Method and system for the accelerated decryption of cryptographically protected user data units

This is a U.S. national stage of application No. PCT/EP2010/065266 filed 12 Oct. 2010. Priority is claimed on German Application No. 10 2009 052 456.8 filed 9 Nov. 2009, the content of which is incorporated herein by reference in its entirety.

1. Field of the Invention

The invention relates to data encryption and, more particularly, to a method and system for accelerated decryption of cryptographically protected user data units, and more particularly for the accelerated decryption of hybrid encrypted data.

2. Description of the Related Art

When transporting data from a transmitter to a receiver over a transmission channel, these data are in many cases transmitted in encrypted form to prevent unauthorized third party access to the data. Various encryption methods are known, in particular asymmetrical and symmetrical encryption methods. In a conventional hybrid encryption method, an asymmetrical encryption is combined with a symmetrical encryption. In this case, a generated session key is firstly asymmetrically encrypted using an asymmetrical encryption method, and buffered. Using a symmetrical encryption method, the user data that is actually to be transmitted is then encrypted using the generated unencrypted session key and following buffering is transported over the transmission channel to a receiver. Decryption occurs accordingly on the part of the receiver. The use of a hybrid encryption method means that, firstly, the user data are encrypted using an asymmetrical encryption method, where this allows asymmetrical key management, and, secondly, the high performance and the low demands on the computing power for encryption and decryption of the user data, due to the symmetrical encryption method used, are utilized. The asymmetrical key management uses key pairs which consist of a public key for encryption and a private key for decryption. Owing to the asymmetrical key management the public key, which is used in the asymmetrical encryption method, does not need to be kept secret. The use of the symmetrical encryption and decryption method for the user data leads to increased data rates in comparison to asymmetrical encryption methods with a comparable security level of the key lengths used.

In conventional hybrid encryption methods, the public key portion of the hybrid encryption method represents a performance bottleneck in many practical applications. This applies in particular in the case of software implementations of cryptographic methods, such as in the case of embedded systems, microcontrollers and smart cards. For this reason in conventional systems, which use hybrid encryption methods, special hardware, such as long-number arithmetic logic units, crypto processors or hardware multipliers, is used in many cases to accelerate the public key calculations or asymmetrical encryption and decryption. The public key operations or calculation steps performed during the course of asymmetrical encryption and decryption are complex and require high computing power and are time consuming.

It is therefore an object of the present invention to provide a method that accelerates a hybrid encryption method without the demands on the computing power or the complexity of the circuits used in the process being appreciably increased.

This and other objects and advantages are achieved in accordance with the invention by a method for the accelerated decryption of cryptographically protected user data units, comprising the following steps:

(a) decryption of a received asymmetrically encrypted key (ENC-K OEM ) by a receiver with a private key (K PRIV ) if verification of the received related key identification (K OEM -ID) of the cryptographic key (K OEM ) shows that the cryptographic key (K OEM ) is not yet present in a decrypted state in the receiver; and

(b) decryption of a received cryptographically encrypted user data unit (ENC-NDE) using the cryptographic key (K OEM ) present in the receiver or using the cryptographic key (K OEM ) decrypted with the private key (K PRIV ), if the cryptographic key (K OEM ) is not present in the receiver.

In an embodiment of the method, if verification of the received key identification shows that the related cryptographic key is not yet present in the receiver, the cryptographic key decrypted using the private key is stored in the receiver together with its related key identification.

In another embodiment of the method, the user data units comprise a software component belonging to a software component manufacturer OEM.

In another possible embodiment, the cryptographic key K OEM comprises a session key belonging to the software component manufacturer.

In a further embodiment, the key identification comprises a hash value or test value of the respective cryptographic key.

In a still further embodiment of the method, the key identification comprises a generated random number of a random number generator of the transmitter.

In an alternative embodiment of the method, the key identification comprises a generated count value of a counter of the transmitter.

In another embodiment of the method, the encrypted user data unit, the related asymmetrically encrypted cryptographic key and its key identification are transported from the transmitter to the receiver over a network or stored on a data carrier.

In an embodiment of the method, the transmitter comprises a development system belonging to a software component manufacturer for the development of software components.

In another possible embodiment, the receiver comprises a target system device belonging to a user for the execution of software components.

In another embodiment of the method, the receiver comprises a memory-programmable controller.

It is also an object of the invention to provide a system for the accelerated decryption of cryptographically protected user data units comprising:

(a) a transmitter which comprises a first encryption unit for the asymmetrical encryption of a cryptographic key (K OEM ) using a public key (K PUB ), a second encryption unit for encrypting at least one user data unit (NDE) using the cryptographic key (K OEM ), and an interface for providing, i.e., making available the encrypted user data unit (ENC-NDE), the asymmetrically encrypted key (ENC-K OEM ) and a related key identification (K OEM -ID) of the cryptographic key (K OEM ), (b) a transportation device for transporting the encrypted user data unit (ENC-NDE), the asymmetrically encrypted key (ENC-K OEM ) and the related key identification (K OEM -ID) of the cryptographic key (K OEM ).

The system further comprises (c) a receiver which comprises a testing unit for, with the aid of the received key identification (K OEM -ID), verifying whether the transported asymmetrically encrypted key (ENC-K OEM ) is already present in an encrypted form in the receiver, a first decryption unit for decrypting the received asymmetrically encrypted key (ENC-K OEM ) using a private key (K PRIV ), if the verification of the related key identification (K OEM -ID) of the cryptographic key (K OEM ) shows that the received encrypted cryptographic key (K OEM ) is not yet present in a decrypted form in the receiver, and a second decryption unit that decrypts the received cryptographically encrypted user data unit (ENC-NDE) using the cryptographic key (K OEM ) already present in an encrypted form in the receiver or using the cryptographic key (K OEM ) decrypted by the first decryption unit.

It is also an object of the invention to provide a transmitter comprising a first encryption unit for the asymmetrical encryption of a cryptographic key (K OEM ) using a public key (K PUB ), a second encryption unit for encrypting at least one the user data unit (NDE) using the cryptographic key (K OEM ) and an interface for providing, i.e., making available the encrypted user data unit (ENC-NDE), the asymmetrically encrypted key (ENC-K OEM ) and a related key identification (K OEM -ID) of the cryptographic key (K OEM ).

It is also an object of the invention to provide a receiver comprising a testing unit for verifying, with the aid of the received key identification (K OEM -ID), whether the transported asymmetrically encrypted key (ENC-K OEM ) is already present in an encrypted form in the receiver, a first decryption unit for decrypting the received asymmetrically encrypted key (ENC-K OEM ) using a private key (K PRIV ) if the verification of the related key identification (K OEM -ID) of the cryptographic key (K OEM ) shows that the received encrypted cryptographic key (K OEM ) is not yet present in a decrypted form, and a second decryption unit which decrypts the received cryptographically encrypted user data unit (ENC-NDE) using the cryptographic key (K OEM ) already present in an encrypted form in the receiver or using the cryptographic key (K OEM ) decrypted by the first decryption unit.

Other objects and features of the present invention will become apparent from the following detailed description considered in conjunction with the accompanying drawings. It is to be understood, however, that the drawings are designed solely for purposes of illustration and not as a definition of the limits of the invention, for which reference should be made to the appended claims. It should be further understood that the drawings are not necessarily drawn to scale and that, unless otherwise indicated, they are merely intended to conceptually illustrate the structures and procedures described herein.

Possible embodiments of the inventive method of the inventive system will be described hereinafter with reference to the accompanying figures, in which:

FIG. 1 shows a flow diagram of the method in accordance with an embodiment of the invention; and

FIG. 2 shows a schematic block diagram of the system in accordance with an embodiment of the invention.

As may be seen from FIG. 1 , an encrypted data transmission comprises a method for the accelerated decryption of cryptographically protected user data NDE according to the invention, wherein the data transmission, occur in six steps S 1 to S 6 , includes the decryption method in accordance with the invention in steps S 5 , S 6 .

In a first step S 1 a cryptographic key is initially generated. This cryptographic key can in particular be a cryptographic key belonging to a software component manufacturer Original Equipment Manufacturer (OEM). The generated cryptographic key K OEM is provided in step S 1 with a related key identification K OEM -ID. In one possible embodiment of the transmission, the key identification K OEM -ID is formed or calculated by a hash or test value of the respective cryptographic key K OEM . In an alternative embodiment, the key identification K OEM -ID comprises a generated random number that is generated, for example, by a random number generator of the transmitter. In a further possible embodiment, the key identification K OEM -ID is generated by a generated count value of a counter inside the transmitter.

After generation of the cryptographic key K OEM and a related key identification in step S 1 , the generated cryptographic key K OEM is asymmetrically encrypted in step S 2 by the transmitter using a public cryptographic key K pub .

In a further step S 3 , at least one user data unit NDE is encrypted by the transmitter using the generated cryptographic key K OEM . In one possible embodiment, the user data unit NDE is a software component SWK or a software element belonging to a software component manufacturer OEM, where the transmitter is part of a development system or a development environment belonging to the software component manufacturer.

In a further step S 4 , the encrypted user data unit ENC-NDE or the encrypted software component and the asymmetrically encrypted cryptographic key ENC-K OEM and the related key identification (K OEM -ID) of the cryptographic key K OEM are transported from the transmitter to a receiver. In one possible embodiment, transportation can occur over a cable or a network. In an alternative embodiment, transportation occurs using a storage device or a data carrier.

The decryption method occurs on the receiving side, where in a step S 5 a decryption of the received asymmetrically encrypted key ENC-K OEM is performed using a private key K priv , if a verification of the received related key identification K OEM -ID of the cryptographic key shows that the cryptographic key K OEM is not yet present in a decrypted state in the receiver.

In a further step S 6 , the received cryptographically encrypted user data unit ENC-NDE is decrypted using either the cryptographic key K OEM already present in the receiver or using the cryptographic key K OEM decrypted using the private key K priv , if the cryptographic key (K OEM ) is not yet present in the receiver.

If verification in step S 5 of the received key identification K OEM -ID shows that the related cryptographic key K OEM is not yet present in the receiver, the cryptographic key K OEM decrypted using the private key K priv is stored for further use in the receiver together with its related key identification K OEM -ID.

FIG. 2 shows a block diagram of a system 1 in accordance with an embodiment of the invention for the accelerated decryption of cryptographically protected user data units. The system 1 comprises a transmitter 2 and a receiver 3 which are connected together by transportation device 4 . In the embodiment shown in FIG. 2 , the transportation device 4 is a data cable. In an alternative embodiment, the transportation device is a network or a large number of networks. The network can also be a wireless network. In an alternative embodiment, the transportation device is a memory or a data carrier that transports the data in stored form.

The transmitter 2 comprises a first encryption unit 2 A for the asymmetrical encryption of a generated cryptographic key K OEM using a public key k pub . The cryptographic key K OEM can be generated, for example, in a key generator 2 B belonging to the transmitter 2 . In one possible embodiment, the public key k pub can be stored in a register or a memory 2 C of the transmitter 2 .

The transmitter 2 also includes a second encryption unit 2 D for encrypting at least one user data unit NDE using the generated cryptographic key K OEM . The user data unit NDE originates in the exemplary embodiment of FIG. 2 from a user data source outside of the transmitter 2 . The user data unit NDE can in particular be a software component SWK that is programmed or manufactured by a software component manufacturer OEM by means of a development tool. The user data unit NDE or the programmed software component SWK can be a short executable program or sub-program, for example. The software component comprises a source code or object code of the respective program or sub-program. This source code or object code or this user data unit is encrypted using the generated cryptographic key K OEM by the second encryption unit 2 D of the transmitter 2 and made available through an interface 2 E of the transmitter 2 . The transmitter 2 can be integrated in a development environment of the software component manufacturer OEM. The interface 2 E provides the encrypted user data unit ENC-NDE or the encrypted software component, the asymmetrically encrypted key ENC-K OEM and the related key identification K OEM -ID of the cryptographic key K OEM .

In one possible embodiment, the transmitter 2 comprises a unit 2 F for providing a related key identification K OEM -ID that is triggered, for example by the key generator 2 B when providing the cryptographic key K OEM . In one possible embodiment, the unit 2 F 7 can be a random number generator that generates a random number as a key identification K OEM -ID. In an alternative embodiment, the unit 2 F is a counter that generates a count value which is provided as the key identification K OEM -ID.

The transportation device 4 transports the encrypted user data unit ENC-NDE, the asymmetrically encrypted key ENC-K OEM and the related key identification K OEM -ID of the cryptographic key K OEM from the transmitter 2 to the receiver 3 . The transportation device can be a data cable, one or more network(s) or a data carrier.

The receiver 3 of the inventive system 1 , as is shown in FIG. 2 , comprises a testing unit 3 A which, with the aid of the received key identification K OEM -ID, verifies whether the transported asymmetrically encrypted key ENC-K OEM is already present in an encrypted form in the receiver 3 . In one possible embodiment, the testing unit 3 A has access for this purpose to an internal memory 3 B belonging to the receiver 3 , in which a plurality of key identifications K OEM -ID and the related cryptographic keys K OEM are stored.

The receiver 3 also comprises a first decryption unit 3 C which is provided for the decryption of the received asymmetrically encrypted key ENC-K OEM using a private key K priv , if the verification of the related key identification K OEM -ID of the cryptographic key K OEM by the testing unit 3 A shows that the encrypted received cryptographic key K OEM is not present in decrypted form in the memory 3 B of the receiver 3 . In one possible embodiment, the first decryption unit 3 C receives a corresponding control signal (Enable) from the testing unit 3 A over a control signal cable. The private cryptographic key K priv , can be stored in a protected memory unit 3 D of the memory device 3 .

The receiver 3 also comprises a second decryption unit 3 E that decrypts the received cryptographically encrypted user data unit ENC-NDE using the cryptographic key K OEM already present in an encrypted form in the receiver or alternatively using the cryptographic key K OEM decrypted by the first decryption unit 3 C. In the embodiment shown in FIG. 2 , a multiplexer 3 F of the receiver 3 is switched as a function of a control signal that originates from the testing unit 3 A. If the testing unit 3 A shows that the encrypted received cryptographic key K OEM is not yet present in encrypted form, for example, in the memory 3 B of the receiver 3 , the testing unit 3 A activates the first decryption unit 3 C for decryption of the received asymmetrical encrypted key using the private key K priv and switches the output of the first decryption unit 3 C, which supplies the decrypted cryptographic key K OEM , with the multiplexer 3 F to the second decryption unit 3 E. If, conversely, the testing unit 3 A finds that the cryptographic key K OEM is already present in stored form in the receiver 3 , decryption using the first decryption unit 3 C no longer needs to occur and the existing cryptographic key K OEM already stored is passed to the second decryption unit 3 E using the multiplexer 3 F. In this case, the relatively complex decryption using the first decryption unit 3 C can be omitted, so that the decryption of the cryptographically protected user data unit NDE is accelerated.

In one possible embodiment, the cryptographic key K OEM is formed by a session key belonging to the software component manufacturer OEM. In one possible embodiment, the transmitting user data unit NDE or the transmitted software component SWK is executed at the receiver side by an executing unit or a microprocessor. The receiver 3 can be part of a target system device belonging to a user for the execution of software components SWK or user data units NDE. In another embodiment, the receiver 3 comprises a memory-programmable controller SPS.

In accordance with the invention for the implementation of a hybrid encryption method, a session key used asymmetrically for user data encryption can be provided with key identifications which can be read in plain text.

In an accordance with the disclosed embodiments of the method, a directory of all session keys previously decrypted with the aid of a public key method is preferably set up and updated. This directory can be located, for example, in the memory 3 B of the receiver 3 . If a new hybrid encrypted data record or a user data unit is received for encryption, it is initially verified whether the directory of the previously decrypted session keys already contains the key identification of the respective session key and if this was used for actual user data encryption of the data record. If the directory does already contain the key identification of the session key, the related session key is read out of the directory and symmetrical decryption of the user data proceeds directly. If the directory does not contain such a key identification, however, or if when decrypting the user data using a session key from the directory it is found that authentication of the encrypted user data is not possible, complete hybrid decryption is performed only in this case. Therefore, with the aid of the public key method the session key, which was used for symmetrical encryption of the user data, is firstly reconstructed and then the user data are symmetrically decrypted with the aid of the calculated session key. The session key calculated in this way is preferably then incorporated in the directory or memory together with its related key identification.

The method in accordance with the disclosed embodiments can be implemented accordingly in the case of a new hybrid encryption of a user data unit NDE if the session key already known is to be used for encryption of the user data unit. In this case, the public key encryption of the session key does not need to be re-calculated. The user data unit is merely symmetrically encrypted.

Marking or identifying hybrid encrypted session keys in accordance with the disclosed embodiments of the method by the encrypting and decryption units makes it possible to recognize whether a specific session key has already been calculated in the past with the aid of a public key calculating operation. If this key is already present in the directory of calculated keys. then renewed execution of the public key operations that reduce performance can be omitted in the disclosed embodiments of the method. In this case the encryption and decryption process is reduced to the symmetrical calculating operations using the pure user data. If certain hybrid encrypted data records or user data units are encrypted or decrypted again and again or are used for a plurality of data records or user data units of the same session key in the disclosed embodiments of the system, the performance or output of the system or computer system can be significantly increased by the disclosed embodiments of the method.

The disclosed embodiments of the method, in which a key identification is used for identifying session keys, can be combined in some embodiments with further methods for protecting against attacks in pre-calculated tables, or to reduce the entropy loss of the secret key material by way of the key identifications that can be read in plain text.

The method and system in accordance with the disclosed embodiments may be used in particular for the secure and confidential transmission of software components or user data units from a development environment 2 to a target system device 3 , for example, a memory-programmable controller SPS. In one possible embodiment, the key IDs can also be hash or test values of the actual key data. It is also possible for the key identification or key ID to be generated randomly and independently of the key data.

Thus, while there have shown and described and pointed out fundamental novel features of the invention as applied to a preferred embodiment thereof, it will be understood that various omissions and substitutions and changes in the form and details of the devices illustrated, and in their operation, may be made by those skilled in the art without departing from the spirit of the invention. For example, it is expressly intended that all combinations of those elements and/or method steps which perform substantially the same function in substantially the same way to achieve the same results are within the scope of the invention. Moreover, it should be recognized that structures and/or elements and/or method steps shown and/or described in connection with any disclosed form or embodiment of the invention may be incorporated in any other disclosed or described or suggested form or embodiment as a general matter of design choice. It is the intention, therefore, to be limited only as indicated by the scope of the claims appended hereto.