Encryption and decryption device and encryption and decryption method

Abstract

Disclosed is an encryption and decryption device and method, belonging to the field of data processing, which comprises a cache module, a control module and an AES algorithm module. The cache module comprises a first cache unit and a second cache unit, and the first cache unit stores a first extended key. The control module is connected with the cache module and the AES algorithm module, and is configured to, in the process of the AES algorithm module encrypting or decrypting a first data packet using the first extended key, receive a second data packet, obtain a key corresponding to the second data packet, generate a second extended key based on the key corresponding to the second data packet, store the second extended key in the second cache unit, and send the second data packet to the AES algorithm module. The AES algorithm module is connected with the cache module, and is configured to encrypt or decrypt the second data packet using the second extended key. The device can improve the efficiency of processing data packets.

Description

Technical Field

[0001] This disclosure relates to the field of data processing, and in particular to an encryption / decryption device and encryption / decryption method. Background Technology

[0002] AES (Advanced Encryption Standard) is a symmetric encryption algorithm, meaning that the same key is used for both encryption and decryption. It is a secure and reliable encryption algorithm.

[0003] In related technologies, encryption and decryption devices based on the AES algorithm include: a control module and an AES algorithm module. The control module is used to receive data packets and obtain the key corresponding to the data packets, and to send the data packets and the corresponding key to the AES algorithm module. The AES algorithm module is used to generate an extended key based on the key, and to encrypt or decrypt data packets based on the extended key.

[0004] However, when using the above-mentioned device for encryption and decryption, if the service traffic increases, such as when the control module receives multiple data packets in a short period of time, there may be a situation where the control module receives a data packet, but the AES algorithm module is still encrypting and decrypting the previous data packet. In this case, the data packet needs to wait for the previous data packet to be encrypted and decrypted before the AES algorithm module can generate an extended key based on the key corresponding to the data packet, and then encrypt and decrypt the data packet based on the generated extended key. Therefore, the efficiency of this encryption and decryption device in processing data packets is low. Summary of the Invention

[0005] This disclosure provides an encryption / decryption apparatus and method, which can improve the efficiency of data packet processing. The technical solution includes at least the following:

[0006] On one hand, an encryption / decryption device is provided, comprising: a caching module, a control module, and an Advanced Encryption Standard (AES) algorithm module; the caching module includes a first caching unit and a second caching unit, the first caching unit storing a first extended key, the first extended key being used to encrypt or decrypt a first data packet; the control module is connected to both the caching module and the AES algorithm module, and is configured to, during the process of the AES algorithm module encrypting or decrypting the first data packet using the first extended key, receive a second data packet, obtain a key corresponding to the second data packet, generate a second extended key based on the key corresponding to the second data packet, store the second extended key in the second caching unit, and send the second data packet to the AES algorithm module; the AES algorithm module is connected to the caching module, and is configured to, after encrypting or decrypting the first data packet using the first extended key, receive the second data packet sent by the control module, obtain the second extended key from the second caching unit, and encrypt or decrypt the second data packet using the second extended key.

[0007] Optionally, the size of the first cache unit is equal to the size of the second cache unit, and the size of the second cache unit is equal to the size of the second extended key.

[0008] Optionally, the control module is configured to acquire the key corresponding to the second data packet in the following manner: acquire the first feature information of the second data packet; determine the key index information of the second data packet based on the key correspondence relationship and the first feature information of the second data packet, wherein the key correspondence relationship is the correspondence relationship between the first feature information and the key index information, and the key index information of the second data packet is used to indicate the storage address of the key corresponding to the second data packet; and acquire the key corresponding to the second data packet based on the key index information of the second data packet.

[0009] Optionally, the AES algorithm module is further configured to send a first prompt message to the control module after encrypting or decrypting the first data packet, the first prompt message indicating that the encryption or decryption of the first data packet is complete; the control module is further configured to receive the first prompt message and, in response to the first prompt message, erase the first extended key in the first cache unit.

[0010] Optionally, the control module is further configured to send the second data packet to the AES algorithm module in response to the first prompt information.

[0011] Optionally, the control module is further configured to receive a third data packet during the process of the AES algorithm module encrypting or decrypting the second data packet using the second extended key; after erasing the first extended key in the first cache unit, obtain the key corresponding to the third data packet based on the third data packet; generate a third extended key based on the key corresponding to the third data packet; store the third extended key in the first cache unit; and send the third data packet to the AES algorithm module, wherein the third extended key is used to encrypt or decrypt the third data packet. The AES algorithm module is further configured to receive the third data packet sent by the control module after the second data packet is encrypted or decrypted, obtain the third extended key from the first cache unit, and encrypt or decrypt the third data packet using the third extended key.

[0012] On the other hand, an encryption / decryption method is provided, the method comprising: receiving a second data packet during the process of an AES algorithm module encrypting or decrypting a first data packet using a first extended key; obtaining a key corresponding to the second data packet based on the second data packet; generating a second extended key based on the key corresponding to the second data packet; storing the second extended key in a second cache unit; and sending the second data packet to the AES algorithm module after the first data packet has been encrypted or decrypted.

[0013] Optionally, obtaining the key corresponding to the second data packet based on the second data packet includes: obtaining first feature information of the second data packet; determining key index information of the second data packet based on the key correspondence relationship and the first feature information of the second data packet, wherein the key correspondence relationship is the correspondence relationship between the first feature information and the key index information, and the key index information of the second data packet is used to indicate the storage address of the key corresponding to the second data packet; and obtaining the key corresponding to the second data packet based on the key index information of the second data packet.

[0014] Optionally, the method further includes: receiving a first prompt message, the first prompt message being used to indicate that the encryption or decryption of the first data packet is complete; and in response to the first prompt message, erasing the first extended key in the first cache unit.

[0015] Optionally, the method further includes: in response to the first prompt information, sending the second data packet to the AES algorithm module.

[0016] Optionally, the method further includes receiving the second data packet when the second buffer unit does not store data.

[0017] Optionally, the method further includes: receiving a third data packet during the process of the AES algorithm module encrypting or decrypting the second data packet using the second extended key; after erasing the first extended key in the first buffer unit, obtaining the key corresponding to the third data packet based on the third data packet; generating a third extended key based on the key corresponding to the third data packet, the third extended key being used to encrypt or decrypt the third data packet; storing the third extended key in the first buffer unit; and sending the third data packet to the AES algorithm module after the second data packet has been encrypted or decrypted.

[0018] The beneficial effects of the technical solutions provided in this disclosure include at least the following:

[0019] Since the key expansion function is implemented by the control module rather than the AES algorithm module, the control module can generate a corresponding second expansion key based on the key corresponding to the second data packet while the AES algorithm module encrypts or decrypts the first data packet based on the first expansion key in the first buffer unit.

[0020] After generating the second extended key, it is stored in the second cache unit. This cache module includes a first cache unit and a second cache unit, each storing one extended key. Therefore, the cache module can store two extended keys simultaneously. The extended key stored in one cache unit can be used by the AES algorithm module to encrypt or decrypt the current data packet (i.e., the first extended key stored in the first cache unit), while the extended key stored in the other cache unit can be used by the AES algorithm module to encrypt or decrypt the next data packet (i.e., the second extended key stored in the second cache unit).

[0021] In this way, after the AES algorithm module has encrypted or decrypted the first data packet, it can directly encrypt or decrypt the second data packet based on the second extended key stored in the second buffer unit, without first generating a second extended key based on the key corresponding to the second data packet, and then encrypting or decrypting the second data packet based on the second extended key. Therefore, the waiting time for the second data packet is reduced, thereby improving the efficiency of the encryption and decryption device in processing data packets. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This illustration shows an application scenario of an encryption / decryption apparatus provided by an exemplary embodiment of the present disclosure;

[0024] Figure 2 A schematic diagram of the structure of an encryption / decryption apparatus provided in an exemplary embodiment of this disclosure is shown;

[0025] Figure 3 A schematic diagram of the structure of an encryption / decryption apparatus provided in another exemplary embodiment of this disclosure is shown;

[0026] Figure 4 A flowchart of an encryption / decryption method provided by an exemplary embodiment of this disclosure is shown. Detailed Implementation

[0027] Unless otherwise defined, the technical or scientific terms used herein shall have the ordinary meaning as understood by one of ordinary skill in the art to which this disclosure pertains. The terms “first,” “second,” “third,” and similar terms used in this patent application specification and claims do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, the terms “an” or “a” and similar terms do not indicate a quantity limitation, but rather indicate the presence of at least one. The terms “comprising” or “including” and similar terms mean that the elements or objects preceding “comprising” or “including” encompass the elements or objects listed following “comprising” or “including” and their equivalents, and do not exclude other elements or objects. The terms “connected” or “linked” and similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0028] To make the objectives, technical solutions, and advantages of this disclosure clearer, the embodiments of this disclosure will be described in further detail below with reference to the accompanying drawings.

[0029] Figure 1 This illustration shows an application scenario of an encryption / decryption apparatus provided by an exemplary embodiment of this disclosure. See also... Figure 1 The encryption / decryption device 100 is connected to the computer device 101, for example, via an AXIS (Advanced eXtensible Interface-Stream) bus.

[0030] Computer device 101 is configured to send data packets that need to be encrypted or decrypted to encryption / decryption device 100. Optionally, computer device 101 may be a network device capable of sending data packets, such as a router or switch.

[0031] The encryption / decryption device 100 is configured to encrypt or decrypt data packets based on the AES algorithm. Optionally, the encryption / decryption device 100 can be implemented based on an FPGA (Field-Programmable Gate Array).

[0032] In one possible implementation, the computer device 101 and the encryption / decryption device are two different electronic devices. In this case, the encryption / decryption device 100 can be a security device with encryption / decryption capabilities, located at a node on an Ethernet network. The computer device 101 is a network device, such as a router or switch. This network device sends data to another network device via the Ethernet network. When the data is transmitted over the Ethernet network, it is first encrypted or decrypted by the security device before being sent to the other network device.

[0033] In another possible implementation, the computer device 101 and the encryption / decryption device are the same electronic device. In this case, the encryption / decryption device 100 can be a callable encryption / decryption board connected to the computer device 101 via a physical interface on the board. After receiving data that needs to be encrypted or decrypted, the computer device 101 can call the board through the physical interface to encrypt or decrypt the data. After encrypting or decrypting the data, the board returns the result to the computer device 101.

[0034] The basic principles of the AES algorithm will be briefly described below.

[0035] The AES algorithm involves several key components: key, plaintext, and ciphertext.

[0036] Plaintext refers to the data that needs to be encrypted, while ciphertext is either the encrypted data or the data that needs to be decrypted. In the AES algorithm, a data packet that needs encryption is first divided into several plaintext groups of the same size, and each group is then encrypted separately. Similarly, in the AES algorithm, a data packet that needs decryption is also divided into several ciphertext groups of the same size, and each ciphertext group is then decrypted separately.

[0037] The AES algorithm encrypts plaintext using an encryption function. The input to the encryption function is the plaintext and the key, and the output is the ciphertext. Similarly, the AES algorithm decrypts ciphertext using a decryption function. The input to the decryption function is the ciphertext and the key, and the output is the plaintext.

[0038] For any given set of plaintext, multiple rounds of encryption are required using an encryption function, with each round involving a different round key. Therefore, after obtaining a set of plaintext and a key, the key cannot be directly used as the round key to encrypt the plaintext. Instead, a key expansion algorithm is needed to expand the key, resulting in an expanded key that includes the round keys required for each round. In this way, the plaintext can be encrypted using the encryption function and the expanded key. Details on how to perform multi-round encryption of plaintext using encryption functions and expanded keys are widely available in related technologies and will not be elaborated here. After all the plaintext sets in a data packet have been encrypted using the above method, the data packet to be encrypted is complete.

[0039] The process of decryption using the AES algorithm is similar to that of encryption using the AES algorithm. The difference is that decryption involves a decryption function and ciphertext, which will not be detailed here.

[0040] Figure 2 A schematic diagram of the encryption / decryption apparatus provided in an exemplary embodiment of this disclosure is shown below. See also: Figure 2 The encryption / decryption device 100 includes: a control module 11, an AES algorithm module 12, and a cache module 13.

[0041] The caching module 13 includes a first caching unit 131 and a second caching unit 132. The first caching unit 131 stores a first extended key, which is used to encrypt or decrypt the first data packet.

[0042] The control module 11 is connected to the AES algorithm module 12 and the cache module 13, respectively. The control module 11 is configured to receive a second data packet, obtain the key corresponding to the second data packet, generate a second extended key based on the key corresponding to the second data packet, store the second extended key in the second cache unit 132, and send the second data packet to the AES algorithm module 12 during the encryption or decryption of the first data packet by the AES algorithm module 12.

[0043] The AES algorithm module 12 is connected to the cache module 13. The AES algorithm module 12 is configured to, after encrypting or decrypting the first data packet using the first extended key, receive the second data packet sent by the control module 11, obtain the second extended key from the second cache unit 132, and encrypt or decrypt the second data packet using the second extended key.

[0044] In this embodiment of the disclosure, since the key expansion function is implemented by the control module rather than the AES algorithm module, during the process of the AES algorithm module encrypting or decrypting the first data packet based on the first expansion key in the first cache unit, the control module can generate the corresponding expansion key based on the key corresponding to the next data packet (that is, generate the second expansion key based on the key corresponding to the second data packet).

[0045] After generating the extended key corresponding to the next data packet, the extended key is stored in a caching module. This caching module includes a first caching unit and a second caching unit. Each caching unit is configured to store one extended key. Therefore, the caching module can store two extended keys at the same time. The extended key stored in one caching unit can be used by the AES algorithm module to encrypt or decrypt the current data packet (that is, the first extended key stored in the first caching unit). The extended key stored in the other caching unit can be used by the AES algorithm module to encrypt or decrypt the next data packet (that is, the second extended key stored in the second caching unit).

[0046] In this way, after the AES algorithm module has encrypted or decrypted the first data packet, it can directly encrypt or decrypt the second data packet based on the second extended key stored in the second buffer unit, without first generating a second extended key based on the key corresponding to the second data packet, and then encrypting or decrypting the second data packet based on the second extended key. Therefore, the waiting time for the second data packet is reduced, thereby improving the efficiency of the encryption and decryption device in processing data packets.

[0047] In this embodiment of the disclosure, the first extended key is generated by the control module 11 based on the key corresponding to the first data packet.

[0048] In this embodiment of the application, both the first cache unit 131 and the second cache unit 132 can store an extended key. Therefore, the cache module 13 can store two extended keys at the same time.

[0049] Optionally, the control module 11 is connected to the computer device 101, for example, via an AXIS data bus. In this way, the control module 11 can receive data packets sent by the computer device 101 that require encryption or decryption. In this case, the first data packet and the second data packet are sent by the computer device 101 to the control module 11.

[0050] Optionally, the control module 11 is also configured to receive a second data packet if the second buffer unit 132 does not store any data.

[0051] In this scenario, before the control module 11 receives the second data packet, the control module 11 needs to determine whether the second buffer unit 132 contains data. Optionally, the control module 11 is configured to determine whether the second buffer unit 132 does not contain data by: acquiring the empty / full flag of the second buffer unit, where the empty / full flag of each buffer unit is used to indicate whether the buffer unit is full of data; and determining whether the second buffer unit does not contain data based on the empty / full flag of the second buffer unit.

[0052] Optionally, the size of the first cache unit 131 is equal to the size of the second cache unit 132, and the size of the second cache unit 132 is equal to the size of the second extended key. That is, the size of each cache unit is exactly equal to the size of the extended key, and one cache unit can store exactly one extended key. Thus, if the empty / full flag of a cache unit indicates that the cache unit is full of data, it means that the cache unit stores one extended key; if the empty / full flag of a cache unit indicates that the cache unit is not full of data, it means that the cache unit does not store an extended key.

[0053] Here, the writing speed of the extended key in each cache unit is very fast. Although the empty / full flag may indicate that the cache unit is not full while an extended key is being written to a cache unit and before the writing is complete, this situation occurs for a very short time and can be basically ignored. Therefore, when the empty / full flag indicates that a cache unit is not full, it can be assumed in most cases that the cache unit does not store the extended key.

[0054] Optionally, when the second cache unit 132 is full of data, the second empty / full flag bit is a first value; when the second cache unit 132 is not stored with data, the second empty / full flag bit is a second value. The first value can be 0 or 1, and correspondingly, the second value can be 1 or 0. When the first value is 0, the second value is 1; when the first value is 1, the second value is 0.

[0055] Here, since the size of the cache unit is the same as the size of the extended key, the cache unit will only be either empty or full, and no other situation will occur. Therefore, the control module 11 can determine whether there is data in the second cache unit 132 by using the second empty / full flag bit.

[0056] Optionally, after obtaining the second data packet, the control module is also configured to obtain the key corresponding to the second data packet in the following manner:

[0057] The first step is to obtain the first characteristic information of the second data packet.

[0058] Optionally, the first characteristic information can be the name of the data packet, the message 5-tuple of the data packet, or other characteristic information. The first characteristic information of the second data packet is either the name of the second data packet or the message 5-tuple of the second data packet, etc.

[0059] The second step is to determine the key index information of the second data packet based on the key correspondence and the first feature information of the second data packet.

[0060] The key correspondence is the correspondence between the first feature information and the key index information. The key index information of the second data packet is used to indicate the storage address of the corresponding key of the second data packet.

[0061] The key mapping relationship can be stored in the internal storage space of the encryption / decryption device 100, while the key can be stored in an external memory connected to the encryption / decryption device 100. Here, since the encryption / decryption device 100 is implemented based on an FPGA, and the internal storage space of the FPGA is limited, if too many keys are stored, the internal storage space of the FPGA cannot store all the keys. Therefore, by storing the keys in external memory, the internal storage space of the encryption / decryption device 100 only stores the key mapping relationship, effectively reducing the occupation of the internal storage space of the FPGA.

[0062] The third step is to obtain the key corresponding to the second data packet based on the key index information of the second data packet.

[0063] Since the key index information is used to indicate the storage address of the key corresponding to the data packet, the storage address of the key corresponding to the second data packet can be determined based on the key index information of the second data packet, and then the key corresponding to the second data packet can be obtained from that storage address.

[0064] After obtaining the key corresponding to the second data packet, the control module 11 can generate a second extended key based on the key corresponding to the second data packet according to the key expansion algorithm. There are many related technologies explaining how the key expansion algorithm generates the extended key based on the key, and details are omitted here.

[0065] Optionally, the encryption / decryption device 100 further includes a memory 14 configured to store data packets encrypted or decrypted by the encryption / decryption device 100. The encrypted or decrypted data packets can then be retrieved from the memory 14 for further processing. Optionally, the memory 14 can be a FIFO (First In First Out) cache, RAM (Random Access Memory), or Flash memory.

[0066] Optionally, the AES algorithm module 12 is connected to the memory 14, for example, via an AXIS data bus. In this way, the AES algorithm module 12 can store encrypted or decrypted data packets in the memory 14.

[0067] Optionally, the AES algorithm module 12 is further configured to send a first prompt message to the control module 11 after the first data packet is encrypted or decrypted. The first prompt message is used to indicate that the encryption or decryption of the first data packet is complete.

[0068] The control module 11 is also configured to receive a first prompt message and, in response to the first prompt message, erase the first extended key in the first cache unit 131.

[0069] After the AES algorithm module 12 has completed encrypting or decrypting the first data packet, the AES algorithm module 12 no longer needs to use the first extended key in the first cache unit 131. Therefore, the first extended key in the first cache unit can be erased, so that the extended key corresponding to other data packets can be stored in the first cache unit next time.

[0070] Optionally, if the first prompt message is present, the control module 11 is also configured to send a second data packet to the AES algorithm module 12 in response to the first prompt message.

[0071] After the first data packet is encrypted or decrypted, the control module 11 can send the second data packet to the AES algorithm module 12 so that the AES algorithm module 12 can perform encryption or decryption operations on the second data packet.

[0072] In this embodiment of the disclosure, the AES algorithm module 12 has both AES encryption and AES decryption functions.

[0073] That is, the AES algorithm module 12 may receive data packets that need to be encrypted or data packets that need to be decrypted. Therefore, in order to facilitate the AES algorithm module 12 in determining whether a received data packet needs to be encrypted or decrypted, in one possible implementation, the AES algorithm module 12 receives an external signal at the same time as receiving a data packet. This external signal is used to indicate whether the data packet needs to be encrypted or decrypted, and the AES algorithm module 12 can determine whether the data packet needs to be encrypted or decrypted through this external signal.

[0074] In another possible implementation, each data packet received by the AES algorithm module 12 has second feature information, which is used to indicate whether the data packet needs to be encrypted or decrypted. The AES algorithm module 12 can determine whether the data packet needs to be encrypted or decrypted by obtaining the second feature information of a data packet.

[0075] In implementation, the aforementioned second feature information and the aforementioned first feature information can be set in the same frame of data. For example, they can be set in the header or footer of each data packet.

[0076] In other embodiments, the AES algorithm module 12 is configured to have only AES encryption functionality or only AES decryption functionality. When the AES algorithm module 12 is configured to have only AES encryption functionality, the data packets that the AES algorithm module 12 needs to process only include the data packets that need to be encrypted. When the AES algorithm module 12 is configured to have only AES decryption functionality, the data packets that the AES algorithm module 12 needs to process only include the data packets that need to be decrypted.

[0077] Optionally, the control module 11 is further configured to receive a third data packet during the process of the AES algorithm module 12 encrypting or decrypting the second data packet using the second extended key, and after erasing the first extended key in the first buffer unit, obtain the key corresponding to the third data packet based on the third data packet, generate a third extended key based on the key corresponding to the third data packet, and store the third extended key in the first buffer unit. The third extended key is used to encrypt or decrypt the third data packet.

[0078] The AES algorithm module 12 is also configured to receive a third data packet sent by the control module after the second data packet is encrypted or decrypted, obtain a third extended key from the first buffer unit, and encrypt or decrypt the third data packet using the third extended key.

[0079] Upon receiving the first prompt message, the control module 11 erases the first extended key stored in the first cache unit 131 and sends the second data packet to the AES algorithm module 12. Therefore, during the process of the AES algorithm module 12 encrypting or decrypting the second data packet using the second extended key, the first cache unit 131 has been erased, thus allowing the third extended key to be stored in the first cache unit 131.

[0080] Furthermore, the time taken for the control module 11 to generate the extended key is generally less than the time taken for the AES algorithm module 12 to encrypt or decrypt the data packet based on the extended key. Therefore, after the control module 11 has completed generating the third extended key corresponding to the third data packet and storing the third extended key in the first buffer unit 131, the AES algorithm module 12 has generally not yet finished encrypting or decrypting the second data packet. Thus, there will not be a situation where the third extended key is not present in the buffer module when the AES algorithm module 12 has finished processing the second data packet and is ready to process the third data packet.

[0081] Upon receiving other data packets, the control module 11 can store the extended key corresponding to the data packet in the first cache unit 131 and the second cache unit 132 in turn. Correspondingly, the AES algorithm module can also retrieve the required extended key from the first cache unit 131 and the second cache unit 132 in turn.

[0082] Figure 3 A schematic diagram of the encryption / decryption apparatus provided in another exemplary embodiment of this disclosure is shown below. See also: Figure 3 ,and Figure 2 In contrast, the control module 11 of the encryption / decryption device 100 includes: a second control unit 111, a key query unit 112, a key expansion unit 113, and a first control unit 114.

[0083] The first control unit 114 is connected to the cache module 13 and the AES algorithm module 12, respectively. The first control unit 114 is configured to determine whether data is stored in the second cache unit 132, and to receive a first prompt message sent by the AES algorithm module 12, and in response to the first prompt message, to erase the first extended key in the first cache unit 131.

[0084] For example, the first control unit 114 and the first cache unit 131 are connected via a 128-bit data bus, a 4-bit address bus, and a 1-bit control signal bus. The first control unit 114 and the second cache unit 132 are also connected via a 128-bit data bus, a 4-bit address bus, and a 1-bit control signal bus.

[0085] The data bus between the first control unit 114 and the first cache unit 131 and the second cache unit 132 is configured to transmit the extended key. In the AES algorithm, the length of the extended key is related to the sum of the keys and the number of rounds of key usage. The key length can be 128 bits (16 bytes, 4 words), 196 bits (24 bytes, 6 words), or 256 bits (32 bytes, 8 words). For example, when the key length is 4 words, 11 rounds of key usage are required, resulting in an extended key length of 44 words; when the key length is 6 words, 13 rounds of key usage are required, resulting in an extended key length of 52 words; and when the key length is 8 words, 15 rounds of key usage are required, resulting in an extended key length of 60 words. It can be seen that regardless of the key length, the corresponding extended key length is always a multiple of 4 words. Therefore, the bit width of the data bus between the first control unit 114 and the first cache unit 131 and the second cache unit 132 can be set to 128 bits to facilitate the transmission of the extended key.

[0086] The first control unit 114 can obtain the address data of the first cache unit 131 and the second cache unit 132 through the address bus. Here, the length of the address data is generally 4 bits or a multiple of 4 bits, so the bit width of the address bus is set to 4 bits to facilitate the transmission of address data.

[0087] The control signal bus between the first control unit 114 and the cache module 13 is configured to transmit a first completion signal, which typically requires only 1 bit (e.g., 0 or 1). Therefore, the bit width of the control signal bus is set to 1 bit to facilitate the transmission of the first completion signal. Here, the first completion signal is used to indicate that the extended key transmission is complete.

[0088] The first control unit 114 and the AES algorithm module 12 are connected via a 1-bit control signal bus. This control signal bus is used to transmit the first prompt information.

[0089] In this embodiment of the disclosure, the second control unit 111 is also connected to the computer device 101 via an AXIS bus, and the second control unit 111 is configured to receive data packets (such as the aforementioned first data packet, second data packet, or third data packet) sent by the computer device 101.

[0090] The second control unit 111 is also connected to the first control unit 114, and the second control unit is further configured to receive a second prompt message sent by the first control unit 114. The second prompt message is used to indicate that at least one cache unit in the cache module 13 has not stored data.

[0091] Accordingly, the first control unit 114 is also configured to send a second prompt message to the second control unit 111 if at least one cache unit in the cache module 13 does not store data.

[0092] Upon receiving the second prompt message, the second control unit 111 can determine that at least one cache unit in the cache module 13 has not stored data, and therefore can receive the second data packet sent by the computer device 101.

[0093] For example, the second control unit 111 and the first control unit 114 are connected via a control signal bus with a bit width of 1 bit, and the control signal bus between the first control unit 114 and the second control unit 111 is configured to transmit a second prompt message.

[0094] The second control unit 111 is also connected to the AES algorithm module 12. The second control unit 111 is used to receive the first prompt information sent by the AES algorithm module 12, and in response to the first prompt information, send the second data packet to the AES algorithm module 12.

[0095] The second control unit 111 is connected to the AES algorithm module 12 via a 128-bit data bus and a 1-bit control signal bus.

[0096] Here, the data bus between the second control unit 111 and the AES algorithm module 12 is configured to transmit data packets, for example, to transmit the first data packet. In the AES algorithm, plaintext is divided into multiple groups, each group being 128 bits in size. Therefore, the size of the data packet is a multiple of 128 bits. Thus, setting the bit width of the data bus between the AES algorithm module 12 and the control module 11 to 128 bits facilitates the transmission of data packets.

[0097] The control signal bus between the second control unit 111 and the AES algorithm module 12 is configured to transmit a second completion signal, which typically requires only 1 bit (e.g., 0 or 1). Therefore, the bit width of the control signal bus is set to 1 bit to facilitate the transmission of the second completion signal. Here, the second completion signal is used to indicate that the data packet transmission is complete.

[0098] Optionally, the second control unit 111 is also connected to the key query unit 112. The second control unit 111 is further configured to acquire first characteristic information of the second data packet, and determine the key index information of the second data packet based on the first characteristic information of the second data packet and the key correspondence. The second control unit 111 is also configured to send the key index information of the second data packet to the key query unit 112. The key query unit 112 is configured to acquire the key corresponding to the second data packet based on the key index information of the second data packet.

[0099] When the key is stored in external memory, the key query unit 112 is also connected to the external memory, for example, via the AXIS data bus.

[0100] For example, the second control unit 111 and the key query unit 112 are connected via an 8-bit data bus and a 1-bit control signal bus.

[0101] The data bus between the second control unit 111 and the key query unit 112 is configured to transmit keys. As mentioned above, the key size can be 16 bytes, 24 bytes, or 32 bytes. 8 bits is one byte. Thus, by setting the bit width of the data bus between the second control unit 111 and the key query unit 112 to 8 bits, key transmission is facilitated.

[0102] The control signal bus between the second control unit 111 and the key query unit 112 is configured to transmit a third completion signal, which typically requires only 1 bit (e.g., 0 or 1). Therefore, the control signal bus is set to 1 bit to facilitate the transmission of the third completion signal. Here, the third completion signal is used to indicate that the key transmission is complete.

[0103] The key expansion unit 113 is connected to the key query unit 112. The key query unit 112 is also configured to send the key corresponding to the second data packet to the key expansion unit. Correspondingly, the key expansion unit 113 is configured to receive the key corresponding to the second data packet sent by the key query unit 112, and to generate a second expanded key based on the key corresponding to the second data packet.

[0104] For example, the key query unit 112 and the key expansion unit 113 are connected via a 1-bit control signal bus and a 128-bit data bus. The data bus between the key query unit 112 and the key expansion unit 113 is configured to transmit a key, and the control signal bus between the key query unit 112 and the key expansion unit 113 is configured to transmit a fourth completion signal, which is used to indicate that the key transmission is complete.

[0105] Optionally, the key expansion unit 113 is also connected to the first control unit 114, and the key expansion unit 113 is further configured to send the generated second expansion key to the first control unit 114. The first control unit 114 is further configured to store the second expansion key in the second cache unit 132.

[0106] For example, the key expansion unit 113 is connected to the first control unit 114 via two 1-bit control signal buses and a 128-bit data bus.

[0107] The data bus between the key expansion unit 113 and the first control unit 114 is configured to transmit the expansion key. Of the two control signal buses between the key expansion unit 113 and the first control unit 114, one is configured to transmit a fifth completion signal, and the other is configured to transmit an expansion key valid signal. The fifth completion signal indicates that the expansion key transmission is complete, and the expansion key valid signal indicates that the expansion key is valid. Here, both the fifth completion signal and the expansion key valid signal are signals sent by the key expansion unit 113 to the first control unit 114.

[0108] Here, the first control unit 114 only receives the extended key if the extended key valid signal is present. If the extended key valid signal is not present, it means that the extended key generated by the key extension unit 113 is incorrect, and the first control unit 114 will not receive the extended key in this case.

[0109] When the encryption / decryption device 100 is implemented, there are also valid signals in other data transmission processes (such as the second control unit 111 receiving data packets, and the AES algorithm module 12 sending data packets that have been encrypted or decrypted to the memory 14). The valid signals involved can be implemented in other ways (e.g., through the AXIS bus protocol), and data transmission only occurs when valid signals are present.

[0110] Furthermore, in this embodiment of the disclosure, the AES algorithm module 12 is connected to the first cache unit 131, and the AES algorithm module 12 is connected to the second cache unit 132 via a 128-bit data bus and a 4-bit address bus.

[0111] The address bus between the AES algorithm module 12 and the first cache unit 131 and the second cache unit 132 is configured to transmit the address data of the cache units, and the AES algorithm module 12 can read data from the cache units based on the address data of the cache units. The data bus between the AES algorithm module 12 and the first cache unit 131 and the second cache unit 132 is configured to transmit the extended key.

[0112] The following describes the operation of the encryption / decryption device 100 in this embodiment of the present disclosure, taking as an example that the first data packet is the first data packet received by the encryption / decryption device 100, the second data packet is the next data packet after the first data packet, and the encryption / decryption device receives the first data packet and the second data packet consecutively.

[0113] After the encryption / decryption device 100 is activated, the computer device 101 sends a first data packet to the encryption / decryption device 100. Since there is no data in either the first buffer unit 131 or the second buffer unit 132, the first control unit 114 sends a second prompt message to the second control unit 111. Accordingly, the second control unit 111 receives the second prompt message. Based on the second prompt message, the second control unit 111 receives the first data packet.

[0114] After receiving the first data packet, the second control unit 111 acquires the first feature information of the first data packet, determines the key index information corresponding to the first data packet based on the first feature information and the key correspondence, and then sends the key index information corresponding to the first data packet to the key query unit 112. Accordingly, the key query unit 112 receives the key index information corresponding to the first data packet.

[0115] After receiving the key index information corresponding to the first data packet, the key query unit 112 obtains the key corresponding to the first data packet based on the key index information, and then sends the key corresponding to the first data packet to the key expansion unit 113. Accordingly, the key expansion unit 113 receives the key corresponding to the first data packet.

[0116] After receiving the data, the key expansion unit 113 expands the key corresponding to the first data packet using a key expansion algorithm to obtain a first expanded key, and sends the first expanded key to the first control unit 114. Correspondingly, the first control unit 114 receives the first expanded key.

[0117] After receiving the first extended key, the first control unit 114 stores the first extended key in the first cache unit 131, since it is the first time the extended key is stored in the cache module 13.

[0118] In the initial encryption or decryption operation, the AES algorithm module 12 is in an idle state. The second control unit 111 can directly send the first data packet to the AES algorithm module 12 after receiving it. However, since the first extended key is not yet present in the cache module, the AES algorithm module cannot encrypt or decrypt the first data packet after receiving it. It needs to continuously check whether data exists in the first cache unit. If data is found in the first cache unit, the first extended key can be obtained from the first cache unit and the operation can be performed.

[0119] After the first extended key is stored in the first cache unit 131, there are still cache units (second cache unit 132) in the cache module 13 that have not stored data. Therefore, the first control unit 114 continues to send the second prompt information to the second control unit 111.

[0120] Based on the second prompt information, the second control unit 111 receives the second data packet, and then repeats the above-described process of generating the first extended key for the second data packet to generate the second extended key and stores the second extended key in the second cache unit 132. In implementation, it is only necessary to replace the first data packet with the second data packet and the first extended key with the second extended key.

[0121] During the process of generating the second extended key and storing the second extended key in the second cache unit 132, the AES algorithm module 12 is also performing encryption or decryption operations on the first data packet based on the first extended key.

[0122] After the AES algorithm module 12 completes the encryption or decryption operation on the first data packet, the AES algorithm module 12 sends the first prompt information to the first control unit 114 and the second control unit 111 respectively.

[0123] Based on the first prompt information, the first control unit 114 erases the first cache unit 131, and the second control unit 111 sends the second data packet to the AES algorithm module 12.

[0124] After the first cache unit 131 is erased, at least one cache unit in the cache module 13 remains unstored (i.e., the first cache unit 131). Therefore, the first control unit 114 sends a second prompt message to the second control unit 111. If the computer device 101 sends a third data packet to the encryption / decryption device 100 at this time, the second control unit 111 receives the third data packet and executes the process executed for the second data packet. If there is no third data packet, the second control unit remains idle until the computer device 101 sends the third data packet to the second control unit, after which it executes the process executed for the second data packet.

[0125] The AES algorithm module 12 receives the second data packet, obtains the second extended key from the second buffer unit 132, and encrypts or decrypts the second data packet based on the second extended key.

[0126] The following are method embodiments of this application. For details not described in detail in the method embodiments, please refer to the above device embodiments.

[0127] Figure 4 A flowchart illustrating an encryption / decryption method provided in an exemplary embodiment of this disclosure is shown. This method can be executed by the aforementioned encryption / decryption apparatus, for example, by the control module within the aforementioned encryption / decryption apparatus. See also... Figure 4 The method includes:

[0128] In step 401, the second data packet is received while the AES algorithm module is encrypting or decrypting the first data packet using the first extended key.

[0129] In step 402, the key corresponding to the second data packet is obtained based on the second data packet.

[0130] Optionally, step 402 includes the following three steps:

[0131] The first step is to obtain the first characteristic information of the second data packet.

[0132] The second step is to determine the key index information of the second data packet based on the key correspondence and the first feature information of the second data packet.

[0133] The key correspondence is the correspondence between the first feature information and the key index information. The key index information of the second data packet is used to indicate the storage address of the corresponding key of the second data packet.

[0134] The third step is to obtain the key corresponding to the second data packet based on the key index information of the second data packet.

[0135] In step 403, a second extended key is generated based on the key corresponding to the second data packet.

[0136] In step 404, the second extended key is stored in the second cache unit.

[0137] In step 405, after the first data packet is encrypted or decrypted, the second data packet is sent to the AES algorithm module.

[0138] Optionally, the method further includes: receiving a first prompt message, the first prompt message being used to indicate that the encryption or decryption of the first data packet is complete; and in response to the first prompt message, erasing the first extended key in the first buffer unit.

[0139] Optionally, the method further includes: sending a second data packet to the AES algorithm module in response to the first prompt message.

[0140] Optionally, the method further includes receiving a second data packet if the second buffer unit does not store data.

[0141] Optionally, the method further includes: receiving a third data packet while the AES algorithm module is encrypting or decrypting the second data packet using the second extended key; after erasing the first extended key in the first buffer unit, obtaining the key corresponding to the third data packet based on the third data packet; generating a third extended key based on the key corresponding to the third data packet, the third extended key being used to encrypt or decrypt the third data packet; storing the third extended key in the first buffer unit; and sending the third data packet to the AES algorithm module after the second data packet is encrypted or decrypted.

[0142] The encryption / decryption methods and encryption / decryption devices provided in the above embodiments belong to the same concept. For details of their implementation, please refer to the device embodiments, which will not be repeated here.

[0143] The above description is merely an optional embodiment of this disclosure and is not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the protection scope of this disclosure.

Claims

1. An encryption / decryption device, characterized in that, The encryption / decryption device includes: a cache module, a control module, and an Advanced Encryption Standard (AES) algorithm module; The caching module includes a first caching unit and a second caching unit. The first caching unit stores a first extended key, which is used to encrypt or decrypt the first data packet. The control module is connected to the cache module and the AES algorithm module respectively. The control module is configured to receive a second data packet, obtain the key corresponding to the second data packet, generate a second extended key based on the key corresponding to the second data packet, store the second extended key in the second cache unit, and send the second data packet to the AES algorithm module during the process of the AES algorithm module encrypting or decrypting the first data packet using the first extended key. The AES algorithm module is connected to the cache module. The AES algorithm module is configured to receive the second data packet sent by the control module after encrypting or decrypting the first data packet using the first extended key, obtain the second extended key from the second cache unit, and encrypt or decrypt the second data packet using the second extended key. The control module is further configured to receive a third data packet during the process of the AES algorithm module encrypting or decrypting the second data packet using the second extended key, and after erasing the first extended key in the first cache unit, obtain the key corresponding to the third data packet based on the third data packet, generate a third extended key based on the key corresponding to the third data packet, store the third extended key in the first cache unit, and send the third data packet to the AES algorithm module, wherein the third extended key is used to encrypt or decrypt the third data packet. The AES algorithm module is further configured to receive the third data packet sent by the control module after the second data packet is encrypted or decrypted, obtain the third extended key from the first cache unit, and encrypt or decrypt the third data packet using the third extended key; The first extended key and the second extended key include the round keys required for each round; The size of the first cache unit is equal to the size of the second cache unit, and the size of the second cache unit is equal to the size of the second extended key; both the first cache unit and the second cache unit can store one extended key, and the cache module can store two extended keys simultaneously; the extended key stored in one cache unit can be used by the AES algorithm module to encrypt or decrypt the current data packet, and the extended key stored in the other cache unit can be used by the AES algorithm module to encrypt or decrypt the next data packet; The control module is further configured to store the extended key corresponding to the data packet in the first cache unit and the second cache unit in turn, and the AES algorithm module is further configured to obtain the required extended key from the first cache unit and the second cache unit in turn; the time for the control module to generate the extended key is less than the time for the AES algorithm module to encrypt or decrypt the data packet based on the extended key; The control module is also configured to receive the second data packet when the second buffer unit does not store data; The control module is further configured to determine whether the second cache unit is not storing data by: obtaining the empty / full flag of the second cache unit, the empty / full flag being used to indicate whether the second cache unit is full of data; and determining whether the second cache unit is not storing data based on the empty / full flag of the second cache unit.

2. The encryption / decryption device according to claim 1, characterized in that, The control module is configured to obtain the key corresponding to the second data packet in the following manner: Obtain the first feature information of the second data packet; The key index information of the second data packet is determined based on the key correspondence and the first feature information of the second data packet. The key correspondence is the correspondence between the first feature information and the key index information. The key index information of the second data packet is used to indicate the storage address of the corresponding key of the second data packet. Based on the key index information of the second data packet, the key corresponding to the second data packet is obtained.

3. The encryption / decryption device according to any one of claims 1 to 2, characterized in that, The AES algorithm module is also configured to send a first prompt message to the control module after the first data packet is encrypted or decrypted, the first prompt message being used to indicate that the encryption or decryption of the first data packet is complete; The control module is also configured to receive the first prompt information and, in response to the first prompt information, erase the first extended key in the first cache unit.

4. The encryption / decryption device according to claim 3, characterized in that, The control module is also configured to send the second data packet to the AES algorithm module in response to the first prompt information.

5. An encryption / decryption method, characterized in that, The method includes: Obtain the empty / full flag of the second cache unit, which is used to indicate whether the second cache unit is full of data; Based on the empty / full flag of the second cache unit, determine whether the second cache unit is not storing data; During the process of encrypting or decrypting the first data packet using the first extended key in the AES algorithm module, the second data packet is received when the second buffer unit does not store data. Based on the second data packet, obtain the key corresponding to the second data packet; A second extended key is generated based on the key corresponding to the second data packet; The second extended key is stored in the second cache unit; the size of the second cache unit is equal to the size of the first cache unit, and the size of the second cache unit is equal to the size of the second extended key; the first cache unit and the second cache unit are located in a cache module; each of the first cache unit and the second cache unit can store one extended key, and the cache module can store two extended keys simultaneously; the extended key stored in one cache unit can be used by the AES algorithm module to encrypt or decrypt the current data packet, and the extended key stored in the other cache unit can be used by the AES algorithm module to encrypt or decrypt the next data packet; the extended key corresponding to the data packet is stored alternately in the first cache unit and the second cache unit, and the AES algorithm module is also configured to obtain the required extended key alternately from the first cache unit and the second cache unit; the time to generate the extended key is less than the time the AES algorithm module takes to encrypt or decrypt the data packet based on the extended key; After the first data packet is encrypted or decrypted, the second data packet is sent to the AES algorithm module; During the process of the AES algorithm module encrypting or decrypting the second data packet using the second extended key, a third data packet is received; After erasing the first extended key in the first cache unit, the key corresponding to the third data packet is obtained based on the third data packet; A third extended key is generated based on the key corresponding to the third data packet; The third extended key is stored in the first cache unit; The third data packet is sent to the AES algorithm module, and the third extended key is used to encrypt or decrypt the third data packet.

6. The method according to claim 5, characterized in that, The step of obtaining the key corresponding to the second data packet based on the second data packet includes: Obtain the first feature information of the second data packet; The key index information of the second data packet is determined based on the key correspondence and the first feature information of the second data packet. The key correspondence is the correspondence between the first feature information and the key index information. The key index information of the second data packet is used to indicate the storage address of the corresponding key of the second data packet. Based on the key index information of the second data packet, the key corresponding to the second data packet is obtained.

7. The method according to claim 5 or 6, characterized in that, The method further includes: Receive a first prompt message, which indicates that the encryption or decryption of the first data packet is complete; In response to the first prompt message, the first extended key in the first cache unit is erased.

Images