Encryption / decryption method and device

Abstract

The invention provides an encryption / decryption method and device. The method comprises the steps that multiple rounds of operation are carried out based on input data and a secret key to generate output data, each round of operation is used for processing N pieces of grouped data to generate rounds of output data, and the N pieces of grouped data of the first round of operation are obtained after random mask processing is carried out on the input data, the N grouped data of the other rounds of operation are obtained according to the N-1 grouped data of the previous round of operation and the round output data. In each round of operation, performing random mask processing according to the round key and N-1 grouped data of the round of operation to generate first data; performing nonlinear transformation on the first data by using the S box with the mask to generate second data; performing linear transformation on the second data to generate third data; performing XOR operation on the other packet data of the current round of operation and the third data to generate fourth data; and performing mask processing on the fourth data to generate round output data of the round of operation. According to the method, the security of equipment and data can be improved.

Description

Technical Field

[0001] This application belongs to the field of cryptography technology, and relates to encryption / decryption methods, and in particular to encryption / decryption methods and apparatus. Background Technology

[0002] Block ciphers, also known as block encryption or block cryptography, are a type of symmetric cryptography. They are widely used in mobile communications, wireless LANs, finance, defense, e-commerce, and video encryption. In block ciphers, the input plaintext data is divided into fixed-length blocks, and a series of operations are performed on each block based on a key to convert it into corresponding ciphertext. Common block cipher algorithms include DES (Data Encryption Standard), AES (Advanced Encryption Standard), and SM4. However, existing block cipher algorithms are relatively weak against DPA (Differential Power Analysis) attacks. Summary of the Invention

[0003] The purpose of this application is to provide encryption / decryption methods, devices, storage media, and electronic devices to enhance the ability of devices to resist DPA attacks.

[0004] In a first aspect, this application provides an encryption / decryption method, the method comprising: performing multiple rounds of operations based on input data and a key to generate output data, wherein each round of operations processes N groups of data to generate round output data, the N groups of data in the first round of operations are obtained by random masking the input data, and the N groups of data in the remaining rounds of operations are obtained based on the N-1 groups of data from the previous round of operations and the round output data, where N is a positive integer greater than 1; wherein in each round of operations: random masking is performed based on the round key and the N-1 groups of data in the current round of operations to generate first data, the round key being generated by a key generator; a nonlinear transformation is performed on the first data using a masked S-box by a nonlinear processor to generate second data; a linear transformation is performed on the second data by a linear processor to generate third data; an XOR operation is performed on the remaining 1 group of data in the current round of operations and the third data by an XOR operation unit to generate fourth data; and a masking operation is performed on the fourth data by a masking processor to generate the round output data of the current round of operations.

[0005] In one implementation of the first aspect, the method further includes: performing an XOR operation on N first random numbers and the input data using an XOR operation unit to generate N grouped data for the first round of operation, wherein the first random numbers are generated by a random number generator.

[0006] In one implementation of the first aspect, the method further includes: the key generator performing an XOR operation with the key using N second random numbers, and expanding the key based on the XOR result to generate the round key, wherein the second random numbers are generated by a random number generator.

[0007] In one implementation of the first aspect, generating first data by performing random masking processing based on the round key and N-1 group data of the current round includes: performing an XOR operation on the round random number, the round key, and the N-1 group data of the current round using an XOR operation unit to generate the first data.

[0008] In one implementation of the first aspect, the method further includes: generating the round random number using a third random number, wherein the round random number is different for each round of operation, and the third random number is generated by a random number generator.

[0009] In one implementation of the first aspect, the process of generating second data by performing a nonlinear transformation on the first data using a masked S-box via a nonlinear processor includes: performing an affine transformation on the first data to generate fifth data; performing a mask inversion on the fifth data in the Galois domain to generate sixth data; and performing an affine transformation on the sixth data to generate the second data.

[0010] In one implementation of the first aspect, the method further includes: adding the output data of the previous round of operation after the last N-1 grouped data of the previous round of operation as the N grouped data of the current round of operation.

[0011] In one implementation of the first aspect, the method further includes: adding the output data of the last round of operation as the seventh data after the N-1 grouped data of the last round of operation; reversing the order of the seventh data to generate the eighth data; and demasking the eighth data to generate the output data.

[0012] In one implementation of the first aspect, the input data is plaintext data and the output data is ciphertext data; or, the input data is ciphertext data and the output data is plaintext data.

[0013] In one implementation of the first aspect, N = 4, and the number of rounds of the multi-round operation is 32.

[0014] Secondly, embodiments of this application provide an encryption / decryption device, comprising: a data acquisition module for acquiring input data; a key acquisition module for acquiring a key and generating a round key via a key generator; and an encryption / decryption module for performing multiple rounds of operations based on the input data and the key to generate output data. Each round of operation processes N data packets to generate round output data. The N data packets in the first round are obtained by processing the input data through a random mask, and the N data packets in the remaining rounds are obtained based on the N-1 data packets from the previous round and the round output data, where N is a positive integer greater than 1. In each round of computation, the encryption / decryption module performs random masking on the round key and the N-1 blocks of data in the current round to generate first data. The round key is generated by a key generator. A nonlinear processor then performs a nonlinear transformation on the first data using a masked S-box to generate second data. A linear processor then performs a linear transformation on the second data to generate third data. An XOR operation unit performs an XOR operation on the remaining block of data in the current round and the third data to generate fourth data. Finally, a masking processor performs masking on the fourth data to generate the round output data for the current round of computation.

[0015] In the encryption / decryption method provided in the embodiments of this application, the intermediate data in the encryption / decryption engine is masked, so that attackers cannot infer the internal operation process and related data of the engine through power consumption analysis, which greatly improves the ability to deal with DPA attacks.

[0016] The masks used in the encryption / decryption methods provided in this application are all random numbers generated by a random number generator, which helps to further improve the security of devices and data.

[0017] In this embodiment, S-box transformation can be performed using arithmetic methods instead of a lookup table. This approach allows for the incorporation of a mask, making the DPA attack targets introduced by this logic more random, such as power consumption, thus further enhancing the ability to counter DPA attacks. Attached Figure Description

[0018] Figure 1 The diagram shows a block encryption algorithm in the relevant technical solution.

[0019] Figure 2 The flowchart shown is the i-th round of calculation in the embodiment of this application.

[0020] Figure 3A The flowchart shown is a process for data processing using a masked S-box in an embodiment of this application.

[0021] Figure 3BThe diagram shown is a schematic of data processing using a masked S-box in an embodiment of this application.

[0022] Figure 3C The flowchart shown is a mask inversion process in an embodiment of this application.

[0023] Figure 4 The flowchart shown is a process for generating output data in an embodiment of this application.

[0024] Figure 5 The diagram shown is an overall schematic diagram of the encryption method provided in the embodiments of this application.

[0025] Figure 6 The diagram shown is a structural schematic of the encryption / decryption device provided in this application. Detailed Implementation

[0026] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0027] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this application. Therefore, the drawings only show the components related to this application and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0028] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0029] In this application, unless otherwise expressly specified and limited, the terms "connected" and "linked" should be interpreted broadly. For example, they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; they can refer to the internal connection of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0030] Figure 1This diagram illustrates the block encryption process in some technical solutions, using the example of plaintext being divided into four data blocks (i.e., four data packets). Figure 1 As shown, the block encryption process includes 32 rounds of iterative computation. In the i-th round of computation, the four block data X are processed... i X i+1 X i+2 X i+3 Perform calculations to generate round output data X i+4 In the (i+1)th round of computation, the four grouped data X i+1 X i+2 X i+3 X i+4 Perform calculations to generate round output data X i+5 And so on. Where i = 0, 1, ..., 31. However, this encryption method is relatively weak against DPA attacks. Specifically, a DPA attack is a physical layer attack technique that exploits the power consumption changes of a cryptographic device under different input data or keys, and infers the internal computational processes and related information of the device by analyzing the power consumption waveform. Figure 1 In the block cipher scheme shown, the data within the encryption engine is closely related to the plaintext. Therefore, an attacker can obtain information about the cryptographic algorithm and key by inputting specific plaintext and monitoring the device's power consumption patterns.

[0031] To address at least the aforementioned problems, this application provides an encryption / decryption method. The technical solution described below will be illustrated with the accompanying drawings of the embodiments of this application, using the encryption method as an example.

[0032] The encryption method provided in this application includes: performing P+1 rounds of operations based on input data and a key to generate output data, where P is a positive integer. Each round of operations processes N data packets to generate round output data. Each data packet and the round output data are of equal size, for example, 32 bits. N is a positive integer greater than 1. The N data packets in the first round are obtained by processing the input data through a random mask, and the N data packets in the remaining rounds are obtained from the N-1 data packets from the previous round and the round output data.

[0033] Figure 2 The flowchart shown is a process flow diagram of the i-th round of operation in the encryption method provided in the embodiments of this application, where i = 0, 1, ..., P. Figure 2 As shown, the i-th round of computation includes the following steps.

[0034] S21, based on the round key rk of the i-th round operation. iThe first data is generated by randomly masking N-1 blocks of data, where the round key is generated by a key generator. For ease of explanation, the following will use the N blocks of data MX from the i-th round of operation as an example. i MX i+1 , ..., MX i+N-1 Taking this as an example, the N-1 grouped data involved in generating the first data are MX i+1 , ..., MX i+N-1 However, this application is not limited to this.

[0035] S22 uses a nonlinear processor to perform a nonlinear transformation on the first data using a masked S-box (MSbox) to generate the second data. The nonlinear processor can be implemented, for example, using a digital signal processor (DSP), an application-specific integrated circuit (ASIC), or a field-programmable gate array (FPGA).

[0036] S23 uses a linear processor to perform a linear transformation on the second data to generate the third data. The linear processor can be implemented using, for example, a DSP, ASIC, or FPGA.

[0037] S24, the remaining one group of data (i.e., MX) in the i-th round of operation is processed by the XOR operation unit. i The fourth data is generated by XORing the third data with the first data.

[0038] S25, the fourth data is masked by the mask processor to generate the round output data MX of the i-th round of operation. i+N .

[0039] If the i-th round is not the last round of calculation, then it can be based on the N-1 grouped data (i.e., MX) from the i-th round of calculation. i+1 , ..., MX i+N-1 ) and wheel output data (i.e., MX) i+N We obtain N groups of data from the (i+1)th round of computation. If the i-th round is the last round of computation, then we can perform the operation on MX. i+1 , ..., MX i+N-1 MX i+N Perform demasking to obtain the final output data.

[0040] As described above, in the encryption method provided in this application embodiment, a masked S-box is used to perform a nonlinear transformation on the first data, thereby masking the second data, as well as the subsequent third and fourth data. Attackers cannot obtain information about this data, and therefore cannot infer the internal operation process and related data of the engine through power consumption analysis or other methods, which greatly improves the ability to resist DPA attacks.

[0041] In some implementations, the encryption method provided in this application may further include: using an XOR operation unit to process N first random numbers mx0, mx1, ..., mx... N-1 XOR the input data with the input data to generate N groups of data MX0, MX1, MX2, and MX3 for the first round of computation. N-1 The first random number can be generated by a random number generator, such as a TRNG (True Random Number Generator). This ensures that the data entering the encryption engine is processed with a random mask, which further enhances the masking of data during the encryption process.

[0042] In some implementations, the encryption method provided in this application may further include: a key generator using N second random numbers mk0, mk1, ..., mk N-1 Perform an XOR operation with the key, and expand the key based on the XOR result to generate the round keys rk0, rk1, ..., rk for each round of operation. N-1 This method provides further protection for the key. The second random number can be generated by a random number generator, such as a TRNG.

[0043] In some implementations, generating the first data by performing random masking based on the round key and the N-1 blocks of data from the i-th round of operation includes: performing XOR operations on the round random number from the i-th round of operation and the round key rk. i Perform an XOR operation with N-1 grouped data to generate the first data.

[0044] In some implementations, the round random number can utilize a third random number mx. N The random numbers generated in each round of computation are different. The third random number can be generated by a random number generator, such as TRNG.

[0045] In some implementations, a third random number can be input into an LFSR (Linear Feedback Shift Register) to generate rounds of random numbers. The LFSR works by shifting the data in the register one bit to the left in each clock cycle, while simultaneously calculating the new rightmost bit according to a predefined linear feedback polynomial and storing it in the register. By continuously repeating this process, the LFSR can generate a round of random numbers for each round of computation.

[0046] As described above, in the embodiments of this application, a mask can be applied to the XOR result of the round key rki and N-1 group data using round random numbers, thereby masking the first data obtained, which helps to further enhance the security of the data.

[0047] Please see Figure 3A In some implementations, generating second data by performing a nonlinear transformation on the first data using a masked S-box via a nonlinear processor includes the following steps.

[0048] S221, Perform an affine transformation on the first data to generate the fifth data.

[0049] S222, in the Galois domain GF(2) 8 The fifth data is masked and inverted to generate the sixth data.

[0050] S223, Perform an affine transformation on the sixth data to generate the second data.

[0051] Figure 3B This diagram illustrates the use of a masked S-box to perform a nonlinear transformation on the first data X⊕M to generate the second data. The dashed line and the symbol above it represent the mask for the current data. An affine transformation is performed on X⊕M to generate the fifth data Aff(X⊕M), which is masked by MA, where A is a cyclic matrix. The fifth data can also be represented as Aff(X)⊕MA. The mask is then inverted on the fifth data to generate the sixth data Aff(X). -1 The sixth data point is masked by MA. An affine transformation is performed on the sixth data point to generate the second data point Sbox(X)⊕MAA, where the second data point is the Sbox(X) masked by MAA.

[0052] For example, Figure 3C This is a flowchart illustrating the mask inversion of the fifth data Y⊕MA to generate the sixth data in an embodiment of this application, where Y = Aff(X). Figure 3C As shown, the product of Y⊕MA and MA is (MA).2 Perform an XOR operation, invert the result using the Galois field, XOR it with 1, and then multiply it by MA to obtain the final mask-inverted result Y. -1 ⊕MA.

[0053] In some implementations, masking the fourth data using a mask processor to generate the round output data for the i-th round of computation includes: performing an XOR operation between the mask of the third data and the fourth data to generate the round output data for the i-th round of computation.

[0054] In some implementations, if the i-th round is not the last round of computation, then the N-1 grouped data MX in the i-th round of computation... i+1 , ..., MX i+N-1 Then add the output data MX of the i-th round of calculation. i+N We obtain the N grouped data from the (i+1)th round of computation, which is MX. i+1 , ..., MX i+N-1 MX i+N .

[0055] Please see Figure 4 In some implementations, the encryption method provided in this application may further include the following steps.

[0056] S41, add the output data of the last round of calculation as the seventh data after the N-1 grouped data of the last round of calculation. For example, if the grouped data of the last round of calculation is MX P+0 MX P+1 , ..., MX P+N-1 The N-1 groups of data mentioned in this step refer to MX. P+1 , ..., MX P+N-1 If the output data of the last round of calculation is MX P+N Then the seventh data is MX P+1 MX P+2 , ..., MX P+N .

[0057] S42, reverse the order of the seventh data to generate the eighth data. For example, if the seventh data is MX P+1 MX P+2 , ..., MX P+N The eighth data obtained after reversing the order is MX. P+N MX P+N -1, ..., MX P+1 .

[0058] S43, perform demasking on the eighth data to generate output data.

[0059] For example, demasking the eighth data includes: performing an XOR operation between the mask of the grouped data in the last round of computation and the eighth data to generate output data.

[0060] For example, when the number of groups N=4 and the number of iterations is 32 (i.e., P=31), the schematic diagram of the encryption method provided in this application embodiment is as follows. Figure 5 As shown, the symbols at the dashed lines represent the masking of the data at those points. In the encryption method provided in this application embodiment, the plaintext is masked by XORing the first random numbers mx0, mx1, mx2, and mx3 with the input random text. The key is masked by XORing the second random numbers mk0, mk1, mk2, and mk3 with the input random key. The masked key is then expanded to generate round keys rk0 to rk0. 31 In the i-th round of computation, the grouped data MX i+0 To MX i+3 The masks are M0' to M3', and the round key is rk. i The mask is M3. Packet data MX i+1 To MX i+3 After performing an XOR operation, it is then compared with the round key rk. i The first data is obtained by XORing the random number m from the first round. The mask for the first data is m' = M1'⊕M2'⊕M3'⊕M3⊕m. The first data is then subjected to a nonlinear transformation using a masked S-box to obtain the second data, whose mask is denoted as m'". The second data is then subjected to a linear transformation to generate the third data, whose mask is denoted as m"'. The grouped data MX from the i-th round of computation is then used... i+0 The fourth data is generated by performing an XOR operation with the third data, and the mask of the fourth data is M0'⊕m”'. The fourth data is then XORed with the mask m”' of the third data to generate the round output data MX. i+4 The mask for the output data of the i-th round is M0'. If the i-th round is not the last round of calculation, then MX i+1 MX i+2 MX i+3 MX i+4 This will be used as the grouping data for the next round. If the i-th round is the last round of computation (i.e., i = 31), then MX will be used. i+1 MX i+2 MX i+3 MX i+4 The seventh data point is reversed to obtain the eighth data point MX. i+4 MX i+3 MX i+2 MX i+1 The ciphertext data (i.e., the final output data) can be obtained by XORing the masks M0' to M3' of the block data with the eighth data.

[0061] It should be understood that the encryption method provided in the embodiments of this application has been described above. The decryption method provided in the embodiments of this application is similar to the encryption method and will not be described in detail here.

[0062] The protection scope of the encryption / decryption method provided in this application is not limited to the execution order of the steps listed in this application. Any scheme implemented by adding, deleting, or replacing steps in the prior art based on the principles of this application is included within the protection scope of this application.

[0063] This application also provides an encryption / decryption device that can implement the encryption / decryption method provided in this application. However, the implementation device for the encryption / decryption method provided in this application includes, but is not limited to, the structure of the encryption / decryption device listed in this application. Any structural modifications and substitutions of the prior art made based on the principles of this application are included within the protection scope of this application.

[0064] Figure 6 The diagram shown is a structural schematic of the encryption / decryption device 6 provided in an embodiment of this application. Figure 6 As shown, the encryption / decryption device 6 includes a data acquisition module 61, a key acquisition module 62, and an encryption / decryption module 63. The data acquisition module 61 acquires input data. The key acquisition module 62 acquires a key and expands it using a key generator to generate a round key. The encryption / decryption module 63 encrypts / decrypts the input data using the encryption / decryption method provided in this embodiment.

[0065] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, or methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules / units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or units may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of apparatuses or modules or units may be electrical, mechanical, or other forms.

[0066] The modules / units described as separate components may or may not be physically separate. The components shown as modules / units may or may not be physical modules; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules / units can be selected to achieve the objectives of the embodiments of this application, depending on actual needs. For example, the functional modules / units in the various embodiments of this application may be integrated into one processing module, or each module / unit may exist physically separately, or two or more modules / units may be integrated into one module / unit.

[0067] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0068] In summary, this application provides an encryption / decryption method and apparatus. In the encryption / decryption method provided in this application, all intermediate data in the encryption / decryption engine is masked, preventing attackers from inferring the internal computational process and related data through power consumption analysis, thus significantly improving the device's ability to resist DPA attacks. Furthermore, the masks used in the encryption / decryption method provided in this application are all random numbers, which further enhances security. Moreover, the S-box transformation can be implemented using computational methods in this application, allowing the mask to be substituted, making the DPA attack targets introduced by this logic, such as power consumption, more random. Therefore, this application effectively overcomes various shortcomings in the prior art and has high industrial value and broad application prospects.

[0069] The descriptions of the processes or structures corresponding to the above figures each have their own emphasis. For parts of a process or structure that are not described in detail, please refer to the relevant descriptions of other processes or structures.

[0070] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. An encryption / decryption method characterized by, The method comprises: performing a plurality of rounds of operation based on input data and a key to generate output data, each round of operation being used to process N packet data to generate round output data, the N packet data of the first round of operation being obtained by performing random masking on the input data, and the N packet data of the remaining rounds of operation being obtained according to N-1 packet data of a previous round of operation and the round output data, N being a positive integer greater than 1; In each round of operation: performing random masking on the N-1 packet data of the current round of operation and a round key to generate first data, the round key being generated by a key generator; performing nonlinear transformation on the first data by a nonlinear processor using an S-box with masking to generate second data; performing linear transformation on the second data by a linear processor to generate third data; performing XOR operation on the remaining one packet data of the current round of operation and the third data by an XOR operation unit to generate fourth data; performing masking on the fourth data by a masking processor to generate round output data of the current round of operation.

2. The method of claim 1, wherein, The method further comprises: performing XOR operation on N first random numbers and the input data by an XOR operation unit to generate the N packet data of the first round of operation, the first random numbers being generated by a random number generator.

3. The method of claim 1, wherein, The method further comprises: performing XOR operation on N second random numbers and the key by the key generator, and performing key expansion according to the XOR result to generate the round key, the second random numbers being generated by a random number generator.

4. The method of claim 1, wherein, Performing random masking on the N-1 packet data of the current round of operation and a round key to generate first data comprises: performing XOR operation on a round random number, the round key and the N-1 packet data of the current round of operation by an XOR operation unit to generate the first data.

5. The method of claim 4, wherein, The method further comprises: generating the round random number using a third random number, the round random number of each round of operation being different, the third random number being generated by a random number generator.

6. The method of claim 1, wherein, Performing nonlinear transformation on the first data by a nonlinear processor using an S-box with masking to generate second data comprises: performing affine transformation on the first data to generate fifth data; performing masking inversion on the fifth data in a Galois field to generate sixth data; performing affine transformation on the sixth data to generate the second data.

7. The method of claim 1, wherein, The method further comprises: adding the round output data of a previous round of operation after the last N-1 packet data of the previous round of operation as N packet data of the current round of operation.

8. The method of claim 1, wherein, The method further comprises: adding the round output data of the last round of operation after the N-1 packet data of the last round of operation as seventh data; performing reverse sequence processing on the seventh data to generate eighth data; performing de-masking processing on the eighth data to generate the output data.

9. The method according to claim 1, wherein: the input data is plaintext data, and the output data is ciphertext data; or the input data is ciphertext data, and the output data is plaintext data.

10. The method of claim 1, wherein, N=4, and the number of rounds of the plurality of rounds of operation is 32.

11. An encryption / decryption device, characterized by comprising: comprises: a data acquisition module configured to acquire input data; The key obtaining module is configured to obtain a key and generate a round key by a key generator; The encryption / decryption module is configured to perform a plurality of rounds of operations based on input data and the key to generate output data, each round of operation being configured to process N groups of data to generate round output data, the N groups of data of the first round of operation being obtained by performing random masking on the input data, and the N groups of data of the remaining rounds of operation being obtained according to N-1 groups of data of a previous round of operation and the round output data, N being a positive integer greater than 1; In each round of operation of the encryption / decryption module, random masking is performed on the N-1 groups of data of the current round of operation and the round key to generate first data, the round key being generated by the key generator; a non-linear processor is configured to perform non-linear transformation on the first data by using a masked S-box to generate second data; a linear processor is configured to perform linear transformation on the second data to generate third data; an exclusive OR operation unit is configured to perform exclusive OR operation on the remaining one group of data of the current round of operation and the third data to generate fourth data; a masking processor is configured to perform masking on the fourth data to generate the round output data of the current round of operation.

Images