CN1161997C - Security device and method for capturing data transmitted between two sources - Google Patents

Abstract

A security data capture device, preferably implemented in a video camera, is used to protect captured data clips from undetected tampering. The security data capture device performs "time sort" and/or "sequence order" operations to maintain data integrity by two registers that store a "star state" ("SOTU") number and a serial number, respectively. The time classification is done by digitally signing the running hash value representing the folder appended to the SOTU number before the digital signature is "time stamped". The sequence alignment is done by digitally marking the digest of the data frame or frames along the sequence number.

Description

Security device and method for capturing data transmitted between two sources

Background of the invention

The present invention relates to devices and methods for data security. More specifically, the present invention relates to a semiconductor device that prevents data captured by a capture device from being unknowingly altered and that provides a mechanism for maintaining data integrity.

technical field

As personal computers ("PCs"), networks, and other devices that support the transfer of digital data become more common, the importance of data security increases dramatically. For data security to be highly reliable, it must be ensured that the data transmitted between two sources is "authentic". One limited technique for protecting data integrity is through access control (ie, user identification and authorization). Now, current efforts are using an access control technique called "biometrics," which uses capture devices that are basically used for equipment security (eg, buildings, rooms, etc.). Biometrics techniques typically involve digitally scanning a characteristic of a user (e.g., fingerprint, iris, retina, etc.) to capture at least one or more similar multiple frames of data (commonly referred to as "data clips") of that characteristic , and compare the captured folder with the previously stored copy. If certain characteristics of the capture folder match those of the stored master, the user is identified and authorized.

In recent years, electronic technology has become so sophisticated that changes to digitally captured folders, as evidenced by certain specialized effects in current feature films, have become more difficult to detect. As a result, security systems utilizing biometrics (hereafter referred to individually as "biosystems") are now considered subject to tampering with captured data clips if the biometric system is not physically connected to the system or component processing or storage Capture folder words. The reason for this is that the communication channel will most likely be open to the public, giving the hacker the opportunity to (i) replace an originally recorded folder with a captured folder, (ii) transmit it in real time from another location or (iii) ) combined with other images or features that do not exist.

In an effort to protect data integrity, a technology called "time stamping" has recently been developed and made commercially available by Surety Technologies of Chatham, New York. As shown in FIG. 1, data is processed by the user through a cryptographically secure hash algorithm 120 (e.g., the "MD5" algorithm developed by RSA Data Security, Inc. of Redwood, California) stored at a local source 100. An example of time-stamping is done by groups 110 (ie, data streams). This results in the digital data assembly 110 being mapped from any size thereof to a significantly smaller, fixed size, often referred to as a "digest" 130 with no information content.

Typically, a digest 130 is transmitted (preferably electronically) to a central source 150 represented by dashed line 140 and is thereafter hashed and linked with some other digest 160 from a different source in a "binary tree" fashion as shown Combining, therefore, produces a number of "intermediate digests" 170 , resulting in a composite digest 180 . Next, the synthesized abstract 180 is widely published (e.g., printed in a publication, distributed to all sources, stored in a trusted database, etc.), to establish that the data set 110 has been exists. However, there is currently no mechanism for "time-bracketing" abstracts 130 to ensure that data sets 110 exist after a certain point in time before publication. Timed classification of captured folders is useful to prevent spoofing of previously captured folders. Also, there is no mechanism for fixing the data frames of the "ordered" folder to prevent the order of the data frames from being altered in order of occurrence to achieve some sequence of events that occur.

Contents of the invention

Based on the above description, it is apparent that there is a need to employ a secure data capture device in the capture device which prevents the captured data folder from being altered without detection. In addition, to further protect the integrity of the data folder, the security data capture device preferably includes a "time classification" mechanism that calculates and establishes the time period during which a data folder must be captured by the capture device, and optionally includes a "sequencing" mechanism , which ensures the order in which multiple dataframes appear in the folder.

A semiconductor device according to the present invention, comprising

a sensing device for capturing data folders; and

An encryption device, connected to the sensing device, for protecting the integrity of the data folder, the encryption device comprising:

storage means for storing the unique key pair, the run-length hash value, and the state value,

processor means for performing an operation on said data folder to establish that the data folder was captured after said state value was disclosed and before said run hash value was time-stamped, and

bus means for communicating said processor means and said memory means, said bus means being connected to said processor means and said memory means.

A semiconductor device according to the present invention includes:

Sensing devices for capturing data folders; and

an encryption circuit connected to said sensing device, said encryption circuit comprising:

a plurality of storage locations that can contain a state value and a run-length hash value that is the result of hashing the data folder combined with the state value at the time the sensor is used to capture the data Before clamping, loading the state value into one of the plurality of storage units,

a processor capable of (i) performing operations on said data folder to generate said hash value, (ii) digitally marking said run-length hash value and (iii) outputting said run-length hash value for use in for time-stamping operations, and

A bus is connected to the plurality of memory units and the processor, the bus communicating the processor with the plurality of memory units.

A method of maintaining the integrity of a data folder transmitted from a first source to a second source according to the present invention, the method comprising the steps of:

load a state value into a system state (SOTU) memory unit;

capture the first data frame of the folder;

generating a first consecutive frame of data by hashing at least said first frame of data;

adding said first consecutive data frame to a run-length hash value;

adding the state value to the run hash value;

digitally sign the run hash value; and

A time-stamping operation is performed on the run hash value.

A semiconductor device according to the present invention includes:

a sensor to capture data clips; and

an encryption circuit connected to the sensor, said encryption circuit comprising:

multiple storage locations, which can contain a run-length hash value and a state value loaded prior to capturing the folder,

a processor coupled to said plurality of storage units, said processor capable of performing operations on said data folder to establish that said data folder is after the state value is disclosed and after said run hash value is retrieved from the encryption circuit Output was previously captured.

A kind of encryption circuit according to the present invention comprises:

memory locations containing a run-length hash value and a state value prior to capturing a folder load; and

a processor coupled to the plurality of storage units, the processor performing an operation on the data folder to establish that the data folder was captured after the state value was disclosed and before information including a run hash value was disclosed of.

A method for maintaining the integrity of transmitted data according to the present invention, said method comprising the steps of:

get a state value from a remote source;

Capture the first data frame;

generating a hash result of the first data frame;

generate a run-length hash value based on the hash result and a state value; and

A time-stamping operation is performed on the run hash value.

Description of drawings

The features and advantages of the present invention will become more apparent from the following detailed description of the present invention.

Figure 1 is a flowchart of a conventional time stamp for generating a synthesized abstract.

Figure 2 is a block diagram of an embodiment of a computer system operating in combination with a capture device employed in a security data capture device.

Fig. 3 is a block diagram of the encryption operation performed by the security data capture device.

Figure 4 is a block diagram of one embodiment of a security data capture device.

Figure 5 is a flow chart showing those process steps performed by the secure data capture device in a timed and sequential order to protect the integrity of the captured data folder.

Figure 6 is a timing flow diagram showing how data folders are timed between two points in time.

Detailed ways

The present invention relates to a security data capture device, preferably employed in a capture device, and a corresponding method of operation thereof. In the following description, certain terms are used to discuss certain well-known cryptographic functions. For example, data folders are information digitized into binary data required to display video, audio, and text. The information includes at least one data frame. "Keys" are encoding and/or decoding parameters used by conventional encryption algorithms; namely: public key encryption algorithms such as Rivest, Shamir and Adleman ("RSA"), symmetric key encryption algorithms such as Data Encryption Standard ("DES") ), the Data Encryption Algorithm ("DEA"), etc. A "certificate" is defined as any digital information (typically a public key) associated with an entity, encrypted with a private key issued by another entity such as a manufacturer or a widely publicized trusted authority (eg: owned by banks, government departments, trade associations, etc.). A "digital signature" is similar to a certificate, but authenticates data, not its sender.

Referring now to FIG. 2 , there is shown an illustrative embodiment of a capture device 215 employing the present invention and operating in association with computer system 200 . The computer system 200 includes a display monitor 205 having a PC platform with built-in memory, processing hardware, and the like. A capture device 215 (such as a video camera, digital camera, etc.) is separate from the display monitor 205 and can be placed within the housing of the display monitor 205, or it can be mounted on the display monitor 205 as shown . When capture device 215 captures a folder of desired data (eg, physical characteristics of computer user 220 ), it transmits the captured data to the PC platform via communication line 225 . Communication line 225 may be depicted as an electrical or fiber optic cable, a wireless communication link or the like.

Since the communication line 225 is publicly accessible, which threatens the integrity of the captured data folder, a secure data capture device 230 is employed in the capture device 215 . The security data capture device 230 captures the data folder, and securely transmits the captured data folder to the PC platform 210 by digitally marking each captured data frame or the entire data folder according to the method adopted by the implementing entity.

However, it is contemplated that there are other embodiments of capture devices that employ security data capture devices. For example, a capture device may include internal storage capabilities. In that case, the security data capture device 230 marks the data folder prior to storage without requiring the communication line 225 to establish an electrical connection with the computer system. Of course, it is contemplated that the capture device could be an audio recording device, similar to the security data capture device of Figure 4 (below), which digitizes audio clips of digital signatures rather than visual images as described below. The spirit and scope of the present invention remains in the implementation of a secure data capture device in a first source remote from a second source, in an effort to protect the integrity of data transmissions between the two.

As noted above, digital signatures are used in the embodiments described above to protect the integrity of folder contents transferred from the capture device and to verify the identity of the computer user without unnecessarily modifying the folder. As shown in FIG. 3 , numbers 310 are generated from data folder 315, obtained by first source 300 (e.g., capture device 215 of FIG. 2 ), optionally combined with additional information 335 as shown, obtained by A cryptographically secure hash algorithm 320 performs an arithmetic "hashing" operation. This allows data folder 315 to be mapped from its arbitrary size (typical size) to a significantly smaller size, commonly referred to as a "digest" 330 . Reverse engineering of Digest 330 in time mode is practically impossible. Accordingly, the digest 330 is encrypted with the private key “PRK1” 340 of the security data capture device 230 . The number 310 is accompanied by encrypted data 325 which may be encrypted by RSA using a public key ("PUK2") 355 of a second source 350 or by a recognized symmetric key using DES, although encryption is not required because it is transmitted to a second source 350 (eg PC platform, memory or any other device that can receive data).

If necessary, the second source 350 decrypts the data 325 using its private key "PRK2" 360 (or a recognized DES key) and hashes the received data, preferably with additional information 335, This operation is the same as the hashing operation performed in the first source 300 to generate the second digest 370 . At the same time, the second source 350 also uses the public key “PUK1” 345 of the security data capture device to decrypt the digital signature 310 to obtain a digest of the digital signature 310 . "PUK1" 345 may be provided by the first source by transmitting a certificate, such as a manufacturer's certificate, which is well known in the art. Digests 330 and 370 are compared, and if they are identical, integrity of the data and authorization of the sender are ensured.

Referring to FIG. 4, one embodiment of a security data capture device 230 is shown. Security data capture device 230 includes data capture circuitry 235 and encryption circuitry 240, both preferably integrated into a single integrated circuit package to reduce vulnerability to physical tampering. The data capture circuit 235 is a conventional sensor such as a Charge Coupled Device "CCD" (the standard sensor used in camcorders), a DRAM based video sensor developed by VLSI Vision Ltd of Edinburgh, Scotland, or any other similar technology . In general, video capture circuitry 235 includes pixel capture array 400 and control logic 405 for controlling pixel capture array 400 .

The encryption circuit 240 includes a processing unit 410, which is connected by an internal bus 435 to a non-volatile memory 415 (e.g., EPROM, Flash EPROM VROM EEPROM, etc., a clip sequence (“CS”) storage unit 420, a frame sequence (“FS”) ) storage unit 421, a state of the galaxy ("SOTU") storage unit 425, and optionally, a random number generator 430, the encryption circuit is preferably formed on the same silicon chip as the data capture circuit 235. The processing circuit 410 includes hardware 411 (for example: flash memory, read-only memory "ROM", random access memory "RAM", etc.) is used to perform the RSA algorithm on the information of the digital sign and complete the hash operation, and store the run-length hash value (later description). Optionally, encryption acceleration hardware 412 may be used in the processing unit 410, as shown by the dotted line.

Non-volatile memory 415 also stores unique public/private key pairs 340 and 345 associated with security data capture device 230 and manufacturer certificate 440 for authorization purposes. The internal storage of this unique public/private key pair 340 and 345 allows the captured data folder to be encrypted and/or secured in security prior to transmission from the processing unit 410 to another processor or storage device located remotely at a second source. Digital signage is performed within the data capture device 230 . In addition, the unique public/private key pair 240, 245 and manufacturer's certificate 440 allow the remote system (e.g. PC platform) to uniquely identify the capture device, grant it a candidate/response protocol, and establish a symmetric "Conversation" keys to support "symmetric key encryption" to reduce latency for encrypting and decrypting data. As a result, it is not possible to eavesdrop on the communication channels between these sources and replace previously recorded clips or alter captured data clips without being detected by a second source.

Preferably, the CS storage unit 420 and the FS storage unit 421 are 32-bit registers which collectively store a 64-bit sequence number which increments after each capture of a data frame. Thus, the 64-bit sequence number is unique for the lifetime of each data frame captured by the security data capture device 230 . Ideally, each time the serial number is incremented, it is permanently stored and restored in the event of a power loss. However, this requires exceptionally high speed (eg: 60 times/sec for video capture) to store the serial number.

To avoid high storage rates, the sequence number is stored in two parts. More specifically, the “most significant” part of the serial number is stored in the CS storage unit 420 , while the “unimportant” part of the serial number is stored in the FS storage unit 421 . As a result, FS storage location 421 is incremented after each data frame capture; however, CS register 420 is only incremented when the following conditions occur:

(1) When the FS storage unit is fully loaded (that is, the FS storage unit rolls from "FFFFFFFF" to "0000000"); or

(2) When the security data capture device is powered on.

With this structure, the FS storage unit 421 can be located in volatile memory, while the CS storage unit 420 is located in non-volatile memory. The serial number increments sequentially (never repeating) while power is maintained, and the required state of the serial number is only "logical" after every 232 consecutive captures until the security data capture device is powered down.

If the security data capture device is powered down, the value stored in FS storage unit 421 (i.e., the "frame sequence") is lost, but the value stored in CS storage unit 420 (i.e., the "clip sequence") is incremented on the next power-up, The result is a new setting of unique serial numbers for newly captured folders. Therefore, even if some frame sequence numbers are reused, the uniqueness of each data frame of the folder is ensured.

Preferably, SOTU storage unit 425 is capable of storing 288 data bits representing a large number. The SOTU storage unit 425 is loaded with status information status values from outside the security data capture device (eg, from an associated PC system) at system control, and can be reloaded at any time prior to capturing a data folder, depending on the status information. The status information is generated at a particular location on time in such a way that any time prior to that location is unforeseeable. For example, the state information may be a composite digest, which is the hash value of potentially millions of data sets, virtually unpredictable until the moment it is made public by the time-stamping service provider. The SOTU storage unit 425 may or may not be cleared upon power down.

Random Number Generation Generator 430 is used to generate unique public and private keys as in pending application entitled "Apparatus and Method for Providing Secure Communications" (Application Serial No. 08/251486) by the present invention Co-inventor Derek L. Davis proposed. Its use is preferably contingent on whether the encryption function is required, but is optional (as indicated by the dashed lines).

Reference is now made to FIG. 5, which illustrates the operational steps performed by the security data capture device in transmitting security data to a second source. The SOTU storage unit contains previously loaded state information ("state value") from outside the device, which cannot be changed once the steps described in FIG. 5 have started. In other words, Figure 5 represents an "atomic" process during which the contents of the SOTU memory unit cannot be modified.

The "run hash" value stored internally at step 505 is initialized to zero before capturing the folder. A run-length hash is a continuously updated hash value stored in the computer prior to transmission time classification. At step 510, the data frame of the folder is captured by the device's sensor (eg, CCD pixel sensor array), and at step 515 the sequence number is incremented by one. If a frame sequence is desired (step 520 ), then a sequence number is associated with the data frame to generate a sequence of data frames at step 525 . Thereafter, the data frame or serialized data frame is hashed to synthesize a run-length hash value (step 530). In the case of a single frame capture (as opposed to clips), the run hash value will only represent the hash value of the data frame or the serialized data clip since no data frame was previously included in the run hash value.

Next, the data frame or serialized data can be transmitted to a second source or stored externally (step 535). Additionally, data frames or serialized folders may optionally be encrypted (for privacy purposes) prior to such transmission or storage. If the folder is captured, where no flags are required for each individual data frame, and more frames are captured as part of the folder, then the process captures other data frames associated with the folder (step 540). If no more frames are included in the folder, or the folder is the only data frame, then the process proceeds to step 545 .

At step 545, a determination is made as to whether the folder reuses the state value contained in the SOTU storage unit for time sorting. If so, the state value is included in the run-length hash value (eg, combined in a manner including by appending, concatenation, and any other bit manipulation) at step 550 . At step 555, the run-length hash value is digitally signed using the capture device's private key. Finally, at step 560, the state value, optionally the run-length hash value if time sorted, and the signature are transmitted or stored in the second source. This data folder, serial number, state value and digital signature can then be analyzed in a second source to determine validity, as shown in Figure 3.

It should be appreciated that this temporal classification technique cannot be used effectively when the operations that capture the folder and the digital identification of the folder are not atomic (ie, the operations are independent). The reason is that if the data folder is available to software or other inherently insecure data processing systems, there is no way to ensure that the data folder is not generated on time at an earlier location and then inserted with status values and/or serial numbers before the digital signature is executed. This notable feature is that the contents of the SOTU storage unit are established prior to folder capture. The SOTU storage unit cannot be loaded between steps 515 and 540 (by device design).

Referring to FIG. 6 , an exemplary timeline of time-series events providing a temporal classification of capture folders is shown. The first timeline 600 includes a period "Tx" which represents periodic public dates that occur every second, minute, hour, day, week, or any specified period of time. The indices "n" and "m" denote integers where "Tn" appears before "Tn+m". A second timeline 610 represents the required sequential operational steps ("Ot", 1≤t≥9) performed by a capture device, more specifically a security data capture device, in order to "time classify" information. These operational steps are independent of the publication date mentioned above and they are used simply for illustration purposes. First, after "Tn", a state value is loaded into a SOTU storage unit, such as a published compound abstract or a hash of the electronic version of a newspaper's front page. It is impossible to predict the value of any of these numbers prior to their publication.

Therefore, the capture of the data frame of the first folder starts at O ₂ , but once started, the SOTU memory unit may not be loaded until the current operation ends. After the first frame of data is captured, a decision is made whether a sequence of frames is required. If yes, the first serial number is associated with the first data frame to produce the first serialized data frame, as indicated by _O3 . In case the frame sequence is not required, the first serialized data frame or first data frame is hashed and stored in a run-length hashing step ₀₄ . This process continues (shown _{as 05-07} ) for the second data frame of the data folder, as well as forming any subsequent data frames of the data folder.

For O ₈ , after all related operations are completed, the status value of the SOTU storage unit is associated with the folder to generate the expected folder. And the state value is included in the hash value of the run length that is digitized. Once marked, the SOTU location can be loaded in preparation for capturing the next folder. However, it should be understood that the run-length hash value and its digital signature must be sent to the time stamp provider service to perform the time classification operation on the _O9 .

By designing hardware such as SOTU storage units that cannot be loaded for previously captured data folders, it is ensured that any data folder marked with a particular state value must be retrieved by the device after that state value is disclosed (labeled as time point "Tn" in FIG. 6 ). capture. By sending the run-length hash value to the time-stamping service provider, it is ensured that the folder must be captured on time before this point (labeled time point "Tn+m" in FIG. 6). Thus, captured data folders are "categorized" between time points Tn and Tn+m.

While various embodiments of the invention have been described, it will be apparent to those skilled in the art that other embodiments of the invention can be practiced without departing from the spirit and scope of the invention. Also, well-known circuits and operating procedures have not been described in detail in order not to unnecessarily limit the invention. The scope of the invention should therefore be determined by the appended claims.

Claims (36)

1. security personnel that catch data that are used for transmitting between two sources semiconductor device is used to comprise

Sensing device is used to catch data folder; With

Encryption device is connected to described sensing device, is used to protect the integrality of described data folder,

It is characterized in that,

Described encryption device comprises:

Storage device is used to store unique key to, distance of swimming hashed value and state value,

Processor device is used for described data folder executable operations, with establish this data folder be described state value openly after and described distance of swimming hashed value is being carried out time mark operation before be hunted down and

Bus unit makes described processor device and described storage communication, and described bus unit is connected to described processor device and described storage device.

2. according to the described semiconductor device of claim 1, it is characterized in that the described storage device of described encryption device is further stored a sequence number at least, for each Frame of described data folder, it is unique.

3. according to the described semiconductor device of claim 2, it is characterized in that the described storage device of described encryption device comprises a Nonvolatile memery unit.

4. according to the described semiconductor device of claim 3, it is characterized in that the described storage device of described encryption device also comprises a volatile memory-elements.

5. according to the described semiconductor device of claim 4, it is characterized in that, the described storage device of described encryption device also comprises a folder sequence memory cell, and described folder sequence memory cell is a nonvolatile memory, and it is included as the folder sequence number of more than first bit of described sequence number.

6. according to the described semiconductor device of claim 5, it is characterized in that, the described storage device of described encryption device also comprises a frame sequence memory cell, and described frame sequence memory cell is a volatile memory, and it is included as the number of frames of more than second bit of described sequence number.

7. according to the described semiconductor device of claim 6, it is characterized in that the described storage device of described encryption device also comprises a state storage unit, it is included in described sensing device and catches the described state value that loads before the described data folder.

8. according to the described semiconductor device of claim 1, it is characterized in that described sensing device is the transducer that comprises the pixel capture array and be used to control the control logic of described pixel capture array.

9. according to the described semiconductor device of claim 1, it is characterized in that, before described data folder was stored in the described storage device, described processing unit was carried out Hash operation to described data folder and is made it to become described distance of swimming hashed value, and described distance of swimming hashed value is the hashed value of a continuous updating.

10. according to the described semiconductor device of claim 9, it is characterized in that, described processor device produces the hash result to each Frame of described data folder, and wherein each hash result sequentially is stored in the described storage device, jointly to produce described distance of swimming hashed value.

11. according to the described semiconductor device of claim 10, it is characterized in that, described processor device links described distance of swimming hashed value and described state value, to produce the distance of swimming hashed value of a renewal, and the distance of swimming hashed value that digitally indicates described renewal is to output to an external source of time of implementation marking operation.

12. according to the described semiconductor device of claim 11, it is characterized in that, before described processor device links distance of swimming hashed value and described state value, described processing unit also links at least one hashed value and corresponding sequence number, to produce a continuous Frame that forms described data folder.

13., it is characterized in that described encryption device also comprises a randomizer according to the described semiconductor device of claim 1, right to produce described unique key.

14. a semiconductor device comprises:

Be used to catch the sensing device of data folder; With

An encrypted circuit, it is connected to described sensing device, and described encrypted circuit comprises:

A plurality of memory cell, can comprise a state value and a distance of swimming hashed value, this distance of swimming hashed value is the hash result with the described data folder of described state value combination, before described transducer is used to catch described data folder, described state value is loaded into one of them unit of described a plurality of memory cell

A processor, it can (i) executable operations on described data folder produce described hashed value, (ii) digitally indicate described distance of swimming hashed value and (iii) export described distance of swimming hashed value, be used for time-marking operation and

A bus is connected to described a plurality of memory cell and described processor, and this bus makes described processor be communicated with described a plurality of memory cell.

15., it is characterized in that described a plurality of memory cell of described encrypted circuit comprise according to the described semiconductor device of claim 14:

A non-volatile cell, it is right to comprise a unique key;

A memory cell can comprise described distance of swimming hashed value;

A galaxy state storage unit can be included in described transducer and catch the described state value that is loaded before the described data folder;

A folder sequence memory cell can comprise a folder sequence number that increases after this semiconductor device energized; With

A frame sequence memory cell can comprise one and catch the number of frames that increases behind the data folder at described transducer, and described number of frames is added to described folder sequence number to form a sequence number.

16., it is characterized in that the described non-volatile memory cells of described at least encrypted circuit and described folder sequence memory cell are made of nonvolatile memory according to the described semiconductor device of claim 15.

17., it is characterized in that the described frame sequence memory cell of described at least encrypted circuit is made of volatile memory according to the described semiconductor device of claim 16.

18., it is characterized in that described encrypted circuit also comprises a randomizer that is coupled to described bus according to the described semiconductor device of claim 14.

19., it is characterized in that described transducer comprises a pixel capture array and is used to control the control logic of described pixel capture array according to the described semiconductor device of claim 14.

20. according to the described semiconductor device of claim 14, it is characterized in that, before the described processor of described encrypted circuit produces described distance of swimming hash result, described processor to Frame of major general and corresponding sequence number links, to produce the continuous Frame that at least one forms described data folder.

21. wherein each the described semiconductor device according to claim 14 to 20 is characterized in that, described a plurality of memory cell constitute a single memory device.

22. a maintenance is emitted to the method for integrality of the data folder in second source from first source, the method comprising the steps of:

A state value is loaded into a galaxy state storage unit;

Catch first Frame of described data folder;

Produce the first continuous Frame by at least described first Frame being carried out hash;

The described first continuous Frame is added to distance of swimming hashed value;

After the described first continuous Frame is added to distance of swimming hashed value, described state value is added to described distance of swimming hashed value;

Digitally indicate described distance of swimming hashed value; With

To described distance of swimming hashed value time of implementation-marking operation.

23. in accordance with the method for claim 22, it is characterized in that before catching the described step of described first Frame, this method also comprises a sequence number update to described first source.

24. in accordance with the method for claim 23, it is characterized in that the loading of described sequence number comprises:

With a folder sequence number update that is stored in described first source, described folder sequence number is a plurality of higher bit that forms described sequence number.

25. in accordance with the method for claim 24, it is characterized in that the loading of described sequence number also comprises:

A number of frames that is stored in described first source is upgraded, and described number of frames is a plurality of bits of the described sequence number of formation except that the described a plurality of bits that form described folder sequence number.

26. in accordance with the method for claim 24, it is characterized in that the generation of the described first continuous Frame comprises:

The described sequence number that described first Frame is relevant with described first Frame links, to produce the described first continuous Frame.

27. a semiconductor device comprises:

A transducer is used to catch data folder; With

An encrypted circuit is connected to this transducer, and described encrypted circuit comprises:

A plurality of memory cell, the state value that it can comprise a distance of swimming hashed value and load before catching this data folder,

A processor is connected to described a plurality of memory cell, and described processor can be to described data folder executable operations, with establish described data folder be this state value openly after and captive before the described encrypted circuit output in described distance of swimming hashed value.

28., it is characterized in that described processor is carried out Hash function to described data folder according to the described semiconductor device of claim 27, so that produce a hash result, described distance of swimming hashed value is the hashed value of a continuous updating.

29., it is characterized in that described processor produces a hash result to each Frame of this data folder, so that produce described distance of swimming hashed value according to the described semiconductor device of claim 28.

30. the semiconductor device according to claim 26 is characterized in that, it plays a microprocessor.

31. an encrypted circuit comprises:

A plurality of memory cell comprise a distance of swimming hashed value and prior to catching the state value that a data folder loads; With

Processor is connected to described a plurality of memory cell, and described processor is to described data folder executable operations, with establish this data folder be this state value openly after and comprising the information disclosure of a distance of swimming hashed value before captive.

32., it is characterized in that the operation of processor is carried out Hash operation to described data folder before being included in and sequentially being stored in the described memory cell as described distance of swimming hashed value described data folder according to the described encrypted circuit of claim 31.

33., it is characterized in that the operation of described processor comprises that a Frame of the described data folder from described memory cell produces a hash result, produces described distance of swimming hashed value with the concentrated area according to the described encrypted circuit of claim 31.

34., it is characterized in that the operation of described processor comprises that described state value is attached to described distance of swimming hashed value and digitlization ground sign has the described distance of swimming hashed value of described state value according to the described encrypted circuit of claim 33.

35. according to the described encrypted circuit of claim 33, it is characterized in that, also described hash result linked to produce the continuous data frame that at least one forms data folder with corresponding sequence number.

36. a method that is used to keep be transmitted the integrality of data, described method comprises step:

Obtain a state value from a remote source;

Catch first Frame;

Produce the hash result of described first Frame;

Produce a distance of swimming hashed value according to hash result and described state value; With to described distance of swimming hashed value time of implementation-marking operation.

Images