Integrated Circuit Devices for Secure Data Encryption

1. Field of the Invention

The present invention relates to a technique for placing a digital word or private key into an integrated circuit in a manner where it cannot be later read or modified from outside the integrated circuit in order to provide a secure communication system.

2. Description of the Prior Art

The security of data communications has been increasingly important especially where sensitive information is to be transmitted to one or more remote locations over shared lines or channels. Typical of such sensitive information are files, programs and business information of a corporation or possible government communications.

A microcomputer cipher apparatus for secure transmission is disclosed in U.S. Pat. No. 4,249,180 issued to G. Eberle et al on Feb. 3, 1981. The disclosed apparatus includes a microcomputer that controls a cipher process by which sensitive data is encrypted before transmission. As shown in FIG. 6 of the patent and described in the specification, two basic levels of cipher keys are provided by and are stored in a cipher apparatus. As shown in FIG. 6 of Eberle et al, the cipher keys are stored in programmable read only memories (PROMs), and an operator can enter a new key at any time by using an "Enter Key".

Secure encryption for communication is also now available on a single VLSI device as shown on the Motorola Semiconductor Data Sheet for the MC6859 Data Security Device. The MC6859 Data Security Device is a monolithic MOS integrated circuit for use in equipment requiring protection of data. The cryptographic algorithm used by this device is the Data Encryption Standard (DES) as adopted by the U.S. Department of Commerce, National Bureau of Standards. With this device the key is placed into the device when a transmission is to be made. The use of a secondary key is also possible for increased security and the secondary key is transmitted to the remote location in encrypted form.

For these devices, the private key is externally applied. This implies that the key is stored in a ROM or set of switches and is accessible to anyone who can examine the security hardware. The problem remaining in the prior art is to provide a data encryption device or integrated circuit which once the key is entered cannot be read or modified from outside the device or integrated circuit to provide a secure communication system.

The foregoing problem has been solved in accordance with the present invention which relates to a technique for placing a digital word or private key into an integrated circuit in a manner where it cannot be later read or modified.

It is an aspect of the present invention to provide a technique for placing digital words or a private key into a register in an integrated circuit so that it cannot be later read or modified. More particularly, a special key register is provided in the form of an externally programmable read-only-memory which is programmable from external to the integrated circuit. The programmable register contains an extra bit, which is not part of the private key, to enable the program line through a gating means for burning in the private key. A code in the extra bit disables the gating means thereafter once the key is burned into memory to prevent subsequent access.

Other and further aspects of the present invention will become apparent during the course of the following description and by reference to the accompanying drawings.

The FIGURE illustrates a VLSI device including an Externally Programmable Read Only Memory key register which provides secure communication in a secure communication system in accordance with the present invention.

In accordance with the present invention, a secure communication system is provided by making a private key, for gaining access to the communication system, inaccessible upon examination of the transmitter or receiver. More particularly, in the FIGURE, secure encryption for communication is achieved on, for example, a Very Large Scale Integrated (VLSI) device 10 by the use of a special key register 11 associated with an AND gate 12 which can be located on the same substrate 10 as an encryption device 13. In the preferred embodiment, key register 11 is an externally programmable read-only-memory (PROM) which is programmable from outside the VLSI device 10.

Programmable register 11 provides storage for M+N bits of information, with storage locations 1 to M being shown for use in storing the M-bit code for the private key to permit access to the secure communication system and storage location N comprising an extra storage location which is not part of the private key where N=1 in the FIGURE. The N-bit code is used to enable the program line initially through gate 12. In operation, PROM register 11 starts with an erase state of a binary "1" for each bit in each storage location. The binary "1" in storage location N of register 11 enables the program line through gate 12. The M bits of the private key are then permanently entered or burned into the appropriate storage locations 1 to M of register 11 over leads 14 after which the extra bit (the N storage location of register 11) is programmed to a binary "0" via lead 15. Once bit N is changed to a binary "0", the program line is disabled through gate 12 and the PROM key register 11 can no longer be read or modified from outside the device 10. In this manner the private key can only be read by the encryption device 13 over leads 16 to provide access to the secure communication system. This private key in register 11 is then used by encryption device 13 to permit a user transmitting such private key to the encryption device to transmit or receive data over a secure communication system.

It is to be understood that the above-described embodiments are simply illustrative of the principles of the invention. Various other modifications and changes may be made by those skilled in the art which will embody the principles of the invention and fall within the spirit and scope thereof. For example, it is to be understood that with the key register 11 and the AND gate 12 being formed on a VLSI device or other integrated circuit, the leads to and from register 11 and gate 12, along with the register and gate, could be encapsulated or made generally inaccessible from outside the device without some form of destruction to prevent access to the key. It is to be further understood that when the device of the FIGURE is used at the transmitting end of the secure communication system, device 13 will be an ecryption device which takes the data input from a user and performs the proper encryption process thereon before transmitting the encrypted data over the system. When device 13 is at the receiver of the secure communication system, the device 13 will generally be an appropriate decoder for converting the received encrypted data from the transmitter into the proper data output signal. Such encryption or decoding will only be performed if the proper M-bit private key word is also provided by the user which is the same as that stored in register 11. It is also to be recognized that the present register 11 and gating means 12 can also be used for purposes other than a secure communication system access and that the N-bit enable code word could comprise more than one bit which is connected to a gating means 12 in a predetermined manner to achieve the same function.