SM4 encryption method based on FPGA

Abstract

The invention discloses an SM4 encryption method based on an FPGA, and relates to the technical field of data encryption, and the method comprises the steps: obtaining to-be-encrypted plaintext data; a plurality of SM4 encryption cores are configured on the FPGA chip to perform parallel encryption operation on plaintext data to be encrypted; wherein each SM4 encryption core adopts a pipeline architecture, and the pipeline architecture comprises an access device, a round function arithmetic unit and a key adder; an extraction circuit based on physical noise and integrated on the FPGA chip is utilized to generate N-bit random numbers as encryption keys of each SM4 encryption core; handshake signals are collected to calculate the operation efficiency of each SM4 encryption core; adjusting FPGA resource allocation among the SM4 encryption cores by adopting a priority scheduling algorithm according to the operation efficiency; in the encryption operation process, power consumption equalization is carried out by adopting polynomial and logical operation hybrid calculation, and time sequence randomization is carried out by adopting a random waiting period. Aiming at the problem of weak anti-difference sensitivity in the prior art, the side channel attack resistance is improved.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to an SM4 encryption method based on FPGA. Background Art

[0002] With the rapid development of information technology and the widespread popularity of network applications, data security issues have become increasingly prominent. In various information systems and network platforms, protecting key data and user privacy from illegal access and malicious attacks has become an important and urgent task. Cryptography technology, as the core means to ensure information security, plays a key role in data encryption and identity authentication. The SM4 algorithm uses a 128-bit key to encrypt data, has high security strength and good performance, and can effectively resist a variety of conventional cryptographic attacks. However, the SM4 algorithm still faces the threat of side-channel attacks during implementation.

[0003] Side channel attacks are an attack method based on the physical implementation information of cryptographic devices. By analyzing the power consumption, electromagnetic radiation, execution time and other side channel information of cryptographic devices during operation, the key can be inferred or the ciphertext can be cracked. Common side channel attacks include power analysis attacks, electromagnetic analysis attacks, time analysis attacks, etc. These attacks take advantage of the correlation between the physical characteristics and the key in the practice of cryptographic algorithms. Through statistical analysis and related calculations, the key or plaintext information can be restored, thereby destroying the security of SM4 encryption.

[0004] The existing hardware implementation schemes of the SM4 algorithm mainly use devices such as ASIC (Application Specific Integrated Circuit) and FPGA (Field Programmable Gate Array). Although these schemes can provide high encryption performance, they still have some shortcomings in resisting side-channel attacks. First, most of the existing schemes use fixed encryption structures and operation methods, which lack flexibility and randomness and are easily analyzed and predicted by attackers. Secondly, the operation timing and energy consumption in the encryption process are relatively regular, and there is a certain correlation between them and the key, which may leak key information. In addition, due to the limitations of hardware resources and costs, it is difficult for existing schemes to implement complex anti-side-channel attack measures, and the ability to resist advanced attacks is limited. Summary of the invention

[0005] In response to the problem of limited ability to resist side-channel attacks in SM4 algorithm encryption in the prior art, the present application provides an SM4 encryption method based on FPGA, which performs parallel encryption operations on plaintext data through multiple SM4 encryption cores of a pipeline architecture, thereby improving the ability to resist side-channel attacks.

[0006] The purpose of this application is achieved through the following technical solutions.

[0007] The present application provides an SM4 encryption method based on FPGA, which realizes parallel operation of multiple SM4 encryption cores on FPGA chip, including: input of plaintext data: adopt high-speed IO interface of FPGA, such as LVDS, SerDes, etc., to realize high-speed input of plaintext data. Design data input buffer, which is used to temporarily store input plaintext data, and balance the difference between data input rate and encryption core processing rate. Use data distribution circuit to distribute input plaintext data to each SM4 encryption core to realize parallel processing of data. Multi-core parallel encryption: According to the resource situation of FPGA chip, such as lookup table (LUT), trigger (FF), block RAM (BRAM), etc., determine the number of SM4 encryption cores that can be realized. Use modular design method to design SM4 encryption core as independent functional module, which is convenient for copying and instantiation. Use parallel control circuit to synchronously coordinate the operation status of each SM4 encryption core to realize parallel encryption processing.

[0008] Pipeline architecture: Split the round function of the SM4 encryption algorithm into multiple sub-functions, such as nonlinear transformation, linear transformation, etc., to achieve fine-grained pipeline design. Use multi-level pipeline registers to insert pipeline registers between the counter, round function operator and key adder to improve the parallelism of data processing. Optimize the scheduling and control logic of the pipeline, minimize the data dependency and conflict between pipeline stages, and improve the efficiency of the pipeline. Random key generation: Integrate physical noise sources such as resistor thermal noise sources and ring oscillators on the FPGA chip to generate random noise signals. Design a random number extraction circuit to sample, quantize and post-process the analog noise signal generated by the physical noise source to extract a random bit sequence. Use cryptographically secure random number post-processing algorithms, such as Von Neumann correction and XOR mixing, to improve the statistical characteristics and unpredictability of random numbers.

[0009] Handshake signal acquisition: Set handshake signal lines between each stage of the pipeline to indicate the validity of data and the completion of processing. Use asynchronous handshake protocols, such as request-response protocols, to achieve reliable communication and synchronization between pipeline stages. Design handshake signal acquisition circuits to monitor the state changes of handshake signals in real time and record the timestamp and duration of handshake signals. Operational efficiency evaluation: Design efficiency evaluation circuits to calculate the operation time and data throughput of each stage of the pipeline based on the collected handshake signal information. Use weighted average algorithm to comprehensively consider the operation time and data throughput of each stage of the pipeline to obtain a comprehensive operation efficiency index. Use threshold comparison and sorting algorithms to evaluate and sort the operation efficiency of each SM4 encryption core. Dynamic resource scheduling: Design resource scheduling controllers to dynamically adjust the allocation of FPGA resources between each SM4 encryption core based on the results of operation efficiency evaluation. Use priority scheduling algorithms, such as efficiency-based priority scheduling and fairness-based round-robin scheduling, to achieve dynamic resource allocation. By configuring the reconfigurable logic unit of the FPGA, the number and position of the SM4 encryption cores can be dynamically changed to adapt to different task requirements and resource constraints.

[0010] Specifically, after completing a round of encryption operations, each SM4 encryption core packages the operation efficiency data and sends it to the central controller through a dedicated efficiency data channel. The operation efficiency data includes key information such as the number of the SM4 encryption core, operation time, and resource utilization. After receiving the operation efficiency data, the central controller parses and stores the data for subsequent priority scheduling. The central controller prioritizes each SM4 encryption core based on the collected operation efficiency data. The sorting algorithm can adopt hierarchical sorting based on efficiency thresholds or weighted scoring sorting, and selects a suitable algorithm according to actual needs. The sorting result generates a priority list, and the SM4 encryption cores are arranged from high to low according to the operation efficiency. The central controller generates resource allocation control instructions based on the priority list. For the SM4 encryption core with the highest operation efficiency, a resource priority guarantee instruction is generated to ensure that it obtains the best resource support. For the SM4 encryption core with the second highest operation efficiency, a resource enhancement instruction is generated to allocate more FPGA resources to it through dynamic partial reconstruction technology. For the SM4 encryption core with lower operation efficiency, a resource recovery instruction is generated to recover part of its FPGA resources through dynamic partial reconstruction technology.

[0011] For SM4 encryption cores with extremely low or abnormal computing efficiency, resource suspension instructions are generated, and their operation is suspended through gating technology to release resources. The central controller packages the generated resource allocation control instructions and distributes them to each SM4 encryption core through a dedicated control instruction channel. After receiving the resource allocation control instruction, each SM4 encryption core performs the corresponding resource adjustment operation according to the instruction type. For resource priority guarantee instructions, the SM4 encryption core maintains the current resource configuration and continues to operate efficiently. For resource enhancement instructions, the SM4 encryption core uses dynamic partial reconstruction technology to load new encryption modules in the idle area of ​​the FPGA chip to expand parallelism and throughput. For resource recovery instructions, the SM4 encryption core uses dynamic partial reconstruction technology to unload some encryption modules, release FPGA resources, and report the released resource information to the central controller. For resource suspension instructions, the SM4 encryption core uses gating technology to suspend the clock signal, enter a low-power state, and report the suspension state to the central controller. After receiving the resource information released by the SM4 encryption core, the central controller includes these resources in the allocatable resource pool. According to the priority list and the allocatable resource pool, the central controller reallocates resources. Prioritize the allocation of released resources to the SM4 encryption core with higher computing efficiency to improve its parallelism and throughput. Through dynamic partial reconstruction technology, new encryption modules are loaded into the SM4 encryption core that has obtained resource support.

[0012] Hybrid operation mode: Design polynomial operation circuits to implement polynomial addition, multiplication and other operations, and introduce nonlinear transformations. Use a random number generator to randomly select polynomial operations or logical operations during encryption operations to increase the uncertainty of operations. By dynamically adjusting the coefficients and orders of the polynomials, the complexity of polynomial operations is changed to increase the difficulty of power analysis attacks. Random operation timing: Design random delay circuits to insert random delay units, such as LUT lookup tables, triggers, etc., on the critical path of encryption operations. Use a pseudo-random number generator to control the insertion position and duration of random delays and introduce temporal randomness. By dynamically adjusting the parameters of random delays, such as delay granularity and delay probability, it can adapt to different security needs and performance requirements.

[0013] Furthermore, the SM4 encryption IP core is written in hardware description language: Verilog HDL or VHDL hardware description language is used to write the RTL (Register Transfer Level) level description code of the SM4 encryption IP core according to the specifications and processes of the SM4 encryption algorithm. In the RTL level description, the input and output interfaces, data bit width, number of encryption rounds and other parameters of the SM4 encryption are defined, and various functional modules of the SM4 encryption, such as round key generation, nonlinear transformation, linear transformation, etc., are implemented through sequential logic and combinational logic circuits. Using a structured design method, the SM4 encryption IP core is divided into multiple sub-modules to improve the readability and maintainability of the code. Through simulation testing and verification, it is ensured that the RTL level description of the SM4 encryption IP core meets the functional and performance requirements of the SM4 encryption algorithm.

[0014] Generate a logic gate-level netlist through logic synthesis: Input the RTL-level description code of the SM4 encrypted IP core into the logic synthesis tool, such as Synopsys Design Compiler, Cadence RTL Compiler, etc. In the logic synthesis tool, set the technology library and constraint file of the target FPGA device, and specify design indicators such as timing constraints and area constraints. Run the logic synthesis tool to perform logic optimization and mapping on the RTL-level description of the SM4 encrypted IP core, and convert the RTL-level description into a logic gate-level netlist. The logic gate-level netlist consists of basic logic units (such as AND gates, OR gates, NOT gates, triggers, etc.), which describes the logical functions and connection relationships of the SM4 encrypted IP core. Perform functional verification and timing analysis on the generated logic gate-level netlist to ensure that the synthesized circuit is consistent with the original RTL-level description function and meets the timing constraints.

[0015] Mapping layout and routing to FPGA physical resources: Input the logic gate-level netlist file of the SM4 encrypted IP core into the FPGA layout and routing tool, such as Xilinx Vivado, Intel Quartus Prime, etc. In the layout and routing tool, select the target FPGA device model and set physical constraints such as pin constraints and timing constraints. Run the layout and routing tool to map the logic units of the SM4 encrypted IP core to the physical resources of the FPGA device, such as lookup tables (LUTs) and flip-flops (FFs). The layout and routing tool uses heuristic algorithms and optimization strategies to layout and route the mapped physical resources, determine the location and connection method of the physical resources, and generate the bitstream file after layout and routing. Perform timing analysis and power analysis on the circuit after layout and routing to verify whether the timing performance and power consumption characteristics of the circuit meet the design requirements.

[0016] Clock tree balance and asynchronous reset: Before FPGA layout and routing, the clock tree on the FPGA chip is balanced and optimized to ensure that the clock arrival time of each physical resource of the SM4 encryption IP core is consistent and reduce clock skew and jitter. Clock tree synthesis (CTS) technology is used to automatically generate a balanced clock tree structure, insert clock buffers and delay units, and adjust the propagation path and drive strength of the clock signal. In the top-level module of the SM4 encryption IP core, an asynchronous reset signal is added to put the SM4 encryption IP core in a preset initial state. The asynchronous reset signal is connected to the key registers of the SM4 encryption IP core. When the reset signal is valid, the registers are cleared or set to preset values ​​to ensure that the SM4 encryption IP core starts working from a known state.

[0017] Port mapping connection constitutes the SM4 encryption core: the SM4 encryption IP core after layout and routing is connected to the physical resources of the FPGA chip through port mapping to form a complete SM4 encryption core. In the top-level design file of the FPGA device, multiple SM4 encryption IP cores are instantiated, and their input and output ports are connected to the physical pins or internal interconnection resources of the FPGA. Through port mapping, the data input, key input, encryption enable, reset and other control signals of the SM4 encryption IP core are connected to the corresponding ports of the FPGA. At the same time, the data output of the SM4 encryption IP core is connected to the output port of the FPGA or the input port of the next-level module to form a complete data encryption path.

[0018] Multiple SM4 encryption cores are instantiated and connected in parallel to form a parallel SM4 encryption array, which improves the overall encryption efficiency and throughput. Multiple SM4 encryption cores are configured and implemented on the FPGA chip, covering the complete design process from high-level language description to physical resource mapping. By utilizing the reconfigurable characteristics and parallel processing capabilities of FPGA, efficient SM4 encryption hardware acceleration is achieved to meet the encryption requirements of high throughput and low latency. At the same time, the reliability and stability of the SM4 encryption core are guaranteed through technical means such as clock tree balancing and asynchronous reset, providing a solid hardware foundation for secure and reliable data encryption.

[0019] Further, the selection and application of logic synthesis tools and layout and routing synthesis tools, the selection of logic synthesis tools: select at least one logic synthesis tool from Synopsys Design Compiler, Cadence RTL Compiler and Mentor Graphics Precision to convert the RTL-level description of the SM4 encrypted IP core into a logic gate-level netlist. Synopsys Design Compiler: A logic synthesis tool widely used in the industry, providing high-quality synthesis results and optimization capabilities. Supports multiple hardware description languages, such as Verilog, VHDL and SystemVerilog. Provides a wealth of constraint setting options, such as timing constraints, area constraints, power constraints, etc., which can be optimized according to design requirements. Integrated functions such as design rule checking (DRC) and layout and routing estimation (Floorplanning) help to discover design problems early.

[0020] Cadence RTL Compiler: A logic synthesis tool from Cadence that is seamlessly integrated with Cadence's digital IC design flow. It uses leading synthesis algorithms and optimization strategies to generate high-quality logic gate-level netlists. It supports multiple hardware description languages ​​and mixed language designs, and provides flexible design input methods. It provides comprehensive design constraint management and design space exploration functions to help designers quickly converge designs. Mentor Graphics Precision: A logic synthesis tool from Mentor Graphics (now Siemens EDA), which is widely used in FPGA and ASIC design. It uses mature synthesis engines and optimization technologies to generate area-optimized and performance-optimized logic gate-level netlists. It supports multiple hardware description languages ​​and provides flexible design input and constraint setting options. It integrates functional verification and timing analysis functions to ensure the correctness and performance of the synthesized circuit. Selection of layout and routing synthesis tools: Select at least one layout and routing synthesis tool from Xilinx Vivado, Intel Quartus, and Lattice Diamond to map the logic gate-level netlist of the SM4 encrypted IP core to the physical resources of the FPGA device and complete the layout and routing.

[0021] Xilinx Vivado: Xilinx's FPGA design suite supports the design and implementation of Xilinx's full range of FPGA devices. It provides integrated synthesis, placement and routing, and verification tools to achieve a complete design process from RTL-level description to bitstream generation. It uses advanced placement and routing algorithms and optimization strategies, such as clock tree synthesis and congestion-aware placement, to generate high-quality placement and routing results. It provides a wealth of design constraints and optimization options, such as timing constraints, pin constraints, power optimization, etc., to meet different design requirements. Intel Quartus: Intel (formerly Altera)'s FPGA design suite supports the design and implementation of Intel FPGA devices. It provides a complete design process, including synthesis, placement and routing, timing analysis, and power analysis. It uses an intelligent placement and routing engine and optimization algorithms to automatically complete the mapping and interconnection of physical resources and generate efficient placement and routing results. It provides a wealth of design constraints and optimization options, such as timing optimization, logic optimization, power optimization, etc., to meet high-performance and low-power design requirements. Lattice Diamond: Lattice Semiconductor's FPGA design suite supports the design and implementation of Lattice FPGA devices. Provides an integrated design environment, including synthesis, placement and routing, simulation and debugging tools. Adopts optimized placement and routing algorithms and strategies to automatically complete the mapping and routing of logic units, generating compact and efficient placement and routing results. Provides flexible design constraints and optimization options, such as timing constraints, pin constraints, power optimization, etc., to meet different design requirements.

[0022] Application process of logic synthesis tools and layout and routing synthesis tools: In the selected logic synthesis tool, take the RTL level description of the SM4 encrypted IP core as input, set appropriate design constraints and optimization options, run the synthesis process, and generate a logic gate-level netlist. Perform functional verification and timing analysis on the generated logic gate-level netlist to ensure that the correctness and performance of the synthesized circuit meet the requirements. Import the synthesized logic gate-level netlist into the selected layout and routing synthesis tool, set the target FPGA device model and physical constraints, such as pin allocation, clock constraints, etc. In the layout and routing synthesis tool, run the layout and routing process to map the logic gate-level netlist to the physical resources of the FPGA device, such as lookup tables (LUTs), flip-flops (FFs), etc., and complete the layout and routing of the physical resources. Perform timing analysis, power analysis, and design rule checking on the circuit after layout and routing to verify whether the performance, power consumption, and manufacturability of the circuit meet the design requirements. If the verification results meet the requirements, generate the final FPGA bitstream file for the configuration and implementation of the FPGA device. By selecting appropriate logic synthesis tools and layout and routing synthesis tools, and following standard design processes, the SM4 encryption IP core can be efficiently implemented on FPGAs. These tools provide powerful synthesis, optimization, and layout and routing functions to help designers quickly and reliably map the SM4 encryption algorithm to the FPGA hardware platform to achieve high-performance, low-power encryption operations. At the same time, through reasonable design constraints and optimization strategies, the parallel processing capabilities and hardware acceleration advantages of FPGA devices can be fully utilized to meet the encryption requirements of high throughput and low latency.

[0023] Furthermore, the design of the counter, round function operator and key adder in the pipeline architecture is that the counter adopts an architecture that supports variable-length group counter, and divides the input plaintext data to be encrypted into groups according to the group length of the SM4 encryption algorithm, divides the plaintext data into multiple data groups of equal length, and outputs the divided data groups in sequence to the next level of the pipeline; the round function operator adopts a programmable architecture that supports dynamic configuration of the number of encryption rounds, sets the number of SM4 encryption rounds through configurable registers, controls the number of round function operations according to the configured number of rounds, performs nonlinear and linear transformations on the input data groups in each round of round function operations, and outputs the round function operation results to the next level of the pipeline; the key adder adopts an architecture that supports key group division and group key prediction, divides the input encryption key into multiple key groups, expands the key groups by table lookup, predicts the next key group based on the current key group, and performs an XOR operation on the round function operation result and the predicted key group to generate the encryption result of the current number of rounds.

[0024] Furthermore, the data accessor includes a packet storage area: the packet storage area is a storage unit for caching plaintext data packets to be accessed. According to the packet length (128 bits) of the SM4 encryption algorithm, the bit width of the packet storage area is set to 128 bits in order to store a complete plaintext data packet. The depth of the packet storage area is appropriately set according to the design requirements and throughput requirements to meet the needs of data caching and reading. The packet storage area is implemented using a dual-port RAM (DPRAM), one port is used to write plaintext data packets, and the other port is used to read plaintext data packets. Circular buffer: The circular buffer uses a linked list structure to manage plaintext data packets, and data caching and reading are achieved through the insertion and deletion operations of the linked list. The linked list structure contains multiple linked list nodes, each of which is used to record the starting address and packet length of a plaintext data packet.

[0025] The data structure of the linked list node is as follows:

[0026] struct ListNode{uint32_t startAddr; / / Starting address of plaintext data packet

[0027] uint32_t length; / / Length of the plaintext data packet

[0028] ListNode*next; / / Pointer to the next linked list node};

[0029] The head pointer (head) of the linked list points to the first node in the linked list, which is used to identify the starting position of the linked list. The linked list operation interface provides management operations for inserting and deleting linked lists, including: insertNode(ListNode*node): insert a new linked list node into the end of the linked list. deleteNode(ListNode*node): delete the specified linked list node from the linked list. The circular buffer is implemented using SRAM or distributed RAM (DRAM), and stores and reads plaintext data packets according to the starting address and packet length recorded in the linked list node. Data acquisition controller: The data acquisition controller traverses the linked list through the linked list operation interface according to the packet length of the SM4 encryption algorithm, and reads the plaintext data packets recorded in the linked list one by one.

[0030] The workflow of the data acquisition controller is as follows: Initialize the linked list head pointer (head) to be empty. When a new plaintext data packet arrives, insert the new linked list node into the tail of the linked list through the linked list operation interface insertNode(). According to the packet length of the SM4 encryption algorithm, traverse the linked list through the linked list operation interface, and read the plaintext data packets recorded by the linked list nodes in turn. For each plaintext data packet read, read the corresponding data from the circular buffer according to the starting address and packet length recorded by the linked list node. After reading a plaintext data packet, delete the corresponding linked list node through the linked list operation interface deleteNode() to read the data of the variable-length packet. Repeat until the linked list is empty, indicating that all plaintext data packets have been read. The data acquisition controller manages the caching and reading of plaintext data packets in the circular buffer by controlling the write pointer and read pointer of the circular buffer. The write pointer (writePtr) points to the next writable position in the circular buffer. The read pointer (readPtr) points to the next position to be read in the circular buffer. When the write pointer catches up with the read pointer, it means that the circular buffer is full and you need to wait for the read pointer to advance before you can continue to write new data packets. When the read pointer catches up with the write pointer, it means that the circular buffer is empty and you need to wait for the write pointer to write new data packets before you can continue to read.

[0031] Further, the round function operator includes: a round configuration register: the round configuration register is used to store the round configuration value of the SM4 encryption algorithm, and is set according to security and performance requirements. The bit width of the round configuration register is designed according to the maximum number of rounds of the SM4 encryption algorithm. For example, a 6-bit register can support a maximum of 64 rounds of encryption operations. The round configuration register can be configured by software or hardware, and a suitable configuration interface is selected according to actual needs. Round function operation module: the round function operator includes multiple round function operation modules, each of which is used to perform a round of encryption operation of the SM4 encryption algorithm. The input of each round function operation module is a data group (128 bits) and a corresponding round key, and the output is an encrypted data group (128 bits). The round function operation module internally includes two submodules: nonlinear transformation and linear transformation. The nonlinear transformation submodule performs an S-box (Substitution Box) substitution operation on the input data group to achieve a byte-level nonlinear transformation. The S-box can be implemented using a lookup table (LUT) or a combinational logic circuit. The linear transformation submodule performs a linear transformation on the result after the S-box substitution, including a circular left shift and an XOR operation. Linear transformation can be realized by using shift register and XOR gate circuit. The output of round function operation module is XORed with the corresponding round key to obtain the encryption result of the current round.

[0032] Round function selector: The input end of the round function selector is connected to the output of each round function operation module, and the output end is connected to the next level of the pipeline. The round function selector selects the output of the round function operation module of the corresponding round number to the next level of the pipeline according to the value of the round number configuration register. The round function selector can be implemented using a multiplexer (MUX) or a data selector (Data Selector), and the selection signal is controlled according to the round number configuration value. Round key generation module: The round key generation module generates the round key of each round according to the input initial key through the key expansion algorithm of the SM4 encryption algorithm. The key expansion algorithm includes the following steps: the initial key is divided into 4 subkeys (each subkey is 32 bits). Each subkey is subjected to cyclic left shift and S box replacement operations to generate the expanded subkey. The expanded subkey is XORed with the fixed parameter to obtain the round key. Repeat the generation of round keys for all rounds. The round key generation module provides the generated round key to the corresponding round function operation module for encryption operation. The round key generation module can use a lookup table (LUT) or a combinational logic circuit to implement a key expansion algorithm, and generate a corresponding round key according to the initial key and the number of rounds.

[0033] Round function controller: The round function controller controls the transfer of data packets between various levels of pipeline modules according to the process of the SM4 encryption algorithm, controls the round function selector to switch the round function, controls the round key generation module to provide the round key, and performs multi-round encryption operations of the SM4 encryption algorithm. The workflow of the round function controller is as follows: Receive data packets from the previous level of the pipeline and pass them to the first round function operation module. According to the value of the round number configuration register, control the round function selector to select the output of the round function operation module of the corresponding round number to the next level of the pipeline. Control the round key generation module to generate the round key of the corresponding round number and provide it to the corresponding round function operation module. Wait for the encryption operation of the current round to be completed, and pass the encryption result to the next level of the pipeline. Repeat until all rounds of encryption operations are completed. The round function controller can be implemented using a finite state machine (FSM) to control the transfer of data packets, round function selection and round key generation according to the round number configuration and the process of the SM4 encryption algorithm.

[0034] Furthermore, the key adder includes: a key grouping cache module: the key grouping cache module is used to cache the key used by the SM4 encryption algorithm, and divide the input initial key into 4 subkeys for caching. The input of the key grouping cache module is a 128-bit initial key, and the output is 4 32-bit subkeys. The key grouping cache module is implemented using a register or distributed RAM (DRAM), and according to the positional relationship of the initial key, it is divided into 4 subkeys and stored in the corresponding register or DRAM. The storage order of the subkeys can be adjusted according to the requirements of the SM4 encryption algorithm to facilitate subsequent key expansion operations.

[0035] Key expansion module: The key expansion module expands the subkey output by the key group cache module by table lookup, and randomly permutes the data bits of the expanded subkey to generate the round key for the current encryption round. The input of the key expansion module is 4 32-bit subkeys, and the output is a 32-bit round key. The key expansion module uses a lookup table (LUT) to implement the key expansion operation of the SM4 encryption algorithm, and obtains the corresponding expansion result by looking up the table according to the value of the subkey. The lookup table can be implemented using ROM or combinational logic circuits, and the corresponding lookup table content is generated according to the key expansion rules of the SM4 encryption algorithm. The data bits of the expanded subkey are randomly permuted to increase the randomness and security of the key. The data bit permutation operation can be implemented using a pseudo-random number generator (PRNG) or a fixed permutation pattern. The permuted expanded subkey is used as the round key of the current encryption round, and is used for XOR operation with the output result of the round function operator.

[0036] Key XOR module: The key XOR module performs a bitwise XOR operation on the intermediate result output by the round function operator and the round key generated by the key expansion module to obtain the output result of the current encryption round. The input of the key XOR module is the 32-bit intermediate result output by the round function operator and the 32-bit round key generated by the key expansion module, and the output is a 32-bit XOR result. The key XOR module uses XOR gate circuits to implement bitwise XOR operations, performs XOR operations on each bit of the intermediate result and the round key, and obtains an XOR result. The XOR result is the output result of the current encryption round and is passed to the next round through the pipeline for subsequent encryption operations.

[0037] Key controller: According to the round number configuration of the SM4 encryption algorithm, the key controller triggers the key expansion module to generate round keys in each encryption round, controls the key XOR module to perform round key XOR, and passes the XOR result to the next round through the pipeline. The key controller is implemented by a finite state machine (FSM). According to the current round and the number of SM4 encryption rounds, it determines whether the key expansion and key XOR are completed. The workflow of the key controller is as follows: Initialize the round counter to 0, indicating that it is currently in the first encryption round. Trigger the key expansion module to generate the corresponding round key according to the current subkey. Control the key XOR module to perform XOR operation on the intermediate result output by the round function operator and the round key. Pass the XOR result to the next round through the pipeline. Determine whether the current round reaches the SM4 encryption round configuration value. If not, increase the round counter and return to continue to execute the next round. If the SM4 encryption round configuration value has been reached, it means that the encryption process is completed and the final encryption result is output. The key controller controls the number of key expansion and key XOR operations by determining the relationship between the round counter and the SM4 encryption round configuration value, ensuring that the specified number of rounds of encryption operations are completed.

[0038] Furthermore, a three-way handshake verification mechanism is adopted. By establishing an independent handshake channel between the counter, the round function operator and the key adder, the handshake password generated by the pseudo-random number generator and the output of the physical non-deterministic source PHYS are used to realize the identity authentication and communication synchronization between the internal modules of the SM4 encryption core, thereby improving the security and reliability of the SM4 algorithm. Collection of handshake signals: A pseudo-random number generator is set on the FPGA chip to generate pseudo-random numbers at different times as handshake passwords. The pseudo-random number generator can be implemented using hardware circuits such as a linear feedback shift register (LFSR), which ensures the randomness and unpredictability of the handshake password.

[0039] An independent handshake channel is set between the counter, round function operator and key adder. The channel uses the high-speed serial transceiver of FPGA (such as LVDS, SerDes, etc.) to achieve high-speed, low-latency handshake signal transmission, and is independent of the normal data channel, which does not affect the transmission efficiency of SM4 encrypted data. A physical non-deterministic source PHYS is set at the transmitting and receiving ends of the independent channel. PHYS can use random signal sources such as environmental noise and circuit noise. After ADC sampling, filtering, quantization and other processing, the random characteristics of physical noise are extracted as an additional factor for handshake password verification. The PHYS output is combined with the pseudo-random number handshake password to construct a handshake password challenge response verification mechanism based on physical non-determinism, which further enhances the security of handshake verification.

[0040] Handshake process: After the data collector completes the plaintext group data collection, it obtains the handshake password 1 of the current moment from the pseudo-random number generator, packages the password 1 with the data collection completion identification code and timestamp, generates the first handshake signal, and sends the first handshake signal to the round function operator through the handshake interface on the independent channel. After receiving the first handshake signal, the round function operator verifies the password 1 therein. The verification method is to compare the received password 1 with the output of the local PHYS of the round function operator to determine the validity of password 1. After the verification is passed, the round function operator obtains the handshake password 2 of the next moment from the pseudo-random number generator, packages the password 2 with the round function operation completion identification code, timestamp and the first handshake signal, generates the second handshake signal, and sends the second handshake signal to the key adder through the handshake interface.

[0041] After receiving the second handshake signal, the key adder verifies the password 2 therein, and the verification method is similar to that of the round function operator. After the verification is passed, the key adder obtains the handshake password 3 of the next moment from the pseudo-random number generator, packages the password 3 with the encryption completion identification code, the timestamp, the first handshake signal and the second handshake signal, generates a third handshake signal, and returns the third handshake signal to the data collector through the handshake interface. After receiving the third handshake signal, the data collector verifies the password 3 therein, and the verification method is similar to the previous two times. After the verification is passed, the data collector completes a complete handshake process, the identities of each module of the SM4 encryption core are verified, the communication is also completed synchronously, and the next round of encryption process can be entered. Using the pseudo-random number handshake password and the physical non-deterministic source, the identity authentication and communication synchronization mechanism between the internal modules of the SM4 encryption core is established through the three-way handshake verification. The randomness and unpredictability of the handshake password, as well as the introduction of the physical non-deterministic source, enhance the security of the handshake verification and prevent threats such as man-in-the-middle attacks and replay attacks. The independent handshake channel ensures the efficient transmission of the handshake signal without affecting the processing efficiency of the SM4 encrypted data. The introduction of timestamps prevents delay and replay of handshake signals.

[0042] Furthermore, by using the timestamp information carried in the handshake signal and calculating the operation time of each module in the SM4 encryption core, the overall operation efficiency of the SM4 encryption core is obtained. By introducing the weight coefficient, the influence of different modules on the encryption efficiency is taken into account, making the efficiency evaluation more accurate and comprehensive. Analysis of handshake signals: The collected first handshake signal, the second handshake signal and the third handshake signal are analyzed to extract the timestamp information carried therein. The timestamp information can be expressed in a high-precision timestamp format, such as the nanosecond level of the UNIX timestamp, to ensure the accuracy of time measurement.

[0043] According to the timestamp difference of adjacent handshake signals, the operation time of the number extractor, the round function operator and the key adder are calculated respectively. The specific method is as follows: the number extractor controller calculates the operation time T1=T3_end-T1_start of the number extractor according to the start timestamp T1_start of the first handshake signal and the end timestamp T3_end of the third handshake signal. Here, T1 includes the total time for the number extractor to complete the plaintext packet extraction, generate the first handshake signal, and wait for the third handshake signal to return. The round function controller calculates the operation time T2=T2_end-T1_end of the round function operator according to the end timestamp T1_end of the first handshake signal and the end timestamp T2_end of the second handshake signal. Here, T2 includes the time for the round function operator to receive the first handshake signal, complete the round function operation, and generate the second handshake signal. The key controller calculates the operation time T3=T3_start-T2_end of the key adder according to the end timestamp T2_end of the second handshake signal and the start timestamp T3_start of the third handshake signal. Here, T3 includes the time for the key adder to receive the second handshake signal, complete the key addition operation, and generate the third handshake signal.

[0044] Calculation of operation efficiency: According to the operation time T1, T2, T3 of the counter, round function operator and key adder, and their weight coefficients W1, W2, W3 affecting the encryption efficiency, the operation efficiency E of the SM4 encryption core is calculated by the formula E=1 / (W1*T1+W2*T2+W3*T3). The values ​​of the weight coefficients W1, W2, W3 can be estimated and adjusted according to the complexity and operation amount of each module in the SM4 encryption core to reflect their influence on the encryption efficiency. For example, the round function operator usually has higher complexity and operation amount, and its weight coefficient W2 can take a larger value; while the operation of the counter and key adder is relatively simple, and its weight coefficients W1 and W3 can take smaller values. The operation efficiency E calculated by the formula comprehensively considers the operation time and influence weight of each module in the SM4 encryption core, and obtains a comprehensive efficiency evaluation result. The larger the E value, the higher the operation efficiency of the SM4 encryption core and the faster the encryption speed.

[0045] Furthermore, random polynomial operations and logical operations are introduced into each module of the SM4 encryption core. The operation process of each part is coordinated by the hybrid operation control module, so that the encrypted data is randomly encoded, obfuscated, etc. when it circulates inside the SM4. The data flow is complex and changeable, and it is difficult to be captured and analyzed by attackers, thereby improving the security of the SM4 algorithm. When the data acquisition controller reads the plaintext data: the polynomial coefficient generation module uses LFSR to generate the random values ​​of the variables x, y, and z in the polynomial f(x, y, z) = (ax+b)y+cz, and the Bracewell sequence B(n) generates the polynomial coefficients a, b, and c, wherein the random seed of the LFSR and the starting value n of B(n) are provided by the seed generator, which ensures the randomness of the polynomial coefficients. The plaintext data is used as the input variable of the polynomial f(x, y, z), and the plaintext is randomly encoded through the polynomial operation. The encoding result is passed to the round function operator as the output of the data acquisition controller, which conceals the statistical characteristics of the plaintext. When the round function operator performs nonlinear transformation: the polynomial operation module expands the operation process of f(x, y, z) through the Horner algorithm, and the specific steps are: initialize the result register res to 0; read the coefficients c, b, a of the polynomial z, y, and x terms from B(n) in sequence; calculate the x term tmp=ax+R, where R is the random number generated by the LFSR; calculate the y term tmp=tmpy+b; calculate the z term res=tmpz+S, where S is another random number generated by the LFSR. The polynomial operation result is used as the intermediate result of the S-box replacement, and then the logical operation circuit is used to confuse the S-box output with logical operations such as XOR, AND, or OR to obtain the nonlinear transformation result after confusion. During linear transformation, the linear transformation result and the polynomial operation result are subjected to logical operations such as XOR to introduce randomization factors, and the polynomial operation and logical operation are performed alternately, which increases the complexity of the round function operation.

[0046] In the process of generating round keys and performing round key addition operations by the key adder, random polynomial operations and logical operations are introduced to randomly encode and confuse the round keys and round function results, disrupt the regularity of the key addition operation, and increase the randomness of the key addition results, thereby improving the security of the SM4 algorithm. Round key generation process: The polynomial coefficient generation module uses LFSR to generate the random value of the variable k in the polynomial f(k)=ak^2+bk+c, and the Bracewell sequence B(n) generates the polynomial coefficients a, b, and c, where the random seed of the LFSR and the starting value n of B(n) are provided by the seed generator, ensuring the randomness of the polynomial coefficients. Each subkey in the key group is used as the input variable of the polynomial f(k), and the subkey is randomly encoded by the polynomial operation module. The randomly encoded subkey is then used to generate the round key through the key expansion algorithm, and the expanded round key is XOR mixed with the random encoding result to obtain the randomized round key. By introducing random polynomial operations in the round key generation process, the randomness of the round key is increased, making it difficult for attackers to infer the key by analyzing the statistical characteristics of the key.

[0047] The process of round key addition operation: The round function operation result and the randomized round key are first subjected to XOR, AND, OR and other logical operations through the logic operation circuit to introduce nonlinear confusion. The logical operation result is then XOR mixed with the random polynomial operation result to obtain a mixed key addition result. Among them, the random polynomial operation result is generated by the polynomial operation module. The method similar to the round key generation process is used to generate random polynomial coefficients using LFSR and Bracewell sequence, and the round function result is randomly encoded. The key controller controls the timing of the mixed operation so that the random polynomial operation, logical operation and round key addition operation are executed alternately, which disrupts the regularity of the key addition operation and increases the uncertainty of the key addition result, making it difficult for attackers to infer the key by analyzing the timing regularity of the key addition operation.

[0048] Iterative round encryption process: After completing a round of SM4 encryption, the encryption result of this round is XOR mixed with the result of random polynomial operation and used as the input of the next round of encryption. By introducing random polynomial operation between rounds, the encryption result of the previous round is randomly encoded, so that the input of each round is random, which increases the diffusion of the SM4 algorithm and makes the avalanche effect more obvious. After the last round of encryption is completed, the final result is encoded again through random polynomial operation to obtain the obfuscated SM4 ciphertext output. This step increases the randomness of the ciphertext, making the statistical characteristics of the ciphertext more uniform and difficult to be exploited by attackers. In the polynomial operation process, the random numbers R and S generated by LFSR are inserted to participate in the calculation of the intermediate results tmp and res, introducing randomization factors and dynamically disguising the results of the polynomial operation; and by changing the clock cycle of the polynomial operation from time to time, the power consumption characteristics of the polynomial operation are adjusted, increasing the difficulty of power consumption analysis.

[0049] After the polynomial operation is completed, the results tmp and res are input to the logic operation circuit, and the operation results are further obfuscated through XOR, AND, OR operations; and the logic operation results are fed back to the input of the polynomial operation, repeating the process of polynomial operation and logic operation to form a circular data path, and multiple iterations of mixed operations to increase data complexity. Provide control signals for polynomial operation and logic operation, and cooperate with the data acquisition controller, round function controller, and key controller to ensure that the mixed operation is synchronized with the SM4 encryption process, so that the encrypted data is processed by random polynomial mixed operation when it is transmitted inside SM4, and the data flow is complex and changeable, making it difficult for attackers to capture.

[0050] Compared with the prior art, the advantages of this application are:

[0051] By configuring multiple SM4 encryption cores with pipeline architecture on the FPGA chip, the efficiency and throughput of SM4 encryption are improved by multi-core parallel processing. The pipeline architecture divides the encryption operation into three stages: data acquisition, round function operation, and key addition, realizing fine-grained parallel encryption processing, giving full play to the parallel computing advantages of FPGA chips, and improving encryption speed.

[0052] The handshake signals between each stage of the SM4 encryption core are collected, and the operation status of each stage is accurately reflected through the handshake signals to calculate the real-time operation efficiency of the SM4 encryption core. The priority scheduling algorithm is used to dynamically adjust the FPGA resource allocation between the SM4 encryption cores according to the operation efficiency, realizing load balancing and resource optimization during the encryption process, and improving the resource utilization of the FPGA chip.

[0053] The physical noise-based random number extraction circuit integrated on the FPGA chip is used to generate high-quality random numbers as the encryption key of the SM4 encryption core. The introduction of physical noise sources enhances the randomness of the key, improves the unpredictability of the key, and effectively resists attacks such as key guessing and key analysis.

[0054] The SM4 encryption core uses a mixed calculation method of polynomial operations and logical operations. The encoding and obfuscation of plaintext data and intermediate results are achieved through nonlinear polynomial operations, which conceals the statistical characteristics of the data and increases the difficulty of power analysis attacks. Mixing polynomial operations and logical operations further increases the computational complexity and enhances the SM4 encryption algorithm's ability to resist side channel attacks.

[0055] During the operation of the SM4 encryption core, wait cycles are randomly inserted. By randomizing the operation timing and introducing time jitter, the correlation between encryption operations and energy consumption is disrupted, which increases the difficulty of side channel attacks such as power consumption analysis and electromagnetic analysis, and improves the strength of SM4 encryption against side channel attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The present application will be further described in the form of exemplary embodiments, which will be described in detail by the accompanying drawings. These embodiments are not restrictive, and in these embodiments, the same number represents the same structure, wherein:

[0057] Figure 1 is an exemplary flow chart of an FPGA-based SM4 encryption method according to some embodiments of the present application;

[0058] Figure 2 is an exemplary flow chart of configuring an encryption core according to some embodiments of the present application;

[0059] Figure 3 This is an exemplary flow chart of collecting handshake signals according to some embodiments of the present application. DETAILED DESCRIPTION

[0060] The method and system provided in the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0061] Figure 1is an exemplary flow chart of an FPGA-based SM4 encryption method shown in some embodiments of the present application, including: obtaining plaintext data to be encrypted and inputting the plaintext data into an FPGA chip; configuring multiple SM4 encryption cores on the FPGA chip, and using the SM4 encryption cores to perform parallel encryption operations on the plaintext data to obtain ciphertext data; wherein each SM4 encryption core adopts a pipeline architecture, and the pipeline architecture includes a counter, a round function operator and a key adder, which respectively perform the three stages of the encryption operation, namely, counter, round function operation and key addition; using a random number extraction circuit based on physical noise integrated on the FPGA chip to generate an N-bit random number, and using the generated N-bit random number as the encryption key of each SM4 encryption core; The key is used for SM4 encryption operation; inside each SM4 encryption core, the handshake signals between the counter, the round function operator and the key adder are collected, and the handshake signals are used to reflect the operation status of the counter, the round function operator and the key adder; according to the collected handshake signals, the operation efficiency of each SM4 encryption core is calculated; according to the calculated operation efficiency, the priority scheduling algorithm is used to dynamically adjust the FPGA resource allocation between each SM4 encryption core; in the process of executing the encryption operation of each SM4 encryption core, the calculation is performed in a mixed manner of polynomial operation and logical operation to improve the power consumption analysis attack capability; and the waiting cycle is randomly inserted in the encryption operation to improve the anti-side channel attack capability of SM4 encryption by random operation timing.

[0062] Obtain the plaintext data to be encrypted and input the plaintext data into the FPGA chip: Receive the plaintext data to be encrypted from external devices (such as host computers, sensors, etc.) through the external interfaces of the FPGA chip, such as GPIO, UART, SPI, I2C, etc. The received plaintext data is transmitted to the data cache module inside the FPGA chip, such as FIFO, RAM, etc., through the data bus. The bit width and depth of the data cache module are designed according to the packet length and throughput requirements of the SM4 encryption algorithm. The data cache module is connected to the data input interface of the SM4 encryption core, and the synchronous transmission of data is realized through the handshake signal. When the amount of plaintext data stored in the data cache module reaches the input data length of the SM4 encryption core, the counter of the SM4 encryption core starts to read the plaintext data from the data cache module.

[0063] Figure 2According to the exemplary flow chart of configuring the encryption core shown in some embodiments of the present application, multiple SM4 encryption cores are configured on the FPGA chip: Verilog HDL or VHDL hardware description language is used to write the RTL level code of the SM4 encryption IP core according to the specification of the SM4 encryption algorithm. The code includes three modules: a counter, a round function operator and a key adder, and is connected in a pipeline manner. Using logic synthesis tools such as Synopsys Design Compiler, Cadence RTL Compiler or Mentor Graphics Precision, the RTL level code of the SM4 encryption IP core is logically synthesized to generate a gate-level netlist file of the SM4 encryption IP core. During the synthesis process, the timing, area and power consumption of the SM4 encryption IP core are constrained and optimized according to the characteristics of the FPGA device. Using layout and routing tools such as Xilinx Vivado, Intel Quartus or Lattice Diamond, the gate-level netlist of the SM4 encryption IP core is laid out and routed, and the logic units in the SM4 encryption IP core are mapped to the physical resources (such as LUT, FF, etc.) of the FPGA device, and the wiring between the physical resources is completed. During the layout and routing process, clock constraints and clock tree synthesis are used to balance the clock path delays of various physical resources of the SM4 encrypted IP core to ensure clock synchronization.

[0064] In the top-level module of the SM4 encryption IP core, the registers and storage units in the SM4 encryption IP core are initialized to a preset state through an asynchronous reset signal. The SM4 encryption IP core is integrated into the top-level design of the FPGA chip through port mapping or encapsulation into standard interfaces such as AXI4. According to the throughput requirements of SM4 encryption, multiple SM4 encryption IP cores are instantiated in the top-level design to form a parallel SM4 encryption core array. The SM4 encryption core array is connected to other functional modules (such as key management, data cache, external interface, etc.) using the on-chip interconnection resources of the FPGA chip, such as the AXI4 internal bus, to build a complete SM4 encryption system. Finally, the FPGA top-level design is synthesized, laid out and routed, and the FPGA bitstream file is generated and downloaded to the FPGA chip to complete the configuration and deployment of the SM4 encryption system.

[0065] Using the physical noise-based random number extraction circuit integrated on the FPGA chip, N-bit random numbers are generated, and the random numbers are used as the encryption keys of each SM4 encryption core for SM4 encryption operations: A physical noise-based random number extraction circuit, such as a ring oscillator or a chaotic mapping circuit, is integrated on the FPGA chip. The physical noise source can come from thermal noise, shot noise, or 1 / f noise inside the FPGA chip. The random number extraction circuit uses digital post-processing to amplify, filter, and quantize the analog noise signal generated by the physical noise source to obtain a uniformly distributed random bit sequence. The random bit sequence is tested for randomness using standard test suites such as NIST SP800-22 to ensure the quality of the random number. According to the key length requirements of the SM4 encryption algorithm, the random bit sequence is grouped and parallelized to obtain an N-bit (such as 128-bit) random number. The random bit sequence can be cached and read using structures such as shift registers or FIFOs. The generated N-bit random number is distributed to each SM4 encryption core on the FPGA chip through a bus or a dedicated interface as its encryption key. The SM4 encryption core performs encryption operations on the plaintext data based on the received random key. In order to improve the security of the random number, a dynamic update method can be used to periodically (such as every certain number of encryption operations) regenerate a new random key from the random number extraction circuit to update the encryption key of the SM4 encryption core.

[0066] Inside each SM4 encryption core, the data access device includes: Packet storage area: The packet storage area is implemented using the Block RAM (BRAM) resources on the FPGA chip. BRAM is a high-speed dual-port memory built into the FPGA, with independent read and write ports and a large storage capacity. The bit width and depth of the BRAM are designed according to the packet length (128 bits) of the SM4 encryption algorithm and the throughput requirements of the encryption core. For example, a BRAM with a bit width of 128 and a depth of n (n is the number of plaintext data packets that need to be cached) can be used. The plaintext data packets to be encrypted are written into the BRAM in sequence, and each packet occupies a storage unit of the BRAM. The write port of the packet storage area is connected to the data cache module for receiving plaintext data packets from the data cache module; the read port is connected to the data access controller for reading the plaintext data packets to be encrypted.

[0067] Circular buffer: Use the on-chip storage resources of FPGA (such as Distributed RAM or Shift Register LUT) to implement the linked list nodes of the circular buffer. Each linked list node contains two fields: the starting address (pointing to the starting address of the corresponding plaintext data packet in the packet storage area) and the packet length (recording the length of the plaintext data packet, fixed to 128 bits). The linked list head pointer is implemented using a register (such as Flip-Flop), and the bit width is the same as the storage unit address bit width of the linked list node. Initially, the linked list head pointer points to the first linked list node. The linked list operation interface includes two operations, insertion and deletion, which are implemented using a finite state machine (FSM). Insertion operation: When the data cache module writes a new plaintext data packet to the packet storage area, the insertion operation of the linked list operation interface is triggered. The insertion operation takes an idle node from the idle linked list node pool, writes the starting address and packet length of the new plaintext data packet into the node, and inserts the node into the tail of the linked list. At the same time, the linked list head pointer is updated to point to the newly inserted node. Delete operation: When the data acquisition controller finishes reading a plaintext data packet, the delete operation of the linked list operation interface is triggered. The delete operation removes the currently read linked list node from the linked list and releases the node back to the free node pool. At the same time, the linked list head pointer is updated to point to the next linked list node to be read.

[0068] Data fetch controller: The control logic of the data fetch controller is implemented using a finite state machine (FSM). The FSM contains states such as idle, read, and wait. The data fetch controller obtains the current linked list node to be read through the linked list head pointer. The starting address and packet length of the plaintext data packet are extracted from the node. The data fetch controller uses the starting address as the read address to read the corresponding plaintext data packet from the BRAM in the packet storage area. The read data packet is sent to the round function operator of the SM4 encryption core for encryption processing. The data fetch controller also controls the read pointer of the circular buffer. The read pointer points to the currently read linked list node. After each data packet is read, the read pointer increments and points to the next linked list node to be read. When the read pointer reaches the end of the linked list, the data fetch controller determines whether the circular buffer is empty. If it is not empty, the read pointer returns to the head of the linked list and continues to read data packets; if it is empty, the data fetch controller enters the waiting state and waits for new plaintext data packets to be written. The data fetch controller also controls the write pointer of the circular buffer. The write pointer points to the current position where a new node can be written. When the data cache module writes a new plaintext data packet, the data acquisition controller triggers the insertion operation of the linked list operation interface, inserts the new node to the position pointed to by the write pointer, and updates the write pointer. The data acquisition controller determines the state of the circular buffer (empty, full, neither empty nor full) by the positional relationship between the read pointer and the write pointer. When the circular buffer is empty, the data acquisition controller sends a data request signal to the data cache module to request a new plaintext data packet; when the circular buffer is full, the data acquisition controller suspends sending data requests and waits for the round function operator to read the data packet and release the buffer space.

[0069] The working process of the number fetcher: Initially, the linked list is empty, the circular buffer is empty, and the read pointer and write pointer point to the head of the linked list. When the data cache module writes a new plaintext data packet, the number fetch controller triggers the insert operation of the linked list operation interface, inserts the new node into the tail of the linked list, and updates the write pointer. The number fetch controller reads the first node in the linked list through the linked list head pointer, and obtains the starting address and packet length of the plaintext data packet to be read. According to the starting address, the number fetch controller reads the corresponding plaintext data packet from the BRAM in the packet storage area and sends it to the round function operator for encryption processing. The number fetch controller triggers the delete operation of the linked list operation interface, removes the read node from the linked list, and updates the read pointer. Repeat until the linked list is empty, that is, all cached plaintext data packets are read and encrypted. When the linked list is empty, the number fetch controller enters a waiting state, waiting for a new plaintext data packet to be written. When the data cache module writes a new packet, repeat. The round function operator includes: round number configuration register: the round number configuration register is implemented using the on-chip register resources of the FPGA (such as Flip-Flop). The bit width of the round configuration register is determined by the round number of the SM4 encryption algorithm. For the standard SM4 encryption algorithm, the round number is 32, so the bit width of the round configuration register is 6 bits (2^6=64>32). The value of the round configuration register is written by the control module when the SM4 encryption core is initialized, and the round configuration of the current encryption operation is stored. The output of the round configuration register is connected to the round function selector, which is used to control the output of the round function operation module that selects the corresponding round number.

[0070] Round function operation module: According to the specification of SM4 encryption algorithm, each round function operation module consists of two parts: nonlinear transformation and linear transformation. Nonlinear transformation uses a lookup table (LUT) to implement S-box replacement operation. S-box is a nonlinear permutation table with 8-bit input and 8-bit output. The S-box lookup table is implemented using FPGA's distributed storage resources (such as Distributed RAM or Shift Register LUT). Linear transformation is implemented using XOR operation and circular shift operation. Linear transformation circuit is implemented using FPGA's logic resources (such as LUT) and shift register. The input of each round function operation module is a 128-bit data packet and a 128-bit round key, and the output is a 128-bit encryption result. The round function operation modules are connected in a pipeline manner, and each module corresponds to one round of encryption operation of SM4 encryption algorithm. The depth of the pipeline is designed according to the number of rounds of SM4 encryption algorithm and the target clock frequency.

[0071] Round function selector: The round function selector is implemented using the FPGA multiplexer. The input of the round function selector is connected to the output of each round function operation module, and the input data width is 128 bits multiplied by the number of round function operation modules. The selection signal of the round function selector comes from the round number configuration register, and the bit width of the selection signal is log2 (the number of round function operation modules). The output of the round function selector is connected to the next level module of the pipeline, and the output data width is 128 bits. According to the value of the round number configuration register, the round function selector selects the output of the round function operation module of the corresponding round number to the next level of the pipeline. Round key generation module: According to the key expansion algorithm of the SM4 encryption algorithm, the round key generation module is implemented using the logic resources of the FPGA. The input of the round key generation module is a 128-bit initial key, and the output is 32 128-bit round keys. The round key generation module generates the round key of each round according to the initial key through XOR operation, S box replacement and circular shift operation. The generated round key is provided to the corresponding round function operation module through a dedicated data path. Each round function operation module uses a round key of a corresponding round number to perform encryption operations.

[0072] Round function controller: The control logic of the round function controller is implemented using a finite state machine (FSM). The round function controller controls the transmission of data packets between modules at various levels of the pipeline according to the process of the SM4 encryption algorithm. Data synchronization between modules is achieved through handshake signals (such as data valid signals and data ready signals). The round function controller generates a selection signal for the round function selector, and selects the output of the corresponding round function operation module to the next level of the pipeline according to the current number of encryption rounds. The round function controller controls the operation of the round key generation module, triggers the generation of round keys at the beginning of encryption, and provides the generated round keys to the corresponding round function operation module. The round function controller is also responsible for controlling the progress of data packets in the pipeline, recording the current number of encryption rounds through a counter, and comparing it with the value of the round number configuration register to determine whether the encryption is completed.

[0073] The working process of the round function operator: At the beginning of encryption, the round function controller resets all round function operation modules and round key generation modules, and initializes the value of the round number configuration register to 0. The round function controller triggers the round key generation module, generates 32 round keys based on the input initial key, and distributes the round keys to the corresponding round function operation modules. The data acquisition controller reads the first plaintext data packet from the packet storage area and sends it to the first-level round function operation module of the pipeline. The round function controller controls the data packet to pass through the pipeline step by step, and performs a round of encryption operation on the data packet every time it passes through a round function operation module. The round function controller generates a selection signal of the round function selector according to the current number of encryption rounds, and selects the output of the round function operation module of the corresponding round number to the next level of the pipeline. Repeat until the data packet passes through all the round function operation modules and completes 32 rounds of encryption operations. The last level of the pipeline outputs the encrypted ciphertext data packet and stores it in the ciphertext buffer. Repeat until all plaintext data packets are encrypted.

[0074] The key adder includes: a key group cache module: the key group cache module is implemented using the on-chip storage resources (such as Block RAM or Distributed RAM) of the FPGA. According to the key length (128 bits) of the SM4 encryption algorithm, the input initial key is divided into four 32-bit sub-keys. Four 32-bit registers or storage units are used to cache four sub-keys respectively. The output of each register or storage unit is connected to the input of the key expansion module. The write port of the key group cache module is connected to the key input interface for receiving the initial key data; the read port is connected to the key expansion module for providing sub-key data. The key expansion module: according to the key expansion algorithm of the SM4 encryption algorithm, the key expansion module is implemented using the logic resources (such as LUT and register) of the FPGA. The input of the key expansion module is four 32-bit sub-keys, and the output is one 32-bit extended sub-key. A lookup table (LUT) is used to implement nonlinear transformation (such as S-box replacement) in the key expansion process. According to the specification of the SM4 key expansion algorithm, the S-box replacement result is calculated and stored in advance to speed up the expansion process. The linear transformation in the key expansion process is realized by using XOR operation and circular shift operation. The data bits of the extended subkey are randomly permuted to increase the randomness and security of the key. A linear feedback shift register (LFSR) or other pseudo-random number generator can be used to generate a random permutation sequence, and the data bit permutation can be realized through a crossbar switch or a multiplexer. The output of the key expansion module is the round key used in the current encryption round, which is connected to the input of the key XOR module.

[0075] Key XOR module: The key XOR module is implemented using the logic resources of FPGA (such as LUT). The input of the key XOR module includes the intermediate result (128 bits) output by the round function operator and the round key (32 bits) generated by the key expansion module. The intermediate result output by the round function operator is divided into 4 sub-groups according to 32 bits, and a bitwise XOR operation is performed with the round key respectively. The result of the XOR operation is used as the output result of the current encryption round and is passed to the round function operator of the next round through the pipeline. The output of the key XOR module is connected to the input of the next-level pipeline module for data transmission. Key controller: The control logic of the key controller is implemented using a finite state machine (FSM). The key controller generates a control signal according to the round number configuration of the SM4 encryption algorithm to trigger the operation of the key expansion module and the key XOR module. In each encryption round, the key controller first triggers the key expansion module to generate a round key based on the sub-key of the current round. Then, the key controller triggers the key XOR module to perform an XOR operation on the intermediate result output by the round function operator and the round key. The key controller records the current encryption round through the counter and compares it with the SM4 encryption round configuration to determine whether the encryption is completed. If the current round does not reach the configured SM4 encryption round number, the key controller enters the next round and continues to trigger key expansion and key XOR operations. If the current round reaches the configured SM4 encryption round number, the key controller outputs an encryption completion signal, indicating that the entire encryption process is over.

[0076] The workflow of the key adder: At the beginning of encryption, the key controller resets the key expansion module and the key XOR module, and initializes the round counter to 0. The key input interface writes the initial key into the key group cache module, divides it into 4 subkeys and caches it. The key controller triggers the key expansion module to generate the round key of the first round according to the first subkey. The round function operator performs the first round of encryption operation on the plaintext data group and outputs the intermediate result. The key controller triggers the key XOR module, and performs an XOR operation on the intermediate result output by the round function operator and the round key of the first round to obtain the output result of the first round. The key controller passes the output result of the first round to the round function operator of the next round through the pipeline. The key controller determines whether the current round reaches the configured SM4 encryption round number. If not, it enters the next round and repeats. If the current round reaches the configured SM4 encryption round number, the key controller outputs an encryption completion signal, indicating that the entire encryption process is over.

[0077] Calculate the operational efficiency of the SM4 encryption core and dynamically schedule resources based on the operational efficiency, including: Implementation of pseudo-random number generator: Use linear feedback shift register (LFSR) on the FPGA chip to implement the pseudo-random number generator. The LFSR consists of multiple cascaded D flip-flops and XOR gates. By selecting an appropriate feedback polynomial, a pseudo-random number sequence with a longer period can be generated. Select the appropriate LFSR level according to the required pseudo-random number bit width. For example, a 32-level LFSR can generate a 32-bit pseudo-random number. Use logic resources (such as LUT, FF, etc.) in the FPGA to instantiate the LFSR and control its operation through the clock. In each clock cycle, the LFSR generates a new pseudo-random number based on the feedback polynomial. Use the output of the LFSR as a handshake password for the counter, round function operator, and key adder.

[0078] Figure 3 It is an exemplary flow chart of collecting handshake signals shown in some embodiments of the present application, and the setting of independent handshake channels: using high-speed serial transceivers (such as LVDS, SERDES, etc.) on the FPGA chip to implement independent handshake channels. A pair of high-speed serial transceivers are respectively set between the counter, the round function operator and the key adder for sending and receiving handshake signals. The high-speed serial transceiver at the transmitting end converts the parallel handshake data into serial data and sends it to the receiving end through the differential signal line. The high-speed serial transceiver at the receiving end converts the received serial data into parallel data and restores the original handshake signal. The handshake channel and the data channel are independent of each other, ensuring the high-speed transmission of the handshake signal without affecting the bandwidth and delay of the data channel. The setting of the physical non-deterministic source (PHYS): a physical non-deterministic source (PHYS) is set at the transmitting end and the receiving end of the handshake channel respectively to generate random noise. PHYS can be implemented using a ring oscillator. The ring oscillator is composed of an odd number of inverters cascaded to generate an unstable oscillation signal. Random noise can be obtained by sampling the output of the ring oscillator. PHYS can also be implemented using a quantum random number generator. A quantum random number generator uses a quantum noise source (such as jet noise, photon noise, etc.) to generate true random numbers. The output of PHYS is combined with the handshake password generated by the pseudo-random number generator to form the final handshake password. This can enhance the randomness and unpredictability of the handshake password.

[0079] Generation and transmission of the first handshake signal: After the data collector completes the plaintext packet data acquisition, the handshake password 1 of the current moment is obtained from the pseudo-random number generator. Password 1 is packaged with the data acquisition completion identification code and the timestamp to generate the first handshake signal. The identification code is used to identify the data acquisition completion event, and the timestamp records the time when the data acquisition is completed. The first handshake signal is sent to the round function operator through the high-speed serial transceiver on the handshake channel. Generation and transmission of the second handshake signal: After the round function operator receives the first handshake signal, it verifies password 1. After the verification is passed, the handshake password 2 of the next moment is obtained from the pseudo-random number generator. Password 2 is packaged with the round function operation completion identification code, the timestamp and the first handshake signal to generate the second handshake signal. The identification code is used to identify the round function operation completion event, and the timestamp records the time when the operation is completed. The second handshake signal is sent to the key adder through the high-speed serial transceiver on the handshake channel. Generation and transmission of the third handshake signal: After the key adder receives the second handshake signal, it verifies password 2. After the verification is passed, the handshake password 3 of the next moment is obtained from the pseudo-random number generator. The password 3 is packaged with the encryption completion identification code, the timestamp, the first handshake signal and the second handshake signal to generate a third handshake signal. The identification code is used to identify the encryption completion event, and the timestamp records the time when the encryption is completed. The third handshake signal is returned to the data collector through the high-speed serial transceiver on the handshake channel.

[0080] Verification of handshake signal: In the handshake interface, the received handshake password is compared with the output of PHYS to determine the validity of the handshake password. If the received handshake password is consistent with the output of PHYS, it means that the handshake password is valid and the handshake verification is passed. If the received handshake password is inconsistent with the output of PHYS, it means that the handshake password is invalid and the handshake verification fails. The handshake interface feeds back the handshake failure information to the sender and requires the handshake signal to be resent. Completion of the handshake process: After the counter receives the third handshake signal, it verifies password 3. After the verification passes, it means that a complete handshake process is completed. The counter enters the next round of encryption process and restarts a new round of handshake process. Calculation module operation time: The collected first handshake signal, the second handshake signal and the third handshake signal are parsed to extract the timestamp information. According to the timestamp difference of adjacent handshake signals, the operation time of the counter, the round function operator and the key adder are calculated respectively. The data acquisition controller calculates the operation time T1=T3_end-T1_start of the data acquisition device according to the start timestamp T1_start of the first handshake signal and the end timestamp T3_end of the third handshake signal. The round function controller calculates the operation time T2=T2_end-T1_end of the round function operator according to the end timestamp T1_end of the first handshake signal and the end timestamp T2_end of the second handshake signal. The key controller calculates the operation time T3=T3_start-T2_end of the key adder according to the end timestamp T2_end of the second handshake signal and the start timestamp T3_start of the third handshake signal.

[0081] Calculation of the computing efficiency of the SM4 encryption core: According to the collected handshake signal, the timestamp information is extracted to calculate the operation time T1 of the counter, the operation time T2 of the round function operator and the operation time T3 of the key adder. Set the corresponding weight coefficients W1, W2 and W3 for the counter, round function operator and key adder in the SM4 encryption core. The weight coefficient represents the degree of influence of each module on the encryption efficiency. Determine the appropriate weight coefficient value through experimental testing and statistical analysis. Specifically, the following method can be used: Design a set of test vectors, including plaintext data of different lengths and characteristics, and encrypt the SM4 encryption core. During the encryption process, record the operation time T1, T2, T3 of each module and the encryption time T of the entire encryption core. Collect a certain amount of sample data through multiple tests. Use mathematical optimization methods such as least squares method to fit the weight coefficients W1, W2 and W3 so that the error between the weighted operation time and the overall encryption time is minimized. The value of the weight coefficient should meet the constraints, such as the sum of the weight coefficients is 1 and the weight coefficient is non-negative. According to the calculated operation time T1, T2, T3 and weight coefficients W1, W2, W3, the operation efficiency E of the SM4 encryption core is calculated by the formula E=1 / (W1*T1+W2*T2+W3*T3). The calculation of the operation efficiency E can be implemented in the FPGA using a floating-point operation unit, or the calculation can be simplified by methods such as table lookup optimization.

[0082] Dynamic resource scheduling optimization: According to the calculated operation efficiency E of each SM4 encryption core, the priority scheduling algorithm is used to dynamically adjust the FPGA resource allocation. A resource management module is designed to monitor the operation efficiency of each SM4 encryption core and allocate resources according to the priority scheduling algorithm. The resource management module maintains a priority queue, and puts the SM4 encryption cores with higher operation efficiency at the front of the queue and the ones with lower operation efficiency at the back. When there are available logic resources, storage resources, DSP resources, etc. in the FPGA, the resource management module allocates resources to the SM4 encryption cores in the order of the priority queue. For SM4 encryption cores with higher operation efficiency, more resources are allocated, such as increasing parallelism and increasing clock frequency, to improve their processing performance. For SM4 encryption cores with lower operation efficiency, resource allocation is appropriately reduced, such as reducing parallelism and clock frequency, and resources are allocated to cores with higher efficiency first. The resource management module dynamically adjusts resource allocation according to the actual resource usage and the needs of encryption tasks. When the encryption task changes or there is a bottleneck in resource usage, the priority queue and resource allocation strategy are adjusted in time.

[0083] The choice of priority scheduling algorithm can be determined according to actual needs. Common priority scheduling algorithms include: Weight-based priority scheduling: Different weights are assigned according to the computing efficiency of the SM4 encryption core. The higher the weight, the higher the priority. Deadline-based priority scheduling: Prioritize the SM4 encryption core according to the deadline of the encryption task. The more urgent the deadline, the higher the priority. Fairness-based priority scheduling: Consider the resource usage of each SM4 encryption core to ensure the fairness of resource allocation and avoid individual cores occupying resources for a long time. Through dynamic resource scheduling optimization, the processing performance of each SM4 encryption core is balanced to improve the overall encryption throughput and efficiency.

[0084] Hardware implementation: Design and implement the resource management module in FPGA, including priority queue, resource allocation controller, etc. The resource management module is connected to each SM4 encryption core through a bus or a dedicated interface to realize dynamic resource allocation and control. The design of the SM4 encryption core needs to consider the scalability and reconfigurability of resources to support dynamic resource scheduling. In the SM4 encryption core, design the resource control interface to receive the control signal of the resource management module and dynamically adjust the internal resource usage, such as parallelism, clock frequency, etc. Implement the design of the resource management module and the SM4 encryption core through hardware description languages ​​(such as Verilog, VHDL), and perform synthesis, layout and routing to generate FPGA bitstream files. Software control: Integrate a soft-core processor (such as ARM, MicroBlaze, etc.) in the FPGA to run the resource scheduling and control software program. The software program reads the computing efficiency of the SM4 encryption core, calculates the priority, and passes the priority information to the resource management module. The software program dynamically adjusts the priority scheduling algorithm and resource allocation strategy according to the requirements of the encryption task and the status of the system. The software program communicates with the resource management module and the SM4 encryption core through configuration registers or control interfaces to realize the control of dynamic resource scheduling.

[0085] When the SM4 encryption core performs encryption operations, the plaintext data, intermediate results and random polynomial operations are mixed, the Horner algorithm is used to expand the polynomial operation, and it is combined with logical operations to enhance the ability to resist side channel attacks. Random polynomial encoding of plaintext data: Input of plaintext data: The data acquisition controller reads plaintext data packets from the external interface or data cache, and the length of each packet is 128 bits. The read plaintext data packets are divided into several sub-packets, and the length of each sub-packet can be set according to the needs of the polynomial operation, such as 32 bits or 64 bits. Each sub-packet is used as an input variable of the polynomial operation and random polynomial encoding is performed in turn. Generation of random variables: A linear feedback shift register (LFSR) is used to generate random values ​​of variables x, y, and z in the polynomial operation expression f(x, y, z) = (ax+b)y+cz. According to the security requirements of the polynomial operation, an appropriate LFSR feedback polynomial and initial state are selected. Common feedback polynomials include: x^16+x^14+x^13+x^11+1 (16-bit LFSR); x^32+x^22+x^2+x^1+1 (32-bit LFSR); x^64+x^63+x^61+x^60+1 (64-bit LFSR); Set the initial state of the LFSR to the key or random seed to ensure that the generated random sequence has sufficient randomness and unpredictability. Generate a pseudo-random sequence through the shift and feedback operations of the LFSR as the values ​​of variables x, y, and z. According to the needs of the polynomial operation expression, select the appropriate number of bits to truncate the random sequence generated by the LFSR to obtain the required random variable value.

[0086] Generation of random coefficients: Generate the coefficients a, b, c of each term of f(x, y, z) through the Bracewell sequence B(n). The Bracewell sequence is a pseudo-random sequence with good randomness and uniform distribution characteristics. Its generation method is as follows: Select an initial value B(0) as the starting value of the sequence. Generate subsequent sequence values ​​through the recursive formula B(n) = (B(n-1)*p)modq. Among them, p and q are two mutually prime positive integers, usually p = 31 and q = 127. According to the needs of the polynomial operation expression, select an appropriate number of bits to truncate the Bracewell sequence to obtain the required random coefficients a, b, c. Multiply the generated random coefficients with the corresponding terms in the polynomial operation expression to obtain the complete polynomial expression. Polynomial operation and encoding: Substitute the plaintext data subgroups as the input variable x of the polynomial operation, and the random variables y and z and the random coefficients a, b, c into the polynomial expression f(x, y, z) = (ax+b)y+cz. The polynomial operation unit performs polynomial operations to calculate the encoded result. The polynomial operation unit can be implemented using hardware resources such as multipliers, adders, and shift registers to improve the operation efficiency. In order to reduce the consumption of hardware resources, the Horner algorithm can be used to expand the polynomial operation and convert the polynomial operation into a series of multiplication and addition operations. For each plaintext data sub-packet, the corresponding polynomial operation is performed to obtain the encoded result.

[0087] Output of encoding results: The results obtained by encoding each plaintext data sub-group with random polynomials are spliced ​​to form a complete encoded plaintext data group. The encoded plaintext data group is used as the output of the data acquisition controller and passed to the round function operator for subsequent encryption operations. Through random polynomial encoding, the statistical characteristics of the plaintext data are concealed, the randomness and unpredictability of the data are increased, and the ability to resist side channel attacks is improved. Horner algorithm expansion in the round function operator: Polynomial expansion: The random polynomial f(x, y, z) = (ax + b) y + cz is expanded into the form of the Horner algorithm: f(x, y, z) = (ay + c) x + by + cz. The expanded form of the Horner algorithm is obtained by arranging the polynomials from high to low according to the power of the variable x. The expanded polynomial form can reduce the number of multiplications and improve the calculation efficiency. Polynomial calculation: In the round function operator, the value of the polynomial is calculated by loop iteration. First, the value of (ay + c) is calculated, where a is the polynomial coefficient, y is the random variable, and c is the constant term. Then, multiply the result of (ay+c) by the variable x to get the value of (ay+c)x. Next, add the result of (ay+c)x to the next term by in the polynomial to get the value of (ay+c)x+by. Finally, add the result of (ay+c)x+by to the constant term cz to get the final result of the polynomial f(x, y, z).

[0088] Mixing of intermediate results: In each iterative calculation of the polynomial, the intermediate results are mixed with other operations of the round function to increase the complexity and randomness of the calculation. The intermediate results can be mixed with S-box substitution to perform nonlinear transformation on the intermediate results. The intermediate results can also be mixed with linear transformation to perform linear obfuscation on the intermediate results. By mixing the polynomial calculation with other operations of the round function, the complexity of the calculation is increased and the ability to resist side channel attacks is improved. Hardware implementation: Use DSP resources or logic resources in FPGA to implement the polynomial operation unit to support the expansion and calculation of the Horner algorithm. The finite state machine (FSM) is used to control the process of polynomial calculation and coordinate the execution of each step. The polynomial operation unit is integrated with other modules such as S-box and linear transformation to form a complete round function operator. Through pipeline design, the parallelism and throughput of polynomial calculation are improved and the calculation delay is reduced.

[0089] Key random encoding in the key adder: Key grouping and encoding: The 128-bit key is grouped into several subkeys. The length of each subkey can be set according to the needs of the polynomial operation, such as 32 bits or 64 bits. For each subkey, a random variable value and a random coefficient are generated, and the polynomial expression f(x, y, z) is substituted for calculation to obtain the encoded result. The method of generating random variable values ​​and random coefficients is similar to the random polynomial encoding of plaintext data, and can be generated using modules such as LFSR and Bracewell sequence generator. XOR operation of the encoding result: The result obtained by encoding each subkey with a random polynomial is XORed with the corresponding round key generated by the key expansion algorithm. The XOR operation can mix the encoded key with the expanded key to increase the randomness and unpredictability of the key. The result of the XOR operation is used as a randomized round key for subsequent key addition operations.

[0090] Mixed XOR operation in the key adder: Logical operation of the round function operation result and the round key: When the key adder performs the round key addition operation, the result of the round function operation is first logically operated with the round key. Different logical operations can be selected, such as AND, OR, XOR, etc., to increase the diversity and randomness of the calculation. By using different logical operations, the result of the key addition operation has higher unpredictability and complexity. XOR of the logical operation result and the random polynomial operation result: The result obtained by performing a logical operation on the round function operation result and the round key is XORed with the result of the random polynomial operation. The result of the random polynomial operation is obtained by encoding the round function operation result with a random polynomial. The logical operation result is mixed with the random polynomial operation result through an XOR operation to obtain the final key addition result.

[0091] Random insertion of waiting cycles: Design of pseudo-random number generator: Use linear feedback shift register (LFSR) or other pseudo-random number generator to generate random number sequences. According to the security requirements of SM4 encryption, select appropriate LFSR feedback polynomial and initial state to ensure that the generated random numbers have good statistical properties. The output of the pseudo-random number generator can be used to control whether to insert a waiting cycle and the length of the waiting time. Control of random insertion of waiting cycles: Before each round of SM4 encryption, decide whether to insert a waiting cycle based on the output of the pseudo-random number generator. If the value of the pseudo-random number meets the preset conditions (such as greater than a certain threshold), insert a waiting cycle before the current round of operation. The length of the waiting cycle can also be determined based on the value of the pseudo-random number, and different waiting time granularity can be selected, such as 1 clock cycle, 2 clock cycles, etc. Random polynomial encoding of the final result: Random polynomial encoding of the final encrypted result: After completing all rounds of SM4 encryption, the final 128-bit encryption result is randomly polynomially encoded. Similar to the encoding process of plaintext data, the final encrypted result is divided into several subgroups, and the length of each subgroup can be set according to the needs of polynomial operation. For each subgroup, generate random variable values ​​and random coefficients, substitute them into the polynomial expression f(x, y, z) for calculation, and obtain the encoded result. The encoded results are spliced ​​to obtain the complete obfuscated ciphertext data.

Claims

1. An SM4 encryption method based on FPGA, comprising: Obtain the plaintext data to be encrypted and input the plaintext data into the FPGA chip; Multiple SM4 encryption cores are configured on the FPGA chip, and the SM4 encryption cores are used to perform parallel encryption operations on plaintext data to obtain ciphertext data; each SM4 encryption core adopts a pipeline architecture, which includes a counter, a round function operator and a key adder, which respectively perform the three stages of the encryption operation: counter, round function operation and key addition; Using the physical noise-based random number extraction circuit integrated on the FPGA chip to generate an N-bit random number, the generated N-bit random number is used as the encryption key of each SM4 encryption core for SM4 encryption operations; In each SM4 encryption core, the handshake signals between the counter, round function operator and key adder are collected. The handshake signals are used to reflect the operation status of the counter, round function operator and key adder. According to the collected handshake signals, the operation efficiency of each SM4 encryption core is calculated; According to the calculated operation efficiency, the priority scheduling algorithm is used to dynamically adjust the FPGA resource allocation between each SM4 encryption core; In the process of each SM4 encryption core performing encryption operations, polynomial operations are mixed with logical operations to improve the power consumption analysis attack capability; and wait cycles are randomly inserted in the encryption operation to improve the SM4 encryption's ability to resist side channel attacks by randomizing the operation timing.

2. The FPGA-based SM4 encryption method according to claim 1, characterized in that: Configure multiple SM4 encryption cores on the FPGA chip, including: Use Verilog HDL or VHDL hardware description language to write multiple SM4 encryption algorithm IP core codes and obtain the RTL level description of the SM4 encryption IP core; Input the RTL level description of the SM4 encrypted IP core into the logic synthesis tool, perform logic synthesis on the SM4 encrypted IP core code, convert the RTL level description into a logic gate level netlist, and generate a logic gate level netlist file of the SM4 encrypted IP core; The generated logic gate-level netlist file is used as input, and the layout and routing synthesis tool is used to perform FPGA layout and routing on the SM4 encrypted IP core, map the logic units in the SM4 encrypted IP core to the physical resources of the FPGA device, and complete the layout and routing between the physical resources; wherein the physical resources include the lookup table LUT and the trigger FF; Before FPGA layout and routing, balance the clock tree on the FPGA chip to make the clocks of various physical resources of the SM4 encryption IP core consistent; and put the SM4 encryption IP core into a preset initial state through asynchronous reset; After completing the FPGA layout and routing, the SM4 encryption IP core is connected to the physical resources of the FPGA chip through port mapping to form a group of SM4 encryption cores for parallel SM4 encryption operations.

3. The FPGA-based SM4 encryption method according to claim 2, characterized in that: The logic synthesis tool includes at least one of Synopsys Design Compiler, Cadence RTL Compiler and MentorGraphics Precision; The placement and routing synthesis tool includes at least one of Xilinx Vivado, Intel Quartus, and Lattice Diamond.

4. The FPGA-based SM4 encryption method according to claim 3, characterized in that: In pipeline architecture: The data acquisition device adopts an architecture that supports variable-length packet acquisition. According to the packet length of the SM4 encryption algorithm, the input plaintext data to be encrypted is divided into groups, and the plaintext data is divided into multiple data groups of equal length, and the divided data groups are output to the next level of the pipeline in sequence; The round function operator adopts a programmable architecture that supports dynamic configuration of the number of encryption rounds. The number of SM4 encryption rounds is set through a configurable register, and the number of round function operations is controlled according to the configured number of rounds. In each round of round function operation, nonlinear transformation and linear transformation are performed on the input data group, and the round function operation result is output to the next stage of the pipeline; The key adder adopts an architecture that supports key grouping and group key prediction. It divides the input encryption key into multiple key groups, expands the key groups by table lookup, predicts the next key group based on the current key group, and performs an XOR operation on the round function operation result and the predicted key group to generate the encryption result of the current round.

5. The FPGA-based SM4 encryption method according to claim 4, characterized in that: Data acquisition device, including: A packet storage area, used to cache plaintext data packets to be retrieved; The circular buffer uses a linked list structure to manage plaintext data packets. The linked list structure includes multiple linked list nodes, a linked list head pointer and a linked list operation interface. Each linked list node is used to record the starting address and packet length of a plaintext data packet. The linked list head pointer points to the first node in the linked list. The linked list operation interface is used to manage insertion and deletion of the linked list. The data acquisition controller traverses the linked list through the linked list operation interface according to the packet length of the SM4 encryption algorithm, and reads the plaintext data packets recorded in the linked list in sequence. Each time a data packet is read, the corresponding linked list node is deleted through the linked list operation interface to read the data of the variable-length packet; the data acquisition controller manages the caching and reading of the plaintext data packets in the circular buffer by controlling the write pointer and read pointer of the circular buffer.

6. The FPGA-based SM4 encryption method according to claim 5, characterized in that: Round function operator, including: The round number configuration register is used to store the round number configuration value of the SM4 encryption algorithm; Multiple round function operation modules, each round function operation module is used to perform a round of encryption operation of the SM4 encryption algorithm, the encryption operation includes nonlinear transformation and linear transformation, the nonlinear transformation performs an S-box replacement operation on the input data group, and the linear transformation performs a linear transformation on the result after the S-box replacement; The round function selector has an input end connected to the output of each round function operation module and an output end connected to the next stage of the pipeline. According to the round number configuration value, the output of the round function operation module corresponding to the round number is selected to the next stage of the pipeline; The round key generation module generates the round key of each round through the key expansion algorithm according to the input initial key, and provides the generated round key to the corresponding round function operation module; The round function controller controls the transmission of data packets between pipeline modules at various levels according to the process of the SM4 encryption algorithm, controls the round function selector to switch the round function, controls the round key generation module to provide round keys, and performs multi-round encryption operations of the SM4 encryption algorithm.

7. The FPGA-based SM4 encryption method according to claim 6, characterized in that: Key adder, including: The key grouping cache module caches the key used by the SM4 encryption algorithm and divides the input initial key into 4 subkeys and caches them; The key expansion module expands the subkey output by the key grouping cache module by table lookup; and randomly permutes the data bits of the expanded subkey to generate a round key for the current encryption round; The key XOR module performs a bitwise XOR operation on the intermediate result output by the round function operator and the round key generated by the key expansion module to obtain the output result of the current encryption round; The key controller, according to the round number configuration of the SM4 encryption algorithm, triggers the key expansion module to generate round keys in each encryption round, controls the key XOR module to execute round key XOR, and passes the XOR result to the next round through the pipeline; the key controller uses a finite state machine to determine whether the key expansion and key XOR are completed according to the current round and the number of SM4 encryption rounds. If not, it enters the next round to continue execution until the configured number of SM4 encryption rounds is completed.

8. The FPGA-based SM4 encryption method according to any one of claims 4 to 7, characterized in that: Collect handshake signals, including: A pseudo-random number generator is set on the FPGA chip to generate different pseudo-random numbers as handshake passwords; An independent channel is set between the counter, the round function operator and the key adder. The independent channel uses the high-speed serial transceiver of the FPGA and is independent of the data channel. A physical non-deterministic source PHYS is set at the transmitting and receiving ends of the independent channel. By using the PHYS output as the verification factor of the handshake password, a handshake password challenge response verification mechanism based on physical non-determinism is constructed. After the data acquisition device completes the plaintext group data acquisition, it obtains the handshake password 1 at the current moment from the pseudo-random number generator, packages the password 1 with the data acquisition completion identification code and the timestamp, generates a first handshake signal, and sends the first handshake signal to the round function operator through the handshake interface on the independent channel; The round function operator verifies the password 1 in the first handshake signal. After the verification is passed, the handshake password 2 at the next moment is obtained from the pseudo-random number generator, and the password 2 is packaged with the round function operation completion identification code, the timestamp and the first handshake signal to generate a second handshake signal, and the second handshake signal is sent to the key adder through the handshake interface; The key adder verifies the password 2 in the second handshake signal. After the verification is passed, it obtains the handshake password 3 at the next moment from the pseudo-random number generator, packages the password 3 with the encryption completion identification code, the timestamp, the first handshake signal and the second handshake signal, generates a third handshake signal, and returns the third handshake signal to the data acquirer through the handshake interface; The data reader verifies the password 3 in the third handshake signal. After the verification is passed, a handshake process is completed and the next round of encryption process begins. Among them, the handshake interface determines the validity of the handshake password by comparing the received handshake password with the PHYS output.

9. The FPGA-based SM4 encryption method according to claim 8, characterized in that: Calculate the SM4 encryption core operation efficiency based on the collected handshake signals, including: Parse the collected first handshake signal, second handshake signal and third handshake signal, extract timestamp information, and calculate the operation time of the counter, round function operator and key adder respectively according to the timestamp difference of adjacent handshake signals; The data acquisition controller calculates the operation time T1=T3_end-T1_start of the data acquisition device according to the start time stamp T1_start of the first handshake signal and the end time stamp T3_end of the third handshake signal; The round function controller calculates the operation time T2=T2_end-T1_end of the round function operator according to the end timestamp T1_end of the first handshake signal and the end timestamp T2_end of the second handshake signal; The key controller calculates the operation time T3 of the key adder according to the end timestamp T2_end of the second handshake signal and the start timestamp T3_start of the third handshake signal, which is T3=T3_start-T2_end; The computational efficiency E of the SM4 encryption core is calculated using the following formula: E=1 / (W1*T1+W2*T2+W3*T3), Among them, W1, W2, and W3 are the weight coefficients of the counter, round function operator, and key adder in the SM4 encryption core that affect the encryption efficiency.

10. The FPGA-based SM4 encryption method according to claim 9, characterized in that: In the process of performing encryption operations in each SM4 encryption core, polynomial operations and logical operations are mixed to perform calculations, including: When the data acquisition controller reads the plaintext data group, the plaintext data is used as the input variable of the polynomial operation, and the linear feedback shift register LFSR is used to generate the random values ​​of the variables x, y, and z in the polynomial operation expression f(x, y, z) = (ax+b)y+cz, and the coefficients a, b, and c of each term of f(x, y, z) are generated through the Bracewell sequence B(n); the encoded result is used as the output of the data acquisition controller and passed to the round function operator to cover up the statistical characteristics of the plaintext data; When the round function operator performs nonlinear transformation, the operation process of the polynomial f(x, y, z) is expanded by the Horner algorithm; When the key adder generates the round key, it first uses the polynomial f(x, y, z) to randomly encode each subkey in the key group, and then expands the key, mixes the expanded result with the random encoding result, and obtains the randomized round key; When the key adder performs the round key addition operation, the round function operation result and the round key are first subjected to a logical operation, and then XORed with the random polynomial operation result to obtain a mixed key addition result; After completing a round of SM4 encryption, the encryption result is mixed with the result of the random polynomial f(x, y, z) operation and XORed as the input for the next round of encryption; after the last round of encryption is completed, the final result is encoded again through the random polynomial f(x, y, z) operation to obtain the obfuscated ciphertext output.

Images