M6 block cipher system and method for encoding content and authenticating a device

This application claims the benefit of Korean Patent Appl. No. 10-2004-0097944, filed on Nov. 26, 2004 in the Korean Intellectual Property Office, the disclosure of which is incorporated herein in its entirety by reference.

1. Field of the Invention

The present invention relates in general to an M 6 block cipher system and a method for encoding content and performing authentication of a device.

2. Description of the Related Art

If various forms of audio/video data (hereinafter referred to as content) are transmitted by a data bus, it is possible for a third party to intercept or tamper with the content. Even if an IEEE 1394 high-performance bus is used, interception and/or tampering with the content may still be possible. However, a digital transmission content protection (DTCP) specification volume 1.3, proposed by Hitachi, Intel, Matsushita, Sony and Toshiba, provides a cryptographic protocol for content protection from external attacks.

In order to protect content from external attacks, a M 6 block cipher algorithm is used for DTCP. A general M 6 block cipher algorithm generates a random number, creates an exchange key and encodes content, which may be necessary processes for the content authentication between reception and transmission devices. A general M 6 block cipher algorithm system contains two cores for respectively encoding content and authenticating the device. The general M 6 block cipher algorithm system may be divided into M 6 -S 56 and M 6 -KE 56 algorithms. The M 6 -S 56 algorithm is a block cipher algorithm used to encode content, and the M 6 -KE 56 algorithm is a block cipher algorithm used to authenticate a device. The M 6 block cipher algorithm supports a 64-bit block having a 56-bit key and composed of 10 rounds in total.

A conventional cipher algorithm implements a M 6 -S 56 converted cipher-block chaining (C-CBC) cipher of the M 6 block cipher algorithm used for the DTCP. However, the conventional art does not use the M 6 -KE 56 algorithm to generate a random number and create the exchange key for authentication. In addition, the conventional art does not describe nor suggest using a round function or a Pi function for the implementation of M 6 -S 56 . Further, a general M 6 block cipher algorithm system contains two cores for respectively encoding content and authenticating the device.

An example embodiment of the present invention is directed to an M 6 block cipher system. The M 6 block cipher system may include a rotate constant selector selecting one or more rotate constants from a plurality of input rotate constants for output based on a selection signal input thereto, a rotate constant ordering device ordering the selected rotate constants and a common rotate constant input thereto based on a received ordering signal, and an M 6 core generating one or more of an output signal, a validity signal and a round number based on the ordered rotate constants and a plurality of input signals. The system may include a rotate constant scheduler outputting the ordering signal to the rotate constant ordering device in response to the selection signal and the round number.

Another example embodiment of the present invention is directed to an M 6 block cipher system. The system may be adapted to perform a plurality of round operations in order to authenticate a device for receiving/transmitting content and encode content, in which each of the plurality of round operations includes a plurality of sub round operations. The M 6 block cipher system may include a rotate constant selector selecting one or more rotate constants from a plurality of input rotate constants for output based on a selection signal input thereto, a rotate constant ordering device ordering, for output, the selected rotate constants, a common rotate constant input thereto and a non-common rotate constant input thereto based on a received ordering signal, and an M 6 core generating one or more of an output signal, a validity signal, a round number and a sub round number based on the ordered rotate constants and a plurality of input signals. The system may include a rotate constant scheduler outputting the ordering signal to the rotate constant ordering device in response to the selection signal, the round number and the sub round number.

Another example embodiment of the present invention is directed to an M 6 block cipher system for encoding content and performing authentication of a device. The system may include an M 6 core configured to adjust a value of a rotate constant selection signal so as to encode content input to the system based on selected rotate constants, to generate a random number and to create an exchange key for device authentication.

Another example embodiment of the present invention is directed to method of encoding content and performing authenticating of a device. In the method, one or more rotate constants may be selected from a plurality of input rotate constants for output based on a selection signal. The selection signal may be configured to determine whether to encode content or to generate a random number and create an exchange key for device authentication. The selected rotate constants and one or both of a separate common rotate constant used to encode content and for device authentication, and a separate non-common rotate constant used when an output signal is not rotated, may be ordered based on an ordering signal. The method includes generating one or more of an output signal, a validity signal and at least one of a round number and a sub round number based on the ordered rotate constants and a plurality of input signals. The ordering signal may be generated based on the selection signal and one or both of the round number and sub round number.

Example embodiments of the present invention will become more fully understood from the detailed description given herein below and the accompanying drawings, wherein the like elements are represented by like reference numerals, which are given by way of illustration only and thus are not limitative of the example embodiments the present invention.

FIG. 1 is a block diagram of an M 6 block cipher system according to an example embodiment of the present invention.

FIG. 2 is a block diagram illustrating the M 6 core of FIG. 1 .

FIG. 3 is a block diagram of the Pi function of FIG. 2 .

FIG. 4 is a block diagram of an M 6 block cipher system according to another example embodiment of the present invention.

FIG. 5 is a block diagram of the M 6 core of FIG. 4 .

FIG. 6 is a block diagram of the Pi function of FIG. 5 .

FIG. 7 is a block diagram of the Pi function of FIG. 5 according to another example embodiment of the present invention.

FIG. 8 is a state diagram illustrating an M 6 block cipher system that does not perform a sub round operation according to an example embodiment of the present invention.

FIG. 9 is a state diagram illustrating an M 6 block cipher system that performs a plurality of sub round operations according to an example embodiment of the present invention.

FIG. 10 is a timing diagram illustrating an M 6 block cipher system that does not perform the sub round operation according to an example embodiment of the present invention.

FIG. 11 is a timing diagram illustrating an M 6 block cipher system that performs a plurality of sub round operations according to an example embodiment of the present invention.

As will be shown in further detail below, the example embodiments of the present invention may provide an M 6 block cipher system adapted to prevent illegal copying while data are transmitted in a high-performance digital bus. In other words, the M 6 block cipher system can realize operations to encode content and authenticate a device. At the same time, an M 6 block cipher system only uses a single M 6 core so as to have relatively smaller volume.

FIG. 1 is a block diagram illustrating an M 6 block cipher system 100 according to an example embodiment of the present invention. The M 6 block cipher system 100 may be configured to adjust the value of a SKE selection signal SKE_SEL so as to encode content M 6 _S 56 , generate a random number and create an exchange key M 6 _KE 56 necessary for device authentication. Unlike the conventional art, only one M 6 core 140 is used for this purpose, while two cores are used in the conventional art.

Referring to FIG. 1 , an M 6 block cipher system 100 may include a rotate constant selector 110 . The rotate constant selector 110 may be configured to select among a plurality of rotate constants S 56 _S 2 , S 56 _S 3 , KE 56 _S 2 and KE 56 -S 3 in response to a SKE selection signal SKE_SEL (e.g., “selection signal”) so as to output rotate constants S 2 and S 3 . The SKE selection signal SKE_SEL may be used to determine whether to encode content M 6 _S 56 or to generate a random number and create an exchange key M 6 _KE 56 necessary for device authentication. In the four rotate constants S 56 _S 2 , S 56 _S 3 , KE 56 _S 2 and KE 56 -S 3 , two rotate constants S 56 _S 2 and S 56 _S 3 may be used to encode content, and two rotate constants KE 56 _S 2 and KE 56 -S 3 may be used to generate a random number and create an exchange key necessary for device authentication.

The M 6 block cipher system 100 may include a rotate constant ordering device 120 . The rotate constant ordering device 120 may be configured to order the input rotate constants S 1 , S 2 and S 3 so as to output RC 1 , RC 2 and RC 3 in response to a rotate constant selection signal RC_SEL (e.g., “ordering signal”). The common rotate constant S 1 may be commonly used to encode content and to authenticate the device.

The M 6 block cipher system may include a rotate constant scheduler 130 . The rotate constant scheduler 130 may be configured to output a rotate constant selection signal RC_SEL that may be used to decide the order of the rotate constants to be used for a round operation in response to the SKE selection signal SKE_SEL and a round number R_NUM. The round number R_NUM may contain information of a present round operation.

The M 6 block cipher system 100 may include a M 6 core 140 . The M 6 core 140 may be configured to encode or decode an input signal TEXT_IN in response to the plurality of ordered rotate constants RC 1 , RC 2 and RC 3 , a key signal KEY and a mode selection signal MODE_SEL so as to output signal TEXT_OUT. The M 6 core may also output a round number R_NUM containing information on the present round operation, and a validity signal VALID that may indicate an end of encoding and/or decoding process and the validity of an encoded and/or decoded value.

The key signal KEY may be used to create two round operation keys necessary for each round operation of the M 6 core 140 . The mode selection signal MODE_SEL may be used to indicate whether to encode or decode the input signal TEXT_IN. If the input signal TEXT_IN is plain text, the mode selection signal MODE_SEL may instruct the M 6 core to encode the input signal TEXT_IN. If the input signal TEXT_IN is cipher text, the mode selection signal MODE_SEL may instruct the M 6 core to decode the input signal TEXT_IN. Operation start signal START_M 6 may be used to instruct the M 6 core 140 to start operating. The M 6 block cipher system 100 performs a single round during each of clock cycle, and may include 10 rounds in total, for example.

FIG. 2 is a block diagram illustrating the M 6 core 140 in FIG. 1 . Referring to FIG. 2 , the M 6 core 140 may include a first multiplexer 210 and an M 6 core controller 220 . The first multiplexer 210 may select one of the input signals TEXT_IN and ROUND_OUT in response to a first control signal C 1 so as to output one of the input signals. The M 6 core controller 220 may output an operation start signal START_OP, a first control signal C 1 and a validity signal VALID corresponding to the round number R_NUM and the operation start signal START_M 6 .

The operation start signal START_OP may instruct a Pi function 240 to perform a round operation. The first control signal C 1 may instruct the first multiplexer 210 to select the input signal TEXT_IN in a first round operation and to select the round output signal ROUND_OUT in subsequent round operations. The validity signal VALID may indicate the end of encoding and/or decoding and the validity of the encoded and/or decoded value. The M 6 core controller 220 may further receive the operation start signal START_M 6 that may instruct the M 6 core 140 to start operating, and further output the operation start signal START_OP.

The M 6 core may include a round key generator 230 and a Pi function 240 . The round key generator 230 may generate two operation keys Key 1 and Key 2 corresponding to the key signal KEY. In response to rotate constants RC 1 , RC 2 and RC 3 , two operation keys Key 1 and Key 2 and the mode selection signal MODE_SEL, the Pi function 240 may perform a round operation on the first multiplexer 210 output signal to generate a round output signal ROUND_OUT and a round number R_NUM. If the round output signal ROUND_OUT is a final round output signal, the output signal TEXT_OUT may be a final output signal of the M 6 core 140 .

FIG. 3 is a block diagram illustrating the Pi function 240 of FIG. 2 . The Pi function 240 may divide the 64-bit first-multiplexer 210 output signal into a consecutive 32-bit first data stream L and a 32-bit second data stream R.

Referring to FIG. 3 , the Pi function 240 may include first through the fourth basic operation devices 301 , 303 , 305 and 307 , and first through third rotate functions 302 , 304 and 306 . The basic operation may be exemplified as any of an add operation, a subtraction operation, a XOR operation according to the locations of the basic operation devices 301 , 303 , 305 and 307 , etc.

The first basic operation device 301 may use the first round operation key Key 1 and the first data stream L to perform a basic operation. The first rotate function 302 rotates a first basic operation device 301 output signal a number of positions where the rotation number may equal the value of the first rotate constant RC 1 .

The second basic operation device 303 may use a first rotate function 302 output signal, the first basic operation device 301 output signal and a constant “1” to perform a basic operation. The second rotate function 304 may rotate a second basic operation device 303 output signal a number of positions, where the rotation number may equal the value of the second rotate constant RC 2 .

The third basic operation device 305 may use a second basic operation device 303 output signal, a second rotate function 304 output signal and the second round operation key Key 2 to perform a basic operation. The third rotate function 306 may rotate the third basic operation device 305 output signal a number of positions, where the rotation number may equal the value of the third rotate constant RC 3 .

The fourth basic operation device 307 may perform a basic operation by employing the mode selection signal MODE_SEL, a third basic operation device 305 output signal, a third rotate function 306 output signal and a second data stream R, for outputting a round number R_NUM containing information on the present round operation, and for outputting the ROUND_OUT output signal (e.g., TEXT_OUT) which is the final output signal. The TEXT_OUT signal may be the final output signal if the ROUND_OUT output signal is a final round output signal, as described above.

FIG. 4 is a block diagram of an M 6 block cipher system 400 according to another example embodiment of the present invention. Referring to FIG. 4 , an M 6 block cipher system 400 may perform a plurality of round operations in order to authenticate devices for receiving and/or transmitting content and to encode content.

The M 6 block cipher system may include a rotate constant selector 410 . The rotate constant selector 410 may select from among rotate constants S 56 _S 2 , S 56 _S 3 , KE 56 _S 2 and KE 56 -S 3 in response to a SKE selection signal SKE_SEL, and to output rotate constants S 2 and S 3 . The SKE selection signal SKE_SEL may be used to determine whether to encode content M 6 _S 56 or to generate a random number and an exchange key M 6 _KE 56 for device authentication. In the rotate constants S 56 _S 2 , S 56 _S 3 , KE 56 _S 2 and KE 56 -S 3 , two rotate constants S 56 _S 2 and S 56 _S 3 may be used to encode content, and two rotate constants KE 56 _S 2 and KE 56 -S 3 may be used to generate a random number and an exchange key for device authentication.

The M 6 block cipher system 400 may include a rotate constant ordering device 420 and a rotate constant scheduler 430 . The rotate constant ordering device 420 may order the received rotate constants S 2 and S 3 , a common rotate constant S 1 and a non-common rotate constant S 0 , and to output a rotate constant RC in response to a rotate constant selection signal RC_SEL. The common rotate constant S 1 may be commonly used to encode content and authenticate the device. The non-common rotate constant S 0 may be used when an output signal is not rotated.

The rotate constant scheduler 430 may output a rotate constant selection signal RC_SEL which may decide the order of the rotate constants used for a round operation in response to an SKE selection signal SKE_SEL, a round number R_NUM and a sub round number S_R_NUM. The round number R_NUM may contain information on the present round operation and the sub round number S_R_NUM may contain information on a present sub round operation performed in the present round.

The M 6 block cipher system 400 may include an M 6 core 440 . The M 6 core 440 may encode or decode an input signal TEXT_IN in response to the rotate constant RC, a key signal KEY, a mode selection signal MODE_SEL, a round number R_NUM, a sub round number S_R_NUM and a validity signal VALID so as to output signal TEXT_OUT. The round number R_NUM may contain information on the present round operation and the S_R_NUM may contain information on the present sub round operation. The validity signal VALID may indicate the end of encoding and/or decoding and the validity of the encoded and/or decoded value. The key signal KEY may be used to create two round operation keys necessary for each round operation performed in the M 6 core 440 . The mode selection signal MODE_SEL may be used to instruct the M 6 core 440 to encode or decode the input signal TEXT_IN.

If the input signal TEXT_IN is plain text, the mode selection signal MODE_SEL may instruct the M 6 core 440 to encode the input signal TEXT_IN. If the input signal TEXT_IN is cipher text, the mode selection signal MODE_SEL may instruct the M 6 core 440 to decode the input signal TEXT_IN. An operation start signal START_M 6 may instruct the M 6 core 440 to start operating.

The M 6 block cipher system 400 shown in FIG. 4 may perform a single round during a plurality of clock cycles, and may include 10 rounds in total. The plurality of clock cycles may be necessary for a single round because each single round is divided into a plurality of sub rounds. Each of the sub rounds may be performed during a single clock cycle.

FIG. 5 is a block diagram of the M 6 core 440 shown in FIG. 4 . Referring now to FIG. 5 , the M 6 core 440 may include a first multiplexer 510 and an M 6 core controller 520 . The first multiplexer 510 may select and output one of the input signal TEXT_IN and a round output signal ROUND_OUT in response to a first control signal C 1 . By employing the round number R_NUM, the sub round number S_R_NUM and the operation start signal START_M 6 , the M 6 core controller 520 may output an operation start signal START_OP, the first control signal C 1 and the validity signal VALID. The operation start signal START_OP may instruct a Pi function 540 to perform a round operation. The first control signal C 1 may be used to instruct the first multiplexer 510 to select the input signal TEXT_IN in a first round operation, and to select the round output signal ROUND_OUT in other round operations. The validity signal VALID may indicate an end of encoding and/or decoding and the validity of the encoded and/or decoded value. The M 6 core controller 520 may further receive the operation start signal START_M 6 instructing the M 6 core 440 to start operating.

The M 6 core 440 may include a round key generator 530 and a Pi function 540 . The round key generator 530 may generate two operation keys Key 1 and Key 2 in response to the signal KEY. The Pi function 240 may perform round operation on an first multiplexer 510 output signal corresponding to the operation start signal START_OP, the rotate constant RC, the two operation keys Key 1 and Key 2 and the mode selection signal MODE_SEL so as to output a round number R_NUM, a sub round number S_R_NUM and a round output signal ROUNT_OUT. If the round output signal ROUND_OUT is a final round output signal, the round output signal TEXT _OUT is a final output signal of the M 6 core 440 .

FIG. 6 is a block diagram of the Pi function 540 shown in FIG. 5 . Referring now to FIG. 6 , the Pi function 540 may include a first basic operation device 601 , a rotate function 602 and a second basic operation device 603 for three sub round operations. Circled numbers in FIG. 6 indicates signals processed during the sub rounds.

Employing the two round operation keys Key 1 and Key 2 , a constant “1” and a first data stream L, the first basic operation device 601 may perform a basic operation. The rotate function 602 may rotates a first basic operation device 601 output signal where the position rotation number may equal a value of the rotate constant RC. The second basic operation device 603 may use an output signal of the rotate function 602 , the output signal of the first basic operation device 601 and a second data stream R to perform the basic operation. The first basic operation device 601 may operate in response to the mode selection signal MODE_SEL and the sub round number S_R_NUM. The second basic operation device 603 may generate a sub round number S_R_NUM and a round number R_NUM. The basic operation may be an add operation, a subtraction operation, or a XOR operation.

The operation of the first basic operation device 601 and the second basic operation device 603 is as described below. The first basic operation device 601 may perform a basic operation on the first round operation key Key 1 and the first data stream L during a first sub round of each round, a basic operation on the output signal ROUND_OUT of the second basic operation device 603 and the constant “1” during a second sub round of each round and a basic operation on the second round operation key Key 2 and the output signal ROUND_OUT of the second basic operation device 603 at the third sub round of each round. The second basic operation device 603 may use the second data stream R in the basic operation during a final sub round of each round.

FIG. 7 is a block diagram of the Pi function 540 according to another sample embodiment of the present invention. Referring to FIG. 7 , the Pi function 540 , which may perform six sub rounds, may include a basic operation device 701 and a rotate function 702 . Circled numbers in FIG. 7 indicate signals processed during the sub rounds.

The basic operation device 701 may have the same function as the first basic operation device 601 and the rotate function 702 may be of the same function of the rotate function 602 . The basic operation on the first data stream L and the first round operation key Key 1 may be performed in a first round, and data that have been rotated based on the corresponding rotate constant may be generated. The generated data may be input to the basic operation device 701 , which may perform operations on the generated data in the order indicated by the circled numbers. The rotate function 702 may output the round number R_NUM and the sub round number S_R_NUM containing information on the present round and sub round, respectively.

FIG. 8 is a state diagram illustrating an M 6 block cipher system that does not perform the sub round operation according to an example embodiment of the present invention. Referring to FIG. 8 , the M 6 block cipher system may perform a single round during each clock cycle and it has two states indicating as an idle state IDEL and a run state RUN. The M 6 block cipher system may be in the idle state IDLE if R_NUM=10, and be in the run state RUN if the operation signal START_M 6 is enabled (“1”). If the value of the round number R_NUM is less than 10, the M 6 block cipher system may remain in the run state RUN, and if the value of the round number R_NUM is 10, the M 6 block cipher system may enter the idle state IDLE.

FIG. 9 is a state diagram of an M 6 block cipher system that performs a plurality of sub round operations according to an example embodiment of the present invention. Referring to FIG. 9 , the M 6 block cipher system may use a single sub round for a single clock cycle and the system has a run state as it has a plurality of sub run states S_R 1 , S_R 2 . . . of the run state RUN. The M 6 block cipher system using the plurality of sub rounds may end a round if all of the plurality of sub run states S_R 1 , S_R 2 . . . , S_R final are completed.

FIG. 10 is a timing diagram illustrating an M 6 block cipher system that does not perform a sub round operation according to another example embodiment of the present invention. Referring now to FIG. 10 , the M 6 block cipher system at the idle state IDLE may start operating in response to the operation start signal START_M 6 and enter the run state RUN while loading data simultaneously. The run state RUN may include 10 rounds. The M 6 block cipher system may perform a round operation during each clock cycle and output the validity signal VALID and the signal TEXT_OUT during the final round.

FIG. 11 is a timing diagram of the M 6 block cipher system that may perform a plurality of sub round operations according to an example embodiment of the present invention. Referring to FIG. 11 , the M 6 block cipher system may perform the same operations as the M 6 block cipher system described with reference to FIG. 10 , except that a round is composed of a plurality of sub rounds, i.e., Sub Round 1 through Final Sub Round.

Since sub rounds have its advantages and disadvantage at the same time, the sub rounds may be used in the M 6 cipher system according to the system requirements. The M 6 block cipher system having no sub round has a short clock cycle whereas the M 6 block cipher system with sub rounds can be realized with a smaller circuit. The M 6 block cipher system may properly use sub rounds according to factors such as operating speed and hardware volume, etc. Although the M 6 block cipher systems with three sub rounds and six sub rounds have been described, it is also found that an M 6 block cipher system having four sub rounds may be effective.

Therefore, the example embodiments of the present invention provide an M 6 block cipher system that uses a core to encode content and authenticate a device, where the duration of a round is a single clock cycle. The example embodiments of the present invention also provide an M 6 block cipher system that uses a single core to encode content and authenticate a device, where the duration of a round is a plurality of clock cycles by dividing each round into a plurality of sub-rounds.

While example embodiments of the present invention have been particularly shown and described, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the example embodiments of the present invention, as defined by the following claims.