Data encryption device, data decryption device, and data encryption/decryption device

[0001] This application is based on an application No. 2002-070938 filed in Japan, the contents of which are hereby incorporated by reference.

[0002] 1. Field of the Invention

[0003] The present invention relates to a data encryption device and a data decryption device.

[0004] 2. Related Art

[0005] Digital communications have become widespread in recent years. To foster sound industrial development and also to protect privacy, increasing importance is attached to ensuring confidentiality of data in such digital communications. Data cryptography provides a means of ensuring data confidentiality. Data cryptography needs to have a high level of security against cryptanalytic attacks.

[0006] One example of such cryptographic techniques is a block cipher. A block cipher is the following. First, plaintext is partitioned into blocks of a predetermined size. Then a nonlinear transformation is performed on each of these blocks, thereby generating ciphertext. Thus, block ciphers achieve high security by employing nonlinear transformations. Examples of block ciphers include Serpent and Hierocrypt-3. These block ciphers have the SPN (Substitution-Permutation Network) construction. The SPN construction is explained using a specific example below.

[0007] To realize a block cipher having the SPN construction, an encryption device has four data transformation units and one data diffusion unit. When 128-bit plaintext data is input, the encryption device divides the plaintext data into four 32-bit data blocks. These four 32-bit data blocks are input respectively to the four data transformation units. Each data transformation unit performs a nonlinear transformation on its input 32-bit data block, and outputs the result to the data diffusion unit. The data diffusion unit receives the four 32-bit data blocks from the four data transformation units, and shuffles these four 32-bit data blocks. The four 32-bit data blocks are then connected and output as 128-bit ciphertext data. In an actual encryption device, the above operations of the data transformation units and data diffusion unit are repeated a plurality of times to generate ciphertext.

[0008] To decrypt this ciphertext data into the original plaintext data, a decryption device has one inverse data diffusion unit and four inverse data transformation units. When the 128-bit ciphertext data is input, the decryption device divides the ciphertext data into four 32-bit data blocks. These 32-bit data blocks are input in the inverse data diffusion unit. The inverse data diffusion unit performs the inverse operation of the above data diffusion unit on the four 32-bit data blocks. Having done so, the inverse data diffusion unit outputs the resulting four 32-bit data blocks respectively to the four inverse data transformation units. Each inverse data transformation unit performs the inverse operation of the above data transformation units on its input 32-bit data block. The resulting four 32-bit data blocks are connected and output as the 128-bit plaintext data. In an actual decryption device, the above operations of the inverse data diffusion unit and inverse data transformation units are repeated the same number of times as in the encryption device, to generate plaintext.

[0009] Thus, according to a block cipher having the SPN construction, data transformation units and data diffusion unit used for encryption conduct different operations from data transformation units and data diffusion unit used for decryption. In other words, the inverse operation of the encryption is performed in the decryption. Accordingly, when implementing a circuit that performs both encryption and decryption, the circuit scale needs to be twice as large as a circuit that performs only one of encryption and decryption. This causes increases in cost.

[0010] The present invention was conceived in view of the problem described above, and has an object of providing a data encryption device and data decryption device which enable a circuit that performs both encryption and decryption to be implemented without increases in circuit scale.

[0011] The stated object can be achieved by a data encryption device for encrypting N-bit plaintext to generate N-bit ciphertext where N is a positive integer, including: a division unit operable to divide the N-bit plaintext into M data blocks which are each B bits long, where NMB; a first transformation unit operable to perform a data transformation on each of the M data blocks, the data transformation being equal to its own inverse; a diffusion unit operable to perform an invertible data diffusion on the M data blocks transformed by the first transformation unit; a second transformation unit operable to perform the same data transformation as the data transformation performed by the first transformation unit, on each of the M data blocks diffused by the diffusion unit; and a connection unit operable to connect the M data blocks transformed by the second transformation unit, thereby generating the N-bit ciphertext.

[0012] According to this construction, the data encryption device uses such a data transformation that is equal to its own inverse. Therefore, the data encryption device can decrypt ciphertext which was generated by the data encryption device itself, by performing the same data transformation again on the ciphertext. Hence a circuit that performs the data transformation can be commonly used for encryption and decryption.

[0013] Here, the first transformation unit may include: a division subunit operable to divide each of the M data blocks into first data of higher-order B/2 bits and second data of lower-order B/2 bits; a shuffle subunit operable to shuffle the first data and the second data to generate third data of higher-order B/2 bits and fourth data of lower-order B/2 bits; and a connection subunit operable to exchange in order the third data and the fourth data, and connect the exchanged third data and fourth data as a data block transformed by the first transformation unit.

[0014] According to this construction, the data transformation is equal to its own inverse, because the third data and the fourth data are exchanged in order. Hence the data encryption device can decrypt ciphertext which was generated by the data encryption device itself, by using the same data transformation.

[0015] Here, the shuffle subunit may include: a substitution subunit operable to concurrently (a) perform a substitution on the second data and output the substituted second data to a combination subunit, and (b) output the second data as the fourth data; and the combination subunit operable to combine the first data and the substituted second data, and output the combination as the third data.

[0016] According to this construction, the data shuffling effect is enhanced.

[0017] Here, the first transformation unit may be operable to perform the data transformation on each of the M data blocks a plurality of times, and the diffusion unit may be operable to perform the data diffusion on the M data blocks transformed by the first transformation unit, a plurality of times.

[0018] According to this construction, the data shuffling effect is further enhanced.

[0019] The stated object can also be achieved by a data encryption device for encrypting N-bit plaintext to generate N-bit ciphertext where N is a positive integer, including: a division unit operable to divide the N-bit plaintext into M data blocks which are each B bits long, where NMB; a first transformation unit operable to perform a series of operations a plurality of times on each of the M data blocks, the series of operations including, in the stated order, (a) a data transformation that is equal to its own inverse and (b) an invertible data diffusion; a round control unit operable to count a number of times the first transformation unit has performed the series of operations, and when the number reaches a predetermined number, to output the resulting M data blocks to a second transformation unit; the second transformation unit operable to perform the same data transformation as the data transformation performed by the first transformation unit, on each of the M data blocks output from the round control unit; and a connection unit operable to connect the M data blocks transformed by the second transformation unit, thereby generating the N-bit ciphertext.

[0020] According to this construction, the data encryption device repeats the data transformation and the data diffusion a plurality of times. This increases the data shuffling effect. Also, the data encryption device uses such a data transformation that is equal to its own inverse. Hence the data encryption device can decrypt ciphertext which was generated by the data encryption device itself, by using the same data transformation.

[0021] The stated object can also be achieved by a data decryption device for decrypting N-bit ciphertext to obtain N-bit plaintext where N is a positive integer, the N-bit ciphertext being generated by a data encryption device by (1) dividing the N-bit plaintext into M data blocks which are each B bits long where NMB, (2) performing a data transformation that is equal to its own inverse, on each of the M data blocks, (3) performing an invertible data diffusion on the transformed M data blocks, (4) further performing the data transformation on each of the diffused M data blocks, and (5) connecting the further transformed M data blocks as the N-bit ciphertext, the data decryption device including: a division unit operable to divide the N-bit ciphertext into M data blocks which are each B bits long; a first transformation unit operable to perform the same data transformation as the data transformation performed by the data encryption device, on each of the M data blocks divided by the division unit; an inverse diffusion unit operable to perform an inverse of the data diffusion performed by the data encryption device, on the M data blocks transformed by the first transformation unit; a second transformation unit operable to perform the same data transformation as the data transformation performed by the data encryption device, on each of the M data blocks inverse-diffused by the inverse diffusion unit; and a connection unit operable to connect the M data blocks transformed by the second transformation unit, thereby obtaining the N-bit plaintext.

[0022] According to this construction, the data decryption device performs the same data transformation as the data encryption device. Therefore, the data decryption device can share a circuit that performs the data transformation with the data encryption device.

[0023] The stated object can also be achieved by a data decryption device for decrypting N-bit ciphertext to obtain N-bit plaintext where N is a positive integer, the N-bit ciphertext being generated by a data encryption device by (1) dividing the N-bit plaintext into M data blocks which are each B bits long where NMB, (2) performing a first series of operations a plurality of times on each of the M data blocks, the first series of operations including, in the stated order, (a) a data transformation that is equal to its own inverse and (b) an invertible data diffusion, (3) counting a number of times the first series of operations has been performed, and when the number reaches a predetermined number, outputting the resulting M data blocks, (4) further performing the data transformation on each of the output M data blocks, and (5) connecting the further transformed M data blocks as the N-bit ciphertext, the data decryption device including: a division unit operable to divide the N-bit ciphertext into M data blocks which are each B bits long; a first transformation unit operable to perform a second series of operations a plurality of times on each of the M data blocks divided by the division unit, the second series of operations including, in the stated order, (c) the same data transformation as the data transformation performed by the data encryption device and (d) an inverse of the data diffusion performed by the data encryption device; a round control unit operable to count a number of times the first transformation unit has performed the second series of operations, and when the number reaches the predetermined number, to output the resulting M data blocks to a second transformation unit; the second transformation unit operable to perform the same data transformation as the data transformation performed by the data encryption device, on each of the M data blocks output from the round control unit; and a connection unit operable to connect the M data blocks transformed by the second transformation unit, thereby obtaining the N-bit plaintext.

[0024] According to this construction, the data decryption device performs the same data transformation as the data encryption device. Hence the data decryption device can share a circuit that performs the data transformation with the data encryption device.

[0025] The stated object can also be achieved by a data encryption/decryption device for encrypting/decrypting first N-bit data to generate second N-bit data where N is a positive integer, including: a division unit operable to divide the first N-bit data into M data blocks which are each B bits long, where NMB; a first transformation unit operable to perform a data transformation on each of the M data blocks, the data transformation being equal to its own inverse; a switch unit operable to switch an output destination of the M datablocks transformed by the first transformation unit, depending on whether the first N-bit data is subjected to encryption or decryption; a diffusion unit operable to receive the M data blocks transformed by the first transformation unit when the first N-bit data is subjected to encryption, and perform an invertible data diffusion on the received M data blocks; an inverse diffusion unit operable to receive the M data blocks transformed by the first transformation unit when the first N-bit data is subjected to decryption, and perform an inverse of the data diffusion on the received M data blocks; a second transformation unit operable to perform the same data transformation as the data transformation performed by the first transformation unit, on each of the M data blocks diffused by the diffusion unit or inverse-diffused by the inverse diffusion unit; and a connection unit operable to connect the M data blocks transformed by the second transformation unit, thereby generating the second N-bit data.

[0026] According to this construction, the data encryption/decryption device uses such a data transformation that is equal to its own inverse. Which is to say, the data encryption/decryption device performs the same data transformation for both encryption and decryption. This allows the same data transformation circuit to be used for encryption and decryption. Hence the circuit scale can be reduced when compared with the case where different data transformations are performed for encryption and decryption, with it being possible to reduce costs.

[0027] These and other objects, advantages and features of the invention will become apparent from the following description thereof taken in conjunction with the accompanying drawings which illustrate a specific embodiment of the invention.

[0028] In the drawings:

[0029] FIG. 1 shows a construction of a cryptographic communication system to which an embodiment of the invention relates;

[0030] FIG. 2 is a block diagram showing a construction of a reception device shown in FIG. 1;

[0031] FIG. 3 is a block diagram showing a construction of an encryption/decryption unit shown in FIG. 2;

[0032] FIG. 4 is a block diagram showing a construction of a second data scramble unit shown in FIG. 3;

[0033] FIG. 5 is a block diagram showing a construction of a first data scramble unit shown in FIG. 3;

[0034] FIG. 6 shows a construction of a data transformation unit shown in FIG. 5;

[0035] FIG. 7 shows a construction of a data shuffle unit shown in FIG. 6;

[0036] FIG. 8 shows a construction of a data substitution unit shown in FIG. 7;

[0037] FIG. 9 shows a construction of a first data diffusion unit shown in FIG. 5;

[0038] FIG. 10 shows a construction of a second data diffusion unit shown in FIG. 5;

[0039] FIG. 11 is a flowchart showing an overall operation of the reception device;

[0040] FIG. 12 is a flowchart showing a decryption operation of the encryption/decryption unit in step S104 shown in FIG. 11;

[0041] FIG. 13 is a flowchart showing an encryption operation of the encryption/decryption unit in step S106 shown in FIG. 11;

[0042] FIG. 14 shows a construction of a data shuffle unit which is a modification to the embodiment; and

[0043] FIG. 15 shows a construction of a data substitution unit shown in FIG. 14.

[0044] The following is a description of a cryptographic communication system to which an embodiment of the present invention relates, with reference to drawings.

[0045] FIG. 1 shows a construction of a cryptographic communication system 1. As illustrated, the cryptographic communication system 1 is roughly made up of a reception device 10, a recording medium 11, a content delivery device 12, and a broadcast satellite 13.

[0046] The content delivery device 12 is actually realized by a digital broadcast device. The content delivery device 12 broadcasts encrypted digital content which is superimposed on a digital broadcast wave, via the broadcast satellite 13.

[0047] The reception device 10 receives the digital broadcast wave which is broadcast from the content delivery device 12 via the broadcast satellite 13. The reception device 10 extracts the encrypted digital content from the digital broadcast wave, and decrypts the encrypted digital content. The reception device 10 then re-encrypts the decrypted digital content using another key, and writes this re-encrypted digital content onto the recording medium 11.

[0048] 1. Construction of the Reception Device 10

[0049] The following describes a construction of the reception device 10.

[0050] FIG. 2 is a block diagram showing the construction of the reception device 10. As shown in the drawing, the reception device 10 includes a reception unit 101, a data storage unit 102, a key input unit 103, a key storage unit 104, a control unit 105, an encryption/decryption unit 106, an input/output unit 107, and an antenna 108.

[0051] The reception device 10 is actually realized by a computer system that has a microprocessor, a ROM, a RAM, a key operating unit, a communication unit, an antenna, and the like. A computer program is stored in the RAM. The functions of the reception device 10 are realized by the microprocessor operating in accordance with this computer program.

[0052] (1) Reception Unit 101

[0053] The reception unit 101 receives the digital broadcast wave from the content delivery device 12 through the antenna 108. The reception unit 101 extracts ciphertext data C₁ which is the encrypted digital content, from the received digital broadcast wave. The reception unit 101 writes ciphertext data C₁ to the data storage unit 102.

[0054] Ciphertext data C₁ referred to here has been generated by the content delivery device 12, by encrypting plaintext data P using 1280-bit key data K₁.

[0055] (2) Data Storage Unit 102

[0056] The data storage unit 102 stores ciphertext data C₁ output from the reception unit 101. The data storage unit 102 also stores plaintext data P output from the encryption/decryption unit 106.

[0057] (3) Key Input Unit 103

[0058] The key input unit 103 receives an input of 1280-bit key data K₁ used for decrypting ciphertext data C₁ into plaintext data P, and writes key data K₁ to the key storage unit 104.

[0059] The key input unit 103 also receives an input of 1280-bit key data K₂ used for re-encrypting plaintext data P, which is obtained by decrypting ciphertext data C₁ using key data K₁, into ciphertext data C₂. The key input unit 103 writes key data K₂ to the key storage unit 104.

[0060] Here, key data K₂ is different from key data K₁.

[0061] (4) Key Storage Unit 104

[0062] The key storage unit 104 receives key data K₁ and key data K₂ from the key input unit 103, and stores them.

[0063] (5) Control Unit 105

[0064] The control unit 105 exercises the following control when decrypting ciphertext data C₁.

[0065] The control unit 105 instructs the encryption/decryption unit 106 to read key data K₁ stored in the key storage unit 104. The control unit 105 also sets a flag held in a switch unit 220 in the encryption/decryption unit 106, to 1. After this, the control unit 105 divides ciphertext data C₁ stored in the data storage unit 102 into partial data in units of 128 bits, starting from the most significant bit. The control unit 105 sequentially outputs these 128-bit partial data to the encryption/decryption unit 106, in the order in which they were divided.

[0066] Meanwhile, the control unit 105 exercises the following control when encrypting plaintext data P.

[0067] The control unit 105 instructs the encryption/decryption unit 106 to read key data K₂ stored in the key storage unit 104. The control unit 105 also sets the flag held in the switch unit 220 in the encryption/decryption unit 106, to 0. After this, the control unit 105 divides plaintext data P stored in the data storage unit 102 into partial data in units of 128 bits, starting from the most significant bit. The control unit 105 sequentially outputs these 128-bit partial data to the encryption/decryption unit 106, in the order in which they were divided.

[0068] (6) Encryption/Decryption Unit 106

[0069] The encryption/decryption unit 106 receives key data K₁ and ciphertext data C₁ from the control unit 105, and decrypts ciphertext data C₁ into plaintext data P using key data K₁. Here, the encryption/decryption unit 106 performs decryption in units of 128 bits in the order in which the partial data of ciphertext data C₁ is output from the control unit 105. By repeating such 128-bit decryption, the encryption/decryption unit 106 obtains plaintext data P. The encryption/decryption unit 106 writes plaintext data P obtained in this way, into the data storage unit 102 through the control unit 105.

[0070] Also, the encryption/decryption unit 106 receives key data K₂ and plaintext data P from the control unit 105, and encrypts plaintext data P into ciphertext data C₂ using key data K₂. Here, the encryption/decryption unit 106 performs encryption in units of 128 bits in the order in which the partial data of plaintext data P is output from the control unit 105, as in the case of the above decryption. By repeating such 128-bit encryption, the encryption/decryption unit 106 obtains ciphertext data C₂. The encryption/decryption unit 106 outputs ciphertext data C₂ obtained as a result of this re-encryption, to the input/output unit 107.

[0071] The following describes the encryption/decryption unit 106 in greater detail.

[0072] (Construction of the Encryption/Decryption Unit 106)

[0073] FIG. 3 is a block diagram showing a construction of the encryption/decryption unit 106. As shown in the drawing, the encryption/decryption unit 106 includes a key control unit 201, a first data scramble unit 202, a round control unit 203, and a second data scramble unit 204.

[0074] The key control unit 201 receives 1280-bit key data K₁ from the key storage unit 104 through the control unit 105. The key control unit 201 divides 1280-bit key data K₁ into 128-bit partial keys K₁0, K₁1, . . . , K₁9, starting from the most significant bit. When 128-bit partial data of ciphertext data C₁ is first input in the first data scramble unit 202, the key control unit 201 outputs partial key K₁0 to the first data scramble unit 202. Subsequently, the key control unit 201 outputs a partial key in the order of K₁1, K₁2, . . . , K₁9, each time 128-bit partial data is input in the first data scramble unit 202.

[0075] In the same manner, the key control unit 201 receives 1280-bit key data K₂ from the key storage unit 104 through the control unit 105. The key control unit 201 divides 1280-bit key data K₂ into 128-bit partial keys K₂0, K₂1, . . . , K₂9, starting from the most significant bit. When 128-bit partial data of plaintext data P is first input in the first data scramble unit 202, the key control unit 201 outputs partial key K₂0 to the first data scramble unit 202. Subsequently, the key control unit 201 outputs a partial key in the order of K₂1, K₂2, . . . , K₂9, each time 128-bit partial data is input in the first data scramble unit 202.

[0076] The first data scramble unit 202 receives 128-bit partial data from the control unit 105. The first data scramble unit 202 also receives a 128-bit partial key from the key control unit 201. The first data scramble unit 202 performs a nonlinear transformation on the 128-bit partial data, and further performs a linear transformation on the nonlinearly-transformed partial data using the partial key. The first data scramble unit 202 outputs the resulting 128-bit partial data to the round control unit 203. This first data scramble unit 202 is explained in more detail later.

[0077] The round control unit 203 receives the 128-bit partial data from the first data scramble unit 202. The round control unit 203 keeps count of the number of times it has received 128-bit partial data from the first data scramble unit 202. When the count reaches ten, the round control unit 203 outputs the 128-bit partial data to the second data scramble unit 204 and resets the count. If the count is below ten, the round control unit 203 outputs the 128-bit partial data back to the first data scramble unit 202.

[0078] FIG. 4 shows a construction of the second data scramble unit 204. As illustrated, the second data scramble unit 204 includes data transformation units 210e, 210f, 210g, and 210h.

[0079] In the case of decryption, the second data scramble unit 204 receives 128-bit partial data from the round control unit 203, and divides it into four 32-bit data blocks starting from the most significant bit. The four 32-bit data blocks are input respectively to the data transformation units 210e-210h, in the order in which they were divided. Each of the data transformation units 210e-210h performs the nonlinear transformation on its input 32-bit data block. The four 32-bit data blocks output from the data transformation units 210e-210h as a result of this nonlinear transformation are connected to form 128-bit partial data, which is then output to the data storage unit 102 via the control unit 105.

[0080] In the case of encryption, likewise, the second data scramble unit 204 receives 128-bit partial data from the round control unit 203 and divides it into four 32-bit data blocks starting from the most significant bit. The four 32-bit data blocks are input respectively to the data transformation units 210e-210h, in the order in which they were divided. Each of the data transformation units 210e-210h performs the nonlinear transformation on its input 32-bit data block. Four 32-bit data blocks output from the data transformation units 210e-210h as a result of this nonlinear transformation are connected to form 128-bit partial data, which is then output to the input/output unit 107.

[0081] Although the second data scramble unit 204 is shown as an independent construction element in FIG. 3 for ease of explanation, actually the data transformation units 210e-210h of the second data scramble unit 204 share a circuit with data transformation units 210a-210d of the first data scramble unit 202 shown in FIG. 5. Each of these data transformation units is explained in detail later.

[0082] (Construction of the First Data Scramble Unit 202)

[0083] FIG. 5 is a block diagram showing a construction of the first data scramble unit 202. In the drawing, the first data scramble unit 202 includes the data transformation units 210a-210d, the switch unit 220, a first data diffusion unit 230, and a second data diffusion unit 240.

[0084] The first data scramble unit 202 receives 128-bit partial data from the control unit 105, and divides it into four 32-bit data blocks starting from the most significant bit. The four 32-bit data blocks are input respectively to the data transformation units 210a-210d, in the order in which they were divided.

[0085] Each of the data transformation units 210a-210d receives a 32-bit data block, performs the nonlinear transformation on the 32-bit data block, and outputs the result to the switch unit 220. Each data transformation unit is explained in more detail later.

[0086] The switch unit 220 receives four 32-bit data blocks from the data transformation units 210a-210d.

[0087] The switch unit 220 holds the flag that shows the output destination of the data blocks received from the data transformation units 210a-210d. This flag takes 0 or 1. If the flag is 0, the data blocks are output to the first data diffusion unit 230. If the flag is 1, the data blocks are output to the second data diffusion unit 240. The switch unit 220 is connected to the control unit 105, and switches the flag when instructed by the control unit 105.

[0088] Upon receiving the four 32-bit data blocks, the switch unit 220 refers to the flag held therein. If the flag is 0, the switch unit 220 outputs the data blocks to the first data diffusion unit 230. If the flag is 1, the switch unit 220 outputs the data blocks to the second data diffusion unit 240.

[0089] The first data diffusion unit 230 is used when encrypting plaintext data P into ciphertext data C₂. The first data diffusion unit 230 receives four 32-bit data blocks from the data transformation units 210a-210d via the switch unit 220. Also, the first data diffusion unit 230 is connected to the key control unit 201, and receives a partial key from the key control unit 201. The first data diffusion unit 230 performs a linear transformation on the four 32-bit data blocks using the partial key, and outputs the result to the round control unit 203.

[0090] The second data diffusion unit 240 is used when decrypting ciphertext data C₁ into plaintext data P. The second data diffusion unit 240 receives four 32-bit data blocks from the data transformation units 210a-210d via the switch unit 220. Also, the second data diffusion unit 240 is connected to the key control unit 201, and receives a partial key from the key control unit 201. The second data diffusion unit 240 performs a linear transformation on the four 32-bit data blocks using the partial key, and outputs the result to the round control unit 203.

[0091] The first data diffusion unit 230 and the second data diffusion unit 240 are explained in more detail later.

[0092] (Construction of the Data Transformation Unit 210a)

[0093] FIG. 6 shows a construction of the data transformation unit 210a.

[0094] In the drawing, the data transformation unit 210a includes data shuffle units 300a, 300b, and 300c. The transformation performed by the data transformation unit 210a is an involution. An involution refers to such an operation that recovers the original data when repeated twice. In other words, an involution is an operation that is equal to its own inverse.

[0095] A 32-bit data block input in the data transformation unit 210a is divided into the higher-order 16-bit data and the lower-order 16-bit data, and then input in the data shuffle unit 300a. The data shuffle unit 300a shuffles these two sets of 16-bit data and outputs them to the data shuffle unit 300b. The data shuffle unit 300b shuffles the two sets of 16-bit data and outputs them to the data shuffle unit 300c. The data shuffle unit 300c shuffles the two sets of 16-bit data and outputs them. The higher-order 16-bit data and the lower-order 16-bit data output from the data shuffle unit 300c are transposed (i.e. exchanged in position) and then connected to form a 32-bit data block. This 32-bit data block is the output data of the data transformation unit 210a.

[0096] The data transformation units 210b-210h have the same construction as the data transformation unit 210a, so that their explanation has been omitted here.

[0097] (Construction of the Data Shuffle Unit 300a)

[0098] FIG. 7 shows a construction of the data shuffle unit 300a.

[0099] In the drawing, the data shuffle unit 300a includes a data substitution unit 301 and a data combination unit 302. Here, the higher-order 16-bit data and the lower-order 16-bit data input in the data shuffle unit 300a are denoted respectively as first input data F0 and second input data F1. Also, the higher-order 16-bit data and the lower-order 16-bit data output from the data shuffle unit 300a are denoted respectively as first output data H0 and second output data H1. This being so, first input data F0 is input in the data combination unit 302, whilst second input data F1 is output as first output data H0 and at the same time is input in the data substitution unit 301.

[0100] The data substitution unit 301 performs data substitution on second input data F1 and outputs the outcome as 16-bit data G. 16-bit data G is input in the data combination unit 302.

[0101] The data combination unit 302 performs a bitwise exclusive-OR operation on 16-bit data G and first input data F0, and outputs the result as second output data H1.

[0102] The data shuffle units 300b and 300c have the same construction as the data shuffle unit 300a, so that their explanation has been omitted here.

[0103] (Construction of the Data Substitution Unit 301)

[0104] FIG. 8 shows a construction of the data substitution unit 301.

[0105] In the drawing, the data substitution unit 301 includes table substitution units 401a and 401b. Second input data F1 input in the data substitution unit 301 is divided into the higher-order 8-bit data and the lower-order 8-bit data. The higher-order 8-bit data and the lower-order 8-bit data are then input in the table substitution units 401a and 401b respectively.

[0106] Each of the table substitution units 401a and 401b has a substitution table in which different 8-bit data is stored in each of 256 locations. When 8-bit data is input, each of the table substitution units 401a and 401b reads 8-bit data stored in a location indicated by the input 8-bit data, and outputs the read 8-bit data. Note here that the table substitution units 401a and 401b have the same substitution table. A specific example of such a table is 2568-bit data described in S. Moriai et al. Constructing an S-box in Consideration of Security against Known Block Cipher Attacks Technical Report of the Proceeding of the Institute of Electronics, Information and Communication Engineers, ISEC98-13.

[0107] The data substitution unit 301 connects the 8-bit data output from the table substitution unit 401a and the 8-bit data output from the table substitution unit 401b, and outputs the result to the data combination unit 302 as 16-bit data G.

[0108] (Construction of the First Data Diffusion Unit 230)

[0109] FIG. 9 shows a construction of the first data diffusion unit 230 shown in FIG. 5. In the drawing, the first data diffusion unit 230 includes ten exclusive-OR units 501 to 510.

[0110] The first data diffusion unit 230 receives 32-bit data block I0 from the data transformation unit 210a through the switch unit 220. The first data diffusion unit 230 also receives 32-bit data block I1 from the data transformation unit 210b through the switch unit 220. The first data diffusion unit 230 also receives 32-bit data block 12 from the data transformation unit 210c through the switch unit 220. The first data diffusion unit 230 also receives 32-bit data block I3 from the data transformation unit 210d through the switch unit 220. Furthermore, the first data diffusion unit 230 receives a 128-bit partial key from the key control unit 201, and divides it into four sets of 32-bit key data starting from the most significant bit. Here, the four sets of 32-bit key data are denoted by K0, K1, K2, and K3 in the order in which they were divided.

[0111] The exclusive-OR unit 501 receives I0 and K0, and performs a bitwise exclusive-OR operation on I0 and K0. The exclusive-OR unit 501 outputs the result to the exclusive-OR units 505 and 509.

[0112] The exclusive-OR unit 502 receives I1 and K1, and performs a bitwise exclusive-OR operation on I1 and K1. The exclusive-OR unit 502 outputs the result to the exclusive-OR unit 505.

[0113] The exclusive-OR unit 503 receives I2 and K2, and performs a bitwise exclusive-OR operation on I2 and K2. The exclusive-OR unit 503 outputs the result to the exclusive-OR unit 506.

[0114] The exclusive-OR unit 504 receives I3 and K3, and performs a bitwise exclusive-OR operation on I3 and K3. The exclusive-OR unit 504 outputs the result to the exclusive-OR units 506 and 510.

[0115] The exclusive-OR unit 505 receives the calculation result of the exclusive-OR unit 501 and the calculation result of the exclusive-OR unit 502, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 505 outputs the result to the exclusive-OR units 507 and 508.

[0116] The exclusive-OR unit 506 receives the calculation result of the exclusive-OR unit 503 and the calculation result of the exclusive-OR unit 504, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 506 outputs the result to the exclusive-OR unit 507.

[0117] The exclusive-OR unit 507 receives the calculation result of the exclusive-OR unit 505 and the calculation result of the exclusive-OR unit 506, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 507 outputs the result to the exclusive-OR units 508 and 510, and at the same time outputs the result as output data J2.

[0118] The exclusive-OR unit 508 receives the calculation result of the exclusive-OR unit 505 and the calculation result of the exclusive-OR unit 507, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 508 outputs the result to the exclusive-OR unit 509, and at the same time outputs the result as output data J1.

[0119] The exclusive-OR unit 509 receives the calculation result of the exclusive-OR unit 501 and the calculation result of the exclusive-OR unit 508, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 509 outputs the result as output data J0.

[0120] The exclusive-OR unit 510 receives the calculation result of the exclusive-OR unit 504 and the calculation result of the exclusive-OR unit 507, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 510 outputs the result as output data J3.

[0121] In sum, output data J0, J1, J2, and J3 can be expressed as follows:

[0122] where () denotes a bitwise exclusive-OR operation.

[0123] The first data diffusion unit 230 performs the above processing, each time it receives four 32-bit data blocks from the data transformation units 210a-210d and a 128-bit partial key from the key control unit 201.

[0124] The first data scramble unit 202 connects J0, J1, J2, and J3 output from the first data diffusion unit 230 in this order, and outputs the resulting 128-bit partial data.

[0125] (Construction of the Second Data Diffusion Unit 240)

[0126] FIG. 10 shows a construction of the second data diffusion unit 240 shown in FIG. 5.

[0127] In the drawing, the second data diffusion unit 240 includes ten exclusive-OR units 601 to 610.

[0128] The second data diffusion unit 240 receives 32-bit data block L0 from the data transformation unit 210a through the switch unit 220. The second data diffusion unit 240 also receives 32-bit data block L1 from the data transformation unit 210b through the switch unit 220. The second data diffusion unit 240 also receives 32-bit data block L2 from the data transformation unit 210c through the switch unit 220. The second data diffusion unit 240 also receives 32-bit data block L3 from the data transformation unit 210d through the switch unit 220. Furthermore, the second data diffusion unit 240 receives a 128-bit partial key from the key control unit 201, and divides it into four sets of 32-bit key data starting from the most significant bit. Here, the four sets of 32-bit key data are denoted by K0, K1, K2, and K3 in the order in which they were divided.

[0129] The exclusive-OR unit 601 receives L0 and L1, and performs a bitwise exclusive-OR operation on L0 and L1. The exclusive-OR unit 601 outputs the result to the exclusive-OR units 605 and 610.

[0130] The exclusive-OR unit 602 receives L2 and L3, and performs a bitwise exclusive-OR operation on L2 and L3. The exclusive-OR unit 602 outputs the result to the exclusive-OR units 606 and 607.

[0131] The exclusive-OR unit 603 receives L1 and L2, and performs a bitwise exclusive-OR operation on L1 and L2. The exclusive-OR unit 603 outputs the result to the exclusive-OR units 604 and 605.

[0132] The exclusive-OR unit 604 receives L2 and the calculation result of the exclusive-OR unit 603, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 604 outputs the result to the exclusive-OR unit 606.

[0133] The exclusive-OR unit 605 receives the calculation result of the exclusive-OR unit 601 and the calculation result of the exclusive-OR unit 603, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 605 outputs the result to the exclusive-OR unit 609.

[0134] The exclusive-OR unit 606 receives the calculation result of the exclusive-OR unit 602 and the calculation result of the exclusive-OR unit 604, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 606 outputs the result to the exclusive-OR unit 608.

[0135] The exclusive-OR unit 607 receives K3 and the calculation result of the exclusive-OR unit 602, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 607 outputs the result as output data M3.

[0136] The exclusive-OR unit 608 receives K2 and the calculation result of the exclusive-OR unit 606, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 608 outputs the result as output data M2.

[0137] The exclusive-OR unit 609 receives K1 and the calculation result of the exclusive-OR unit 605, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 609 outputs the result as output data M1.

[0138] The exclusive-OR unit 610 receives K0 and the calculation result of the exclusive-OR unit 601, and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit 610 outputs the result as output data M0.

[0139] In sum, output data M0, M1, M2, and M3 can be expressed as follows:

[0140] where () denotes a bitwise exclusive-OR operation.

[0141] The second data diffusion unit 240 performs the above processing, each time it receives four 32-bit data blocks from the data transformation units 210a-210d and a 128-bit partial key from the key control unit 201.

[0142] The first data scramble unit 202 connects M0, M1, M2, and M3 output from the second data diffusion unit 240 in this order, and outputs the resulting 128-bit partial data.

[0143] (Relationship between Encryption and Decryption)

[0144] The following explains the relationship between encryption and decryption performed by the encryption/decryption unit 106.

[0145] The transformation performed by each of the data transformation units 210a-210d shown in FIG. 5 and the transformation performed by each of the data transformation units 210e-210h shown in FIG. 4 are the exact same transformation. This transformation is an involution.

[0146] Let

[0147] YF(X)

[0148] denote an operation of dividing 128-bit data X into 32-bit data blocks starting from the most significant bit, performing the above data transformation on each of these data blocks, and connecting the resulting data blocks as 128-bit data Y. Since the data transformation is an involution,

[0149] holds true.

[0150] Next, suppose the output of the first data diffusion unit 230 and the input of the second data diffusion unit 240 are equal to each other, and also the partial key used by the first data diffusion unit 230 and the partial key used by the second data diffusion unit 240 are equal to each other. Which is to say, suppose J0L0, J1L1, J2L2, J3L3 in Equations 1-8, with K0-K3 in Equations 1-4 being the same as K0-K3 in Equations 5-8. This being so, M0-M3 output from the second data diffusion unit 240 can be written as

[0151] Substituting Equations 1-4 into Equations 10-13 yields

[0152] M0I0

[0153] M1I1

[0154] M2I2

[0155] M3I3

[0156] This indicates that, given the same partial key, the second data diffusion unit 240 is the inverse of the first data diffusion unit 230.

[0157] Let

[0158] YG1(K,X)

[0159] denote an operation of dividing 128-bit data X into 32-bit data blocks starting from the most significant bit, inputting the data blocks into the first data diffusion unit 230 together with partial key K, and connecting the resulting data blocks as 128-bit data Y. Also, let

[0160] YG2(K,X)

[0161] denote an operation of dividing 128-bit data X into 32-bit data blocks starting from the most significant bit, inputting the data blocks into the second data diffusion unit 240 together with partial key K, and connecting the resulting data blocks as 128-bit data Y. This being so,

[0162] holds true, due to the inverse relationship between the first data diffusion unit 230 and the second data diffusion unit 240.

[0163] Based on the above, the relationship between encryption and decryption performed by the encryption/decryption unit 106 in the reception device 10 is explained below.

[0164] The encryption/decryption unit 106 computes 128-bit ciphertext C from 128-bit plaintext P, as follows.

[0165] On the other hand, the encryption/decryption unit 106 computes 128-bit decrypted text D from such computed ciphertext C, as follows. Here, the same key data K0-K9 are used in the encryption and the decryption.

[0166] Substituting Equation 19 Equation 20 yields

[0167] U0G2(K9,F(F(T9)))

[0168] This can be transformed into

[0169] U0G2(K9,T9)

[0170] according to Equation 9.

[0171] Next, substituting Equation 18 into this equation yields

[0172] U0G2(K9,G1(K9,F(T8)))

[0173] This can be transformed into

[0174] U0F(T8)

[0175] according to Equation 14.

[0176] Substituting this equation into Equation 21 yields

[0177] U1G2(K8,T8)

[0178] Repeating the same equation transformation will eventually result in

[0179] PD

[0180] This indicates that, given the same key, the decryption performed by the encryption/decryption unit 106 is the inverse of the encryption performed by the encryption/decryption unit 106.

[0181] (Decryption of Ciphertext Data C₂)

[0182] Accordingly, the encryption/decryption unit 106 can decrypt ciphertext data C₂, which it has generated by encrypting plaintext data P using key data K₂, into plaintext data P by performing the same operation as the above decryption of ciphertext data C₁ while using key data K₂ instead of key data K₁.

[0183] In more detail, the switch unit 220 in the encryption/decryption unit 106 sets the flag to 1, in accordance with an instruction from the control unit 105. Also, the input/output unit 107 reads ciphertext data C₂ from the recording medium 11 and outputs it to the encryption/decryption unit 106, in accordance with an instruction from the control unit 105. The control unit 105 reads key data K₂ from the key storage unit 104 and outputs it to the encryption/decryption unit 106.

[0184] The encryption/decryption unit 106 receives ciphertext data C₂ and key data K₂. In the same manner as the aforedescribed decryption of ciphertext data C₁ into plaintext data P, the encryption/decryption unit 106 subjects ciphertext data C₂ to the processing of the first data scramble unit 202 using key data K₂, and then subjects the outcome to the processing of the second data scramble unit 204. As a result, plaintext data P is obtained. Since the flag in the switch unit 220 is set at 1, the second data diffusion unit 240 is used in the first data scramble unit 202.

[0185] (7) Input/Output Unit 107

[0186] The input/output unit 107 is actually realized by a DVD-RAM drive unit. Here, the recording medium 11 is a DVD-RAM. The input/output unit 107 writes digital content onto the recording medium 11, or reads digital content from the recording medium 11.

[0187] 2. Operation of the Reception Device 10 (Overall Operation)

[0188] An operation of the reception device 10 is explained below, by referring to FIGS. 11 to 13.

[0189] FIG. 11 is a flowchart showing an overall operation of the reception device 10.

[0190] The reception unit 101 receives ciphertext data C₁ from the content delivery device 12, via the broadcast satellite 13 and the antenna 108 (S101). Here, ciphertext data C₁ has been generated by encrypting plaintext data P that is digital content. The reception unit 101 outputs ciphertext data C₁ to the data storage unit 102. The data storage unit 102 stores ciphertext data C₁ (S102).

[0191] The key input unit 103 receives an input of key data K₁ that is a decryption key for decrypting ciphertext data C₁ into plaintext data P. The key input unit 103 outputs key data K, to the key storage unit 104. The key storage unit 104 stores key data K₁ (S103).

[0192] The encryption/decryption unit 106 decrypts ciphertext data C₁ into plaintext data P, using key data K₁ (S104).

[0193] Following this, the key input unit 103 receives an input of key data K₂ that is an encryption key for re-encrypting plaintext data P, which has been decrypted by the encryption/decryption unit 106, into ciphertext data C₂. The key input unit 103 outputs key data K₂ to the key storage unit 104. The key storage unit 104 stores key data K₂ (S105).

[0194] The encryption/decryption unit 106 encrypts plaintext data P into ciphertext data C₂, using key data K₂ (S106).

[0195] The input/output unit 107 writes ciphertext data C₂ onto the recording medium 11 (S107).

[0196] (Decryption)

[0197] FIG. 12 is a flowchart showing the decryption performed in step S104 in FIG. 11. Since the encryption/decryption unit 106 performs decryption in units of 128 bits, the size of ciphertext data C₁ is assumed here to be 128 bits for ease of explanation.

[0198] The control unit 105 reads 128-bit ciphertext data C₁ from the data storage unit 102, and outputs it to the first data scramble unit 202 in the encryption/decryption unit 106 (S201). The control unit 105 also reads 1280-bit key data K₁ from the key storage unit 104, and outputs it to the key control unit 201 in the encryption/decryption unit 106. The key control unit 201 divides key data K₁ starting from the most significant bit, into ten 128-bit partial keys (S202). The key control unit 201 outputs the ten 128-bit partial keys one by one to the first data scramble unit 202, in the order in which they were divided. The first data scramble unit 202 processes 128-bit ciphertext data C₁ using a partial key (S203). The round control unit 203 in the encryption/decryption unit 106 judges whether the number of times the first data scramble unit 202 has performed the processing reaches ten (S204). If the number is below ten (S204:NO), the procedure returns to step S203 where 128-bit data output from the first data scramble unit 202 is input again in the first data scramble unit 202. If the number reaches ten (S204:YES), 128-bit data output from the first data scramble unit 202 is input in and processed by the second data scramble unit 204 (S205).

[0199] Though the operation of decrypting 128-bit ciphertext data C₁ is explained in this example, in reality the size of ciphertext data C₁ is likely to be more than 128 bits. In such a case, the above operation is repeated in units of 128 bits, until all of ciphertext data C₁ are decrypted.

[0200] (Encryption)

[0201] FIG. 13 is a flowchart showing the encryption performed in step S106 in FIG. 11. Since the encryption/decryption unit 106 performs encryption in units of 128 bits, the size of plaintext data P is assumed here to be 128 bits for ease of explanation.

[0202] The control unit 105 reads 128-bit plaintext data P from the data storage unit 102, and outputs it to the first data scramble unit 202 in the encryption/decryption unit 106 (S301). The control unit 105 also reads 1280-bit key data K₂ from the key storage unit 104, and outputs it to the key control unit 201 in the encryption/decryption unit 106. The key control unit 201 divides key data K₂ starting from the most significant bit, into ten 128-bit partial keys (S302). The key control unit 201 outputs the ten 128-bit partial keys one by one to the first data scramble unit 202, in the order in which they were divided. The first data scramble unit 202 processes 128-bit plaintext data P using a partial key (S303). The round control unit 203 in the encryption/decryption unit 106 judges whether the number of times the first data scramble unit 202 has performed the processing reaches ten (S304). If the number is below ten (S304:N0), the procedure returns to step S303 where 128-bit data output from the first data scramble unit 202 is input again in the first data scramble unit 202. If the number reaches ten (S304:YES), 128-bit data output from the first data scramble unit 202 is input in and processed by the second data scramble unit 204 (S305).

[0203] Though the operation of encrypting 128-bit plaintext data P is explained in this example, in reality the size of plaintext data P is likely to be more than 128 bits. In such a case, the above operation is repeated in units of 128 bits until all of plaintext data P are encrypted.

[0204] 3. Construction of the Content Delivery Device 12

[0205] The content delivery device 12 is actually realized by a digital broadcast device. The content delivery device 12 broadcasts encrypted digital content which is superimposed on a digital broadcast wave, via the broadcast satellite 13. The encrypted digital content referred to here is ciphertext data C₁ received by the reception device 10.

[0206] The content delivery device 12 has an encryption/decryption unit which is identical to the encryption/decryption unit 106 in the reception device 10. This being so, the content delivery device 12 encrypts plaintext data P into ciphertext data C₁ using 1280-bit key data K₁, and transmits ciphertext data C₁ to the reception device 10 through the broadcast satellite 13.

[0207] 4. Modifications

[0208] The present invention has been described by way of the above embodiment, though it should be obvious that the invention is not limited to the above. Example modifications are given below.

[0209] (1) The above embodiment describes the case where digital content is transmitted by satellite digital broadcasting, but the invention is not limited to such. The digital content may equally be transmitted through the Internet, a mobile phone network, a cable television network, a terrestrial digital broadcast network, or a recording medium such as a DVD.

[0210] (2) Examples of digital content described in the above embodiment include digitized movie films, music, still images, moving images, software games, computer programs, and other various data.

[0211] (3) The above embodiment describes the case where each data transformation unit has the construction shown in FIGS. 6, 7, and 8, but this is not a limit for the invention. Each data transformation unit may have another construction so long as it performs an involution.

[0212] (4) The above embodiment describes the case where the first data diffusion unit 230 and the second data diffusion unit 240 have the constructions shown in FIGS. 9 and 10 respectively, but this is not a limit for the invention. The first data diffusion unit 230 and the second data diffusion unit 240 may have other constructions so long as they have an inverse relationship.

[0213] (5) In the above embodiment, plaintext data P, ciphertext data C₁, and ciphertext data C₂ may have any data size.

[0214] The encryption/decryption unit 106 performs encryption and decryption in units of 128 bits. Accordingly, in each of the decryption of ciphertext data C₁ into plaintext data P, the encryption of plaintext data P into ciphertext data C₂, and the decryption of ciphertext data C₂ into plaintext data P, the control unit 105 controls the encryption/decryption unit 106 to repeat processing in units of 128 bits until the whole data is processed.

[0215] (6) The above embodiment describes the case where key data K₁ and key data K₂ are each 1280 bits long, but this may be modified in such a way as to generate 1280-bit data from key data smaller than 1280 bits using a random number generator.

[0216] (7) The above embodiment describes the case where the data transformation units, the first data diffusion unit 230, and the second data diffusion unit 240 each perform processing in units of 32 bits, but the processing data size should not be limited to such. One specific example of this is explained below, with reference to FIGS. 14 and 15.

[0217] FIG. 14 shows a data shuffle unit 350. This data shuffle unit 350 includes a data substitution unit 311 and a data combination unit 312, like the data shuffle unit 300a. However, the data shuffle unit 350 differs from the data shuffle unit 300a in that data is processed in units of 64 bits.

[0218] 64-bit data input in the data shuffle unit 350 is divided into the higher-order 32-bit data and the lower-order 32-bit data. The higher-order 32-bit data is input in the data combination unit 312, whilst the lower-order 32-bit data is input in the data substitution unit 311 and at the same time is output as the higher-order 32 bits of the output data of the data shuffle unit 350. The data substitution unit 311 includes table substitution units 501a and 501b, as shown in FIG. 15. The higher-order 16 bits of the 32-bit data are input in the table substitution unit 501a, whereas the lower-order 16 bits are input in the table substitution unit 501b. The table substitution units 501a and 501b each perform data substitution using a substitution table. Resulting 32-bit data output from the data substitution unit 311 is then input in the data combination unit 312. The data combination unit 312 performs a bitwise exclusive-OR operation on the higher-order 32-bit data and the 32-bit data output from the data substitution unit 311, and outputs the result as the lower-order 32 bits of the output data of the data shuffle unit 350.

[0219] According to this construction, the invention can be applied to a machine equipped with a 64-bit CPU.

[0220] (8) In the above embodiment, the operation of each data transformation unit in the first data scramble unit 202 may be repeated a plurality of times. Also, the operation of the first data diffusion unit 230 or second data diffusion unit 240 in the first data scramble unit 202 may be repeated a plurality of times.

[0221] (9) The invention also applies to the method described above. This method may be realized by a computer program that is executed by a computer. Such a computer program may be distributed as a digital signal.

[0222] The invention may also be realized by a computer-readable storage medium, such as a floppy disk, a hard disk, a CD-ROM (Compact Disc-Read Only Memory), an MO (Magneto-Optical) disc, a DVD (Digital Versatile Disc), a DVD-ROM, a DVD-RAM, or a semiconductor memory, on which the computer program or digital signal mentioned above is recorded. Conversely, the invention may also be realized by the computer program or digital signal that is recorded on such a storage medium.

[0223] The computer program or digital signal that achieves the invention may also be transmitted via a network, such as an electronic communications network, a wired or wireless communications network, or the Internet.

[0224] The invention can also be realized by a computer system that includes a microprocessor and a memory. In this case, the computer program can be stored in the memory, with the microprocessor operating in accordance with this computer program.

[0225] The computer program or digital signal may be provided to an independent computer system by distributing a storage medium on which the computer program or digital signal is recorded, or by transmitting the computer program or digital signal via a network. The independent computer system may then execute the computer program or digital signal to function as the invention.

[0226] (10) The limitations described in the embodiment and the modifications may be freely combined.

[0227] Although the present invention has been fully described by way of examples with reference to the accompanying drawings, it is to be noted that various changes and modifications will be apparent to those skilled in the art.

[0228] Therefore, unless such changes and modifications depart from the scope of the present invention, they should be construed as being included therein.