 3 clock cycles per bit after the "first" state has been achieved. The key stream generated by the KSG 640 is XORed with the data stream to recover the original data. Referring again to FIG. 5a and 5b, according to the DECT protocol, the first bit requiring encryption or decryption for a full or double slot is bit 8 of the A-field 509 (e.g., bit 72 of the DECT frame 500). Forty bits of the A-field 509 and all of the bits of the B-field 510 (i.e., 320 bits for a full slot and 800 bits for the double slot) are encrypted or decrypted. Thus, for a full slot, the KSG 640 generates a 360-bit key stream, 40 bits for the A-field 509 and 320 bits for the B-field 510, which is then XORed with the data stream. For a double slot, the KSG 640 generates 840 bits that are XORed with the data stream. It follows that the total number of clock cycles required for decrypting bits of a full slot may be as high as 1328 clock cycles (248 to achieve the "first" state and 360 bits*3 clock cycles per bit). For a double slot, as many as 2768 clocks may be required for decryption. After decrypting a slot (i.e., slot i) in the first-half of the frame, the LFSRs 604-607, or more specifically the flip-flops of the LFSRs 604-607, achieve a particular state, a state that is hereinafter referred to as a "second" state. As described in more detail below, the LFSRs are initialized to the "second" state before the complementary slot, slot i+12, of slot i can be encrypted. Although not so limited, in the instant embodiment the E/D logic 600 is supplied a 10 MHz clock (not shown). Faster clocks may be provided to the E/D logic 600, but such clocks tend to require more power, which is not conducive for potential wireless applications that may be battery powered or require battery backup. A DECT bit period is 1.152 MHz, which means that for each DECT bit period there are about 9-10 cycles of the 10 MHz clock. From the start of a slot 504 to the first bit of the slot 504 to be encrypted/decrypted, there are 720 (72 bits*10 clock cycles) clock cycles available of the 10 MHz clock. For decryption, the "first" state of the LFSRs 604-607 can be achieved in 248 clock cycles, which is well within the available 720 clock cycles of the 10 MHz clock. However, because the DECT specification dictates that encryption for the slots 504 in the second-half of the frame 500 begin with the LFSRs 604-607 in the "second" state, the 720 available clock cycles of the 10 MHz clock prove to be inadequate. That is, even before encryption for slot i+12 can begin, the LFSRs 604-607 must be initialized to the "second" state, the state of the LFSRs 604-607 after the generation of the key stream for slot i. Initialization may consume up to 1328 clock cycles (see above) for a full slot and up to 2768 clock cycles (see above) for a double slot. The present invention allows the LFSRs 604-607 to be initialized within the allotted time without a need of a faster clock or additional memory to store the previous states of the LFSRs 604-607. FIG. 7 illustrates a method in accordance with the present invention that may be employed by the E/D logic 600 of the WLL controller 440 of FIG. 6. The method of FIG. 7 begins at block 710, where the LFSRs 604-607 are initialized by shifting a 64-bit cipher key and initialization vector. After initialization, the LFSRs 604-607 are at the "first" state. At block 720, the E/D logic 600 calculates the "second" state of the LFSRs 604-607 by skipping intermediate states of the flip-flops of the LFSRs 604-607, a process described in more detail below. At block 730, the E/D logic 600 encrypts the data stream with a second key stream. FIG. 8 illustrates a portion 805 of each LFSR 604-607 in accordance with the present invention that may employ the method of FIG. 7 to compute advanced states of the LFSRs 604-607. Specifically, the FIG. 8 illustrates a multiplexer 810 coupled to an input terminal of a D-flip flop 820, and clock (not shown) coupled to a clock terminal of the flip flop 820. The output of the flip-flop 820 may be coupled to additional flip-flops (not shown) as well, depending on the function implemented by the LFSRs 604-607. Each additional flip-flop (not shown) may have a multiplexer (not shown) coupled to its input terminal in manner similar to that shown in FIG. 8. For ease of illustration, only one flip-flop 820 is shown. In the illustrated embodiment, the multiplexer 810 includes seven input terminals and a control input terminal. Based on the signal provided by the control logic 625 to the control input of the multiplexer 810, the multiplexer 810 selects an input signal from its input terminals and provides it to the input terminal of the flip-flop 820. The first input terminal of the multiplexer 810 is coupled to an output terminal of the flip flop 820. The second input terminal is coupled to logic 830(1) for computing the state of the flip-flop 820 one clock cycle in advance. Similarly, the third, fourth, fifth, sixth, and seventh input terminals of the multiplexer are coupled to respective logic 830(2-6) for computing the state of the flip-flop 820 two, three, four, five, and six clock cycles in advance, respectively. Because LFSRs functions are deterministic, the future values of the LFSRs 604-607 can be computed based on current values. Accordingly, it is possible to determine future values several clocks in advance. For example, in the illustrated embodiment, the states of the flip-flops (e.g., flip-flop 820) of the LFSRs 604-607 may be determined more than one clock cycle in advance. Therefore, each flip-flop of the LFSRs 604-607 may have pre-computed future states that can be selected via the mutliplexer 810. The control logic 625 provides a signal to the control terminal of the multiplexer 810 to select one of the seven available inputs. Referring again to FIG. 6, as mentioned above, the E/D logic 600, at the block 620, computes the "second" state of the LFSRs 604-607 by skipping intermediate LFSR states. To arrive at the "second" state, the control logic 625 first pre-clocks the LFSRs 604-607 and then shifts twice or three times, depending on the value of .alpha..sub.n, for each data bit that is decrypted for slot i in the first-half of the frame. However, the control logic 625 in accordance with the instant invention arrives at the "second" state by using fewer clock cycles than had been previously required for decrypting data from slot i. For example, preclocking in the first-half of the frame 500 required 120 clock cycles. However, because LFSRs functions are deterministic, the future values of the LFSRs 604-607 can be computed based on current values. Accordingly, as illustrated in FIG. 8, logic 830(1-6) is capable of determining the states of the flip-flops of the LFSRs 604-607 one to six clock cycles in advance. Thus, by computing, for example, three states in advance during preclocking stage, it is possible to complete preclocking in 40 clock cycles, rather than the usual 120 clock cycles. To reach the "second" state after pre-clocking, the LFSRs 604-607 still have to be shifted two to three clock cycles for each bit that was decrypted for slot i in the first-half of the frame 500. In accordance the present invention, and as described below, it is possible to skip intermediate states of the LFSRs 604-607 after preclocking to arrive at the "second" state. Since the state of the LFSRs 604-607 depend on the value of .alpha..sub.n, the value of .alpha..sub.n needs to be computed not only based on current states of the LFSRs 604-607 but also on the future states of the LFSRs 604-607. Like the LFSR functions, the .alpha..sub.n function is also deterministic in that future values of .alpha..sub.n may be computed based on current values. Thus, calculating .alpha..sub.n allows one encryption key bit to be generated in one clock cycle, as opposed to 2 or 3 clock cycles. Thus, the total number of clock cycles needed to reach the "second" state for a full slot is 528 clock cycles (i.e., 128 clock cycles for the cipher/initialization vector, 40 for pre-clocking, and 360 for the key stream), as opposed to 1328 clock cycles. For a double slot, the total number of clock cycles needed to reach the "second" state for a full slot is 968 clock cycles (ie., 128 clock cycles for the cipher/initialization vector, 40 for pre-clocking, and 800 for the key stream), as opposed to 2768 clock cycles. Since the "second" state for a full slot can be reached in 528 clock cycles, it is well within the available 720 clock cycles of the 10 MHz clock. Reaching the "second" state for a double slot, however, requires 968 clock cycles, which is more than the 720 available clock cycles of the 10 MHz clock. To reach the "second" state within the allotted 720 clock cycles, the control logic 625 looks ahead four to six clocks (instead of 2 to 3 clock cycles for a full-slot). This amounts to selecting inputs from 3 to 7 input terminals of the multiplexer 810 in order to generate 2 key-bits per clock cycle. Accordingly, only 400 clock cycles are required to parse the 800-bit key sequence. Thus, the total number of clock cycles needed to reach the "second" state for a double slot is 688 clock cycles (i.e., 128 clock cycles for the cipher/initialization vector, 40 for pre-clocking, and 400 for the key stream). After the "second" state of the LFSRs 604-607 is reached in either a full or double slot, the E/D logic 600 continues to generate the second key sequence in the usual serial manner to encrypt the bits in the data stream. As mentioned earlier, the present invention may be employed for encryption/decryption of voice, analog data, or packet data. Generally, the CRC fields 535(a-d) in the B-field 510 of the frame 500 are not encrypted or decrypted for packet data transmission. For packet data, each PDU may require encryption/decryption, where each PDU may have its own cipher key. Thus, even in a situation where only one connection exists, there still may be a need to support multiple channels. The instant invention offers several advantages. First, it is possible to encrypt/decrypt data for multiple channels utilizing a single E/D logic, as opposed to having a dedicated E/D logic for each connection. Second, the present invention allows the LFSRs 604-607 to be initialized to a desired state within a proscribed period without requiring additional memory to store earlier states of the LFSRs 604-607. Up to 1K of memory may be required on-chip to store all the earlier states of the LFSRs 604-607. The extra memory results not only in additional expense, it also consumes valuable space on the chip that may be utilized for other purposes. Third, the instant invention avoids the need of expensive programmable logic arrays to generate the necessary bits in one cycle. Those skilled in the art will appreciate that the above-described embodiments with respect to the WLL network 300 may also be pertinent with respect to other communications systems 200 (see FIG. 2) as well. Furthermore, although the present invention has been described with reference to communications systems 200, 300, the application of the present invention is not limited as such. It is contemplated that the application of the present invention may be extended to other technologies as well, including, but not limited to, data processing systems and other electronic devices in which encryption and decryption algorithms may be employed. The particular embodiments disclosed above are illustrative only, as the invention may be modified and practiced in different but equivalent manners apparent to those skilled in the art having the benefit of the teachings herein. Furthermore, no limitations are intended to the details of construction or design herein shown, other than as described in the claims below. It is therefore evident that the particular embodiments disclosed above may be altered or modified and all such variations are considered within the scope and spirit of the invention. Accordingly, the protection sought herein is as set forth in the claims below.
|
Same subclass Same class |
||||||||||