A high-throughput data encryption and decryption method and system for HDMI interface

Abstract

The application discloses a high-throughput data encryption and decryption method and system for HDMI interface. The system comprises a sending device and a receiving device, and is respectively integrated with a video acquisition / output module, a multi-core parallel encryption and decryption module based on an SM4 algorithm and an HDMI transceiving module. The sending device and the receiving device are both internally provided with a key negotiation module based on an SM2 algorithm, and realize bidirectional authentication and safe negotiation of a session key through an HDMI display data channel. The encryption and decryption module adopts a deep pipeline and a multi-core parallel architecture, supports processing of one data block per clock cycle, and realizes high-throughput real-time video data encryption and decryption. The system guarantees the safety of video transmission, significantly improves the encryption throughput, and is suitable for high-definition video application scenarios with strict requirements on data transmission rate and safety.

Description

Technical Field

[0001] This invention belongs to the field of digital video secure transmission technology, specifically relating to a method and system for high-throughput data encryption and decryption for HDMI interfaces. Background Technology

[0002] With the rapid development of information technology, high-definition and ultra-high-definition video technologies have been widely applied in information security-sensitive fields such as military command, government meetings, telemedicine, and financial transactions. The audio and video data in these applications often involve core business secrets or personal privacy. Therefore, to ensure the confidentiality and integrity of the data during transmission, encryption algorithms are used to encrypt the video data, ensuring that only display devices from specifically authorized units can correctly reproduce the image, preventing malicious interception during transmission.

[0003] Some existing encryption schemes based on general cryptographic algorithms (such as SM4) (such as the SM4 multi-mode parallel encryption and SM3 hash processing method for supporting data of arbitrary length proposed in patent CN120711205A) have improved in terms of algorithm flexibility, but when processing the above-mentioned ultra-high bandwidth video streams, their general parallel processing architecture still generally suffers from systemic bottlenecks that make it difficult to balance encryption throughput and real-time performance, and cannot meet the stringent requirements of high bitrate video streams for encryption latency and throughput.

[0004] Therefore, how to solve the problem of insufficient system throughput in the process of high-definition video stream encryption with greater flexibility while ensuring high security is an urgent problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of the above problems, the present invention provides a high-throughput data encryption and decryption system for HDMI interfaces that solves the above problems.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] Includes a transmitting device and a receiving device: The transmitting device includes a video acquisition module, a multi-core parallel encryption module based on a block cipher algorithm, and an HDMI transmitting module; The receiving device includes an HDMI receiving module, a multi-core parallel decryption module based on a block cipher algorithm, and a video output module; Both the transmitting and receiving devices integrate a key negotiation module based on an asymmetric cryptographic algorithm, used to securely negotiate a session key between the two communicating parties; the multi-core parallel encryption module and decryption module use the session key to encrypt and decrypt video data; The block cipher algorithm is the SM4 algorithm; the asymmetric cipher algorithm is the SM2 algorithm. Each encryption / decryption core in the multi-core parallel encryption module and the multi-core parallel decryption module adopts a pipelined architecture to process one data block per clock cycle; The pipeline architecture is a 32-stage pipeline, and each encryption / decryption core integrates a key expansion unit for pre-generating and caching a complete round key set for use by the 32-stage pipeline; The key negotiation module communicates via the display data channel within the HDMI cable.

[0008] Preferably, the sending device further includes a data scheduler and a row buffer FIFO; the data scheduler is used to dynamically allocate the data in the row buffer FIFO to each encryption core of the multi-core parallel encryption module.

[0009] Preferably, it also includes a configuration interface, which is used to dynamically write the session key to the multi-core parallel encryption module or the multi-core parallel decryption module.

[0010] Furthermore, the configuration interface is an AXI-Lite interface.

[0011] Preferably, it also includes an AXI-Stream interface, which is used to transmit video data and maintain its timing synchronization signal.

[0012] Based on the same inventive concept, this invention also discloses a high-throughput video encryption / decryption method for HDMI interfaces, applied to the system described in any of the above, comprising the following steps: Based on asymmetric cryptography algorithms, two-way authentication and key negotiation are performed between the sending and receiving devices to generate a session key; The acquired video data is encrypted in real time using a multi-core parallel block cipher algorithm combined with the session key to generate an encrypted video data stream; The encrypted video data stream is transmitted from the transmitting device to the receiving device via an HDMI interface; Using a multi-core parallel block cipher algorithm corresponding to the encryption step and the session key, the encrypted video data stream is decrypted in real time to restore the original video data.

[0013] The beneficial effects of the above-described technical solutions provided in the embodiments of the present invention include at least the following: 1. The SM2 and SM4 cryptographic algorithms are adopted to replace traditional encryption schemes and improve the system's algorithmic flexibility.

[0014] 2. Through the collaborative design of deep pipeline and multi-core parallel architecture, the problem of insufficient throughput of existing algorithms in ultra-high resolution and high frame rate video stream encryption is effectively solved, meeting the stringent requirements of real-time transmission.

[0015] 3. It integrates the SM2 key negotiation mechanism to complete device authentication and secure key exchange during the communication establishment phase, ensuring the trustworthiness and confidentiality of the transmission link from the source, forming a complete secure transmission system suitable for video transmission scenarios with high security requirements. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the end-to-end encryption system design provided in an embodiment of the present invention; Figure 2 This is a flowchart of a high-throughput data encryption / decryption method for HDMI interfaces provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1 This system embodiment provides a complete high-throughput data encryption and decryption system for HDMI interfaces. Specifically, as follows... Figure 1 As shown, the system consists of a transmitting device and a receiving device. The transmitting device includes a video acquisition module (such as an HDMI receiver chip), a multi-core parallel SM4 encryption module (core computing unit), and an HDMI transmission module (such as a TMDS encoding and driving circuit). The receiving device includes an HDMI receiver module, a multi-core parallel SM4 decryption module, and a video output module (such as a display controller). To achieve secure communication, both the transmitting and receiving devices have a built-in SM2 key negotiation module. This module runs during communication initialization, enabling both ends to authenticate each other and securely negotiate the same session key. Subsequently, both the encryption module at the transmitting end and the decryption module at the receiving end use this session key to encrypt and decrypt the transmitted video data, thereby establishing a secure video transmission channel.

[0020] To significantly improve single-core encryption throughput, this invention employs a deep pipeline optimization design for the hardware implementation of the SM4 encryption algorithm. Specifically, the cyclic architecture of the SM4 algorithm is optimized into a tightly integrated 32-stage pipeline architecture. Each pipeline stage is designed to independently handle a complete round of encryption computation, integrating all the necessary computational logic units for that round, including round key addition, nonlinear S-box substitution, and linear transformation L.

[0021] To achieve efficient pipeline operation, a "round key pre-generation and synchronous supply" mechanism is adopted. During the initialization phase, the key expansion unit generates all 32 round keys (RK0 to RK31) in parallel and caches them in a dedicated register file. During encryption, each pipeline stage can directly read its corresponding round key from the register file at each clock cycle, thus completely eliminating the path delay and waiting overhead caused by real-time round key calculation in traditional designs. This allows the encrypted data stream to proceed unblocked within the pipeline.

[0022] Meanwhile, the entire encryption core employs a 32-stage pipeline with registers cascading at both ends. The encryption output of the previous pipeline is latched under clock drive and used as the input data for the next pipeline in the next clock cycle. This structure allows the encryption core to input a new 128-bit plaintext data block in each clock cycle and output a ciphertext data block that has completed all 32 rounds of computation. Real-world testing shows that this optimization enables the single-core SM4 encryption module to achieve an effective throughput of 35.11 Gbps at a working frequency of 300MHz, achieving a leading level of single-core encryption efficiency in similar research.

[0023] The SM2 key negotiation module utilizes existing physical links for communication. Specifically, the transmitting and receiving devices negotiate keys via the HDMI cable connecting them. The communication channel used in the negotiation process is the Display Data Channel (DDC) defined in the HDMI standard. Both devices exchange parameters such as the public key required for the SM2 algorithm through this DDC (based on the I2C protocol), completing two-way authentication and ultimately generating a session key, thus achieving a "plug-and-play" secure connection establishment.

[0024] Before data is sent to the encryption array, preprocessing is required: First, based on the difference between the pixel bit width (96 bits) of the upstream video interface and the processing bit width (32 bits) of the encryption core, a bit width conversion module is designed and inserted to concatenate and align the input pixel data into data blocks that the encryption core can efficiently process. Second, to ensure the integrity of the video line data and avoid pixel tearing during scheduling, a buffer FIFO is added before the encryption module. The depth of this FIFO is precisely calculated to ensure that it can completely buffer at least one line of video pixel data, thus providing a continuous and stable data source for subsequent scheduling and allocation. This parallel module design allows some data to be directly encrypted while some data is being input, improving throughput and saving computation time. The data scheduler monitors the "busy / idle" status flags of each encryption core in the multi-core SM4 encryption module in real time. When the scheduler detects that an encryption core is idle, it immediately reads a prepared data block from the line buffer FIFO and dynamically allocates it to the idle encryption core. This mechanism achieves load balancing among multiple encryption cores and maximizes parallel computing efficiency.

[0025] Furthermore, the designed encryption IP strictly adheres to the AMBA AXI bus protocol, constructing a clearly layered and fully functional hardware interface and configuration management system. This system mainly comprises three parts: control interface, data interface, and monitoring interface, which together achieve secure key injection, efficient encryption of video data, and real-time visualization management of system status.

[0026] In the control plane, the encryption IP communicates with the Xilinx MicroBlaze soft core microprocessor in the system via the AXI-Lite slave interface. This interface is used to dynamically configure and update all operating parameters of the encryption core in real time. Specifically, the processor can write data to a series of mapped configuration registers within the IP through this interface to complete the following key operations: 1) Session key injection: The shared session key obtained through the SM2 algorithm during the key negotiation phase is securely written into the IP's key register group; 2) Working mode settings: Configure the IP to either encrypted or decrypted mode; 3) Control command issuance: such as initiating a global reset, clearing status flags, etc. This design makes key management, function switching, and IP control fully configurable in software, greatly enhancing the system's flexibility and security.

[0027] In the data plane, the encrypted IP uses the AXI-Stream interface as a high-speed channel for video data input and output. To ensure that the encrypted video stream can be correctly parsed and reproduced by the backend display controller, special attention is paid to the complete transmission and processing of dedicated video synchronization signals, based on the AXI-Stream protocol. Key signals include: 1) TLAST signal: Used to mark the end of a video line or a data packet. The internal logic of IP ensures that this signal travels through the entire processing pipeline synchronously with the encrypted data, ensuring that the structure of the output stream is consistent with the input stream. 2) TUSER signal: Used to carry critical synchronization information such as the start-of-frame of the video frame. The IP design ensures that these metadata signals are not destroyed or lost during encryption operations, but are cached, scheduled, processed, and output as is along with the corresponding pixel data. This fundamentally guarantees that the encryption process will not affect the synchronization sequence of the video, enabling normal video display.

[0028] In terms of monitoring, the system integrates a UART status monitoring interface, forming an observation channel independent of the data path. This interface continuously outputs the system's operating status and performance indicators at a configurable baud rate of 115200bps, including but not limited to: the real-time busy / idle status of each encryption core, the data throughput of the AXI-Stream channel, FIFO empty / full alarms, and bit error or protocol error flags statistically analyzed by the IP's internal monitoring circuitry. This information provides direct evidence for system integration debugging, online performance evaluation, and fault diagnosis, thus forming a complete hardware management system that is monitorable, configurable, and debuggable. This multi-layered interface design ensures that the encryption IP can be seamlessly integrated into the video processing pipeline as a high-performance computing unit, and also integrated into the software management framework of the entire SoC as a controlled node.

[0029] In a complete embodiment, a complete high-definition video stream real-time encryption hardware system was constructed, and its encryption end architecture is as follows: Figure 1 As shown, the core encryption algorithm and key management have achieved complete domestic substitution.

[0030] The high-definition video stream is input via HDMI reception and TMDS decoding modules. It then enters the data buffer and bit-width conversion module. This module first performs clock domain isolation and buffering on the input video stream to resolve the timing asynchrony issue between the source and processing cores. It then concatenates the pixel data and converts it to a 128-bit bit-width optimized by the encryption core, ensuring data boundary integrity. The processed data is sent to the core's multi-core SM4 encryption module. This module, based on a deep pipeline and parallel architecture, achieves high-throughput block encryption. The encrypted ciphertext stream passes through a synchronization control and output buffer module, which reorganizes and aligns the video timing signals to compensate for the fixed delay introduced by the encryption pipeline. Finally, the ciphertext video stream is output via TMDS encoding and HDMI transmission modules.

[0031] To support development verification and performance testing, the system integrates a test stream generation module, which can dynamically switch to internally generated color bars or motion sequences, providing a stable source of information for encryption function and throughput testing.

[0032] At the control and security level, the system is uniformly managed by the MicroBlaze soft-core processor. Session keys, generated by an external security system or a pre-configured scheme, are securely configured into the key register within the encryption module via the AXI-Lite bus using the MicroBlaze soft-core processor, enabling dynamic key injection and management. All control signaling and status monitoring can interact with the host computer via UART or other bus interfaces.

[0033] The encryption terminal system implemented in this embodiment forms a complete processing chain from video acquisition and real-time parallel encryption to ciphertext output. Its modular design allows it to be used plug-and-play to replace encryption units based on protocols such as HDCP in existing equipment, providing a high-performance, domestically produced hardware solution for the secure transmission of high-definition video content. The decryption system at the receiving end has a logically symmetrical architecture, which will not be described in detail here.

[0034] Example 2 like Figure 2 As shown in the figure, this embodiment of the method describes the workflow of the above system, which includes the following steps: After the transmitting and receiving devices are powered on and connected, the SM2 key negotiation modules built into both devices are started through the HDMI DDC channel, and bidirectional authentication is completed based on the SM2 algorithm. They also jointly calculate and generate a shared session key.

[0035] The transmitting device begins acquiring high-definition video. The video data is encapsulated into continuous data blocks, and these data blocks are encrypted in real time using the multi-core parallel SM4 algorithm combined with the generated session key, producing an encrypted video data stream.

[0036] The generated encrypted video data stream is transmitted from the sending device to the receiving device via a physical HDMI interface.

[0037] After receiving the encrypted stream, the receiving device uses its multi-core parallel SM4 decryption module (whose architecture corresponds to that of the sending end encryption module) to decrypt the encrypted video data stream in real time using the same session key, and finally restores the original, unencrypted video data, which is then sent to the display device for output.

[0038] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0039] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A high-throughput data encryption / decryption system for HDMI interfaces, characterized in that, Includes a transmitting device and a receiving device: The transmitting device includes a video acquisition module, a multi-core parallel encryption module based on a block cipher algorithm, and an HDMI transmitting module; The receiving device includes an HDMI receiving module, a multi-core parallel decryption module based on a block cipher algorithm, and a video output module; Both the transmitting and receiving devices integrate a key negotiation module based on an asymmetric cryptographic algorithm, used to securely negotiate a session key between the two communicating parties; the multi-core parallel encryption module and decryption module use the session key to encrypt and decrypt video data; The block cipher algorithm is the SM4 algorithm; the asymmetric cipher algorithm is the SM2 algorithm. Each encryption / decryption core in the multi-core parallel encryption module and the multi-core parallel decryption module adopts a pipelined architecture to process one data block per clock cycle; The pipeline architecture is a 32-stage pipeline, and each encryption / decryption core integrates a key expansion unit for pre-generating and caching a complete round key set for use by the 32-stage pipeline; The key negotiation module communicates via the display data channel within the HDMI cable.

2. The high-throughput data encryption / decryption system for HDMI interfaces according to claim 1, characterized in that, The sending device further includes a data scheduler and a row buffer FIFO; the data scheduler is used to dynamically allocate the data in the row buffer FIFO to each encryption core of the multi-core parallel encryption module.

3. The high-throughput data encryption / decryption system for HDMI interfaces according to claim 1, characterized in that, It also includes a configuration interface, which is used to dynamically write the session key to the multi-core parallel encryption module or the multi-core parallel decryption module.

4. The high-throughput data encryption / decryption system for HDMI interfaces according to claim 3, characterized in that, The configuration interface is the AXI-Lite interface.

5. A high-throughput data encryption / decryption system for HDMI interfaces according to claim 1, characterized in that, It also includes an AXI-Stream interface, which is used to transmit video data and maintain its timing synchronization signal.

6. A high-throughput video encryption / decryption method for HDMI interfaces, applied to the system described in any one of claims 1-5, characterized in that, Includes the following steps: Based on asymmetric cryptography algorithms, two-way authentication and key negotiation are performed between the sending and receiving devices to generate a session key; The acquired video data is encrypted in real time using a multi-core parallel block cipher algorithm combined with the session key to generate an encrypted video data stream; The encrypted video data stream is transmitted from the transmitting device to the receiving device via an HDMI interface; Using a multi-core parallel block cipher algorithm corresponding to the encryption step and the session key, the encrypted video data stream is decrypted in real time to restore the original video data.

Images