Encryption device and method of operating the same

Abstract

An encryption device for performing virtual operation and real operation and a method for operating the encryption device. The method comprises: performing virtual operation; when receiving a real operation request signal, determining whether the executed virtual operation has been completed; and in response to the virtual operation being completed, performing the real operation in response to the real operation request signal.

Description

[0001] [CROSS-REFERENCE TO RELATED APPLICATIONS]

[0002] This application claims the priority of Korean Patent Application No. 10-2017-0134252 filed in the Korean Intellectual Property Office on October 16, 2017 and Korean Patent Application No. 10-2018-0027082 filed in the Korean Intellectual Property Office on March 7, 2018, the disclosure of each of which is incorporated herein by reference in its entirety. Technical Field

[0003] The apparatus, device, and method according to the present disclosure relate to an encryption device and a method of operating the encryption device, and more particularly, to an encryption device for randomly performing virtual operations and a method of operating the encryption device. Background Art

[0004] Smart cards and integrated circuit (IC) cards contain user security information. To prevent security information from being leaked due to hacker attacks, an encryption / decryption device is required to encrypt and transmit security information transmitted through signatures and authorizations.

[0005] One of the important factors for realizing an encryption / decryption device is to apply a method for preventing side channel analysis (SCA). As the above method, a method of randomly or uniformly spreading power and electromagnetic waves as information collected through a side channel can be used. Summary of the invention

[0006] One aspect of the present invention provides an encryption device and a method of operating the encryption device to randomly perform virtual operations and real operations and a method of operating the encryption device, which provide a defense function against side channel attacks.

[0007] According to one aspect of an exemplary embodiment, a method for operating an encryption device to perform real operations and virtual operations is provided, the method comprising: performing a virtual operation; when a real operation request signal is received, determining whether the executed virtual operation has been completed; and in response to the virtual operation being completed, performing a real operation in response to the real operation request signal.

[0008] According to another aspect of the exemplary embodiment, there is provided a method for operating an encryption device for performing virtual operations and real operations, each of the virtual operations and the real operations including a plurality of round operations, each of the plurality of round operations including a plurality of sub-round operations, the plurality of sub-round operations being classified into real sub-round operations and virtual sub-round operations, the method comprising: initializing count values ​​and random values ​​associated with the plurality of sub-round operations, and starting to form a round including a plurality of sub-round operations, the plurality of sub-round operations including one real sub-round operation and a plurality of virtual sub-round operations; deriving a count value by counting the sub-round operations; when the count value is equal to the random value, executing the one real sub-round operation, and when the count value is different from the random value, executing one of the plurality of virtual sub-round operations; and when the count value is equal to a reference count value, completing the round.

[0009] According to another aspect of the exemplary embodiment, there is provided an encryption device for performing virtual operations and real operations, wherein the virtual operations and the real operations each include multiple round operations, wherein the multiple round operations each include multiple sub-round operations, and wherein the multiple sub-round operations are classified into real sub-round operations and virtual sub-round operations, and the encryption device includes: a first virtual operation register, configured to store first dummy data and a first dummy encryption key, wherein the virtual sub-round operation is based on the first dummy data and the first dummy encryption key; a second virtual operation register, configured to store second dummy data and a second dummy encryption key, wherein the virtual sub-round operation is based on the second dummy data and the second dummy encryption key; and a first multiplexer, configured to receive a first output from the first virtual operation register and a second output from the second virtual operation register, select one of the first output or the second output based on a random bit, and output the selected one of the first output or the second output. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Exemplary embodiments will be more clearly understood by reading the following detailed description in conjunction with the accompanying drawings, in which:

[0011] Figure 1 is a block diagram of an apparatus according to an exemplary embodiment.

[0012] Figure 2 is a detailed block diagram of an encryption device according to an exemplary embodiment.

[0013] Figure 3 is a flowchart of a method of operating an encryption device according to an exemplary embodiment.

[0014] Figure 4is a flowchart of a method of operating an encryption device according to an exemplary embodiment.

[0015] Figure 5 is a timing chart for explaining the operation of the encryption device according to an exemplary embodiment.

[0016] Figure 6 is a diagram illustrating a portion of an encryption device for performing an encryption operation according to an exemplary embodiment.

[0017] Figure 7 is a flowchart of a round forming operation of an encryption device according to an exemplary embodiment.

[0018] Figure 8 is a diagram illustrating a portion of an encryption device for a round forming operation according to an exemplary embodiment.

[0019] Fig. 9 is a table showing examples of options that can be set when performing a round forming operation according to an exemplary embodiment.

[0020] Fig.10 is a conceptual diagram of an example in which a plurality of rounds are performed when a round is formed according to an exemplary embodiment.

[0021] Fig.11 is a flowchart of a method of operating an encryption device according to an exemplary embodiment.

[0022] Fig.12 is a table for explaining the operation of the encryption device according to the exemplary embodiment.

[0023] Fig.13 is a diagram of a portion of an encryption device for performing encryption operations according to an exemplary embodiment.

[0024] Fig.14 is a graph illustrating a power waveform varying with operation of an encryption device according to an exemplary embodiment.

[0025] Fig.15 is a block diagram of a memory card according to an exemplary embodiment.

[0026] [Explanation of Symbols]

[0027] 1: Device;

[0028] 10, 1022: encryption device;

[0029] 20: Processor;

[0030] 30: Interface;

[0031] 40: memory;

[0032] 110: encryption / decryption controller;

[0033] 112: virtual operation controller;

[0034] 114: virtual operation register;

[0035] 120: key scheduler;

[0036] 130: data function module;

[0037] 210: Subtractor;

[0038] 220, 320, 440: first multiplexer;

[0039] 230, 330, 450: second multiplexer;

[0040] 240: third multiplexer;

[0041] 250: delay counter;

[0042] 260: Comparator;

[0043] 310: adder;

[0044] 340: counter;

[0045] 350: register;

[0046] 360: first comparator;

[0047] 370: second comparator;

[0048] 410: first virtual operation register;

[0049] 420: a second virtual operation register;

[0050] 430: real operation register;

[0051] 900: host;

[0052] 1000: memory card;

[0053] 1010: host interface;

[0054] 1020: memory controller;

[0055] 1030: Flash memory interface;

[0056] DT: data;

[0057] I_V1, I_V2: initial values;

[0058] NUM_D: number of delays;

[0059] R_B: random bit;

[0060] R_NUM: random value;

[0061] R_op: real operation;

[0062] Real_sub_round, RR: real sub-round operation;

[0063] S_R_op: real operation request signal;

[0064] S_V_op: virtual operation request signal;

[0065] S10, S20, S30, S40, S50, S110, S120, S130, S140, S150, S160, S170, S210, S220, S230, S240, S250, S260, S310, S320, S330: operation;

[0066] Sub_Real_on: real sub-round operation execution signal;

[0067] sub_round_cnt: count value;

[0068] t1: first time point;

[0069] T1: table;

[0070] t2: second time point;

[0071] t3: the third time point;

[0072] t4: fourth time point;

[0073] t5: fifth time point;

[0074] V_op: virtual operation;

[0075] Virtual_sub_round, VR: Virtual sub-round operation. DETAILED DESCRIPTION

[0076] Hereinafter, one or more exemplary embodiments will be described in detail with reference to the accompanying drawings.

[0077] Figure 1 is a block diagram of an apparatus 1 according to an exemplary embodiment.

[0078] Reference Figure 1 , the device 1 may include an encryption device 10, a processor 20, an interface (I / F) 30, and a memory 40. The device 1 may transmit and receive data DT with an external device. For example, the device 1 may transmit and receive data DT with a smart card, a memory card, or another device.

[0079] The processor 20 may transmit and receive data DT to and from one or more other devices outside the device 1 through the interface 30. The processor 20 may execute tasks and store task results in the memory 40. For example, the processor 20 may include multiple cores.

[0080] The memory 40 may store various types of data used for the operation of the processor 20. The memory 40 may be implemented as, for example, a dynamic random access memory (DRAM), a mobile DRAM, a static random access memory (SRAM), a phase change RAM (PRAM), a ferroelectric RAM (FRAM), a resistive RAM (RRAM or ReRAM), and / or a magnetic RAM (MRAM).

[0081] The encryption device 10 may perform encryption and / or decryption on the data DT received from outside the device 1. The encryption device 10 may maintain the security of the data DT by performing encryption operations based on an encryption algorithm. The encryption algorithm may be, for example, an algorithm that generates encrypted data using an encryption key. The encryption algorithm may include various algorithms, for example, a message digest algorithm (MD5), a secure hash algorithm (SHA), a Rivest Shamir Adleman algorithm (RSA), an Advanced Encryption Standard (AES), and a Data Encryption Standard (DES).

[0082] The encryption device 10 according to the exemplary embodiment can perform the real operation of the encryption operation and the virtual operation unrelated to the real operation. The real operation and the virtual operation can include the real round operation and the virtual round operation respectively. In this specification, the real operation and the virtual operation can be an encryption / decryption operation including the round operation (real round operation or virtual round operation). In an exemplary embodiment, a virtual round operation and a real round operation can each include a sub-round operation. For example, the sub-round operation can be classified into a real sub-round operation and a virtual sub-round operation.

[0083] In an exemplary embodiment, one round of virtual operation and one round of real operation may each include one real sub-round operation and a plurality of virtual sub-round operations of the first number. That is, one round of virtual operation may include one real sub-round operation and a plurality of virtual sub-round operations of the first number, and one round of real operation may include one real sub-round operation and a plurality of virtual sub-round operations of the first number. For example, the order of performing the real sub-round operation and the virtual sub-round operation in one round may be randomly changed. In an exemplary embodiment, the sum of the number of real sub-round operations and the number of virtual sub-round operations included in one round may be a power of 2. In other words, the value obtained by adding '1' to the first number may be a power of 2.

[0084] Figure 2 is a detailed block diagram of an encryption device according to an exemplary embodiment. For example, Figure 2 Can Figure 1 A detailed block diagram of the encryption device 10 is shown.

[0085] Reference Figure 2 The encryption device 10 may include an encryption / decryption controller 110, a key scheduler 120, and a data function module 130. The encryption / decryption controller 110 may control the overall operation of the encryption device 10. The encryption / decryption controller 110 may include a virtual operation (V-op) controller 112 and a virtual operation (V_op) register 114.

[0086] In an exemplary embodiment, when a real operation is requested, the virtual operation controller 112 may control the number of virtual operations to be performed before performing the real operation based on the delay number NUM_D indicating the number of delays received from outside the encryption device 10. For example, when a real operation is requested while a virtual operation is performed on the data function module 130, the virtual operation controller 112 may control the data function module 130 so that the virtual operation is performed as many times as the delay number NUM_D and then the real operation is performed.

[0087] For example, the delay number NUM_D may be a value received from a host (not shown) located outside the encryption device 10. As another example, the virtual operation controller 112 may control the number of virtual operations to be performed before performing a real operation based on a random value R_NUM received from a random number generator located outside the encryption device 10.

[0088] In an exemplary embodiment, the virtual operation registers 114 may each store a pair of data and an encryption key for a virtual sub-round operation. For example, each virtual operation register 114 may include a first virtual operation register and a second virtual operation register, and each of the first virtual operation register and the second virtual operation register may store a pair of virtual data and a virtual encryption key.

[0089] In an exemplary embodiment, based on certain random bits included in the random value R_NUM, one of the first virtual operation register and the second virtual operation register may be selected. A virtual sub-round operation may be performed based on dummy data and a dummy encryption key stored in a selected one of the first virtual operation register and the second virtual operation register. That is, whenever a virtual sub-round operation is performed, one of the first virtual operation register and the second virtual operation register may be selected. However, the above description is only an example, and the number of virtual operation registers 114 is not limited thereto.

[0090] The key scheduler 120 may process the encryption key for each sub-round operation. In an exemplary embodiment, the key scheduler 120 may receive the encryption key stored in the register and may perform a shift operation on the received encryption key based on the rule set for each sub-round operation. The rule may be pre-set. The register storing the encryption key may be a virtual operation register 114 or a real operation register (not shown in the figure). After processing the encryption key by performing the shift operation, the key scheduler 120 may provide the processed encryption key to the data function module 130. In addition, the key scheduler 120 may update the processed encryption key to the register that provided the encryption key before processing the encryption key.

[0091] The data function module 130 may perform an encryption operation on the input data DT based on the encryption key. The data function module 130 may perform an encryption operation based on the encryption key by performing, for example, an arrangement to thereby mix the positions of the bits of the data DT. Alternatively or additionally, the data function module 130 may perform an encryption operation based on the encryption key by performing a replacement to thereby replace the data with other mapping data. The data function module 130 may update the data DT on which the encryption operation is performed to the register. Depending on the type of the data DT and the encryption key, the operation performed by the data function module 130 may be determined as one of a real sub-round operation and a virtual sub-round operation.

[0092] In an exemplary embodiment, when data function module 130 performs cryptographic operations based on real data and real encryption key, cryptographic operations can be determined as real sub-round operations. Alternatively, when data function module 130 performs cryptographic operations based on dummy data and dummy encryption key, cryptographic operations can be determined as virtual sub-round operations. However, exemplary embodiments are not limited to this. When data function module 130 performs cryptographic operations based on dummy data and real encryption key, or based on real data and dummy encryption key, cryptographic operations can be determined as dummy sub-round operations.

[0093] In an exemplary embodiment, when a real operation request signal is received by the encryption / decryption controller 110 while a virtual operation is being performed by the data function module 130, the data function module 130 may not stop and may continue to perform the virtual operation that is in the process of being performed when the real operation request signal is received, thereby completing the virtual operation. In other words, the data function module 130 may perform all round operations included in the virtual operation that is in the process of being performed when the real operation request signal is received, thereby completing the round operation before performing the real operation requested by the real operation request signal.

[0094] Figure 3 is a flow chart of a method of operating an encryption device according to an exemplary embodiment. For example, Figure 3 Can Figure 2 The flowchart of the operation of the encryption device 10 is shown. Figure 2 Explanation Figure 3 Flowchart shown.

[0095] Reference Figure 3 In operation S10, the encryption device 10 may start to perform a virtual operation. In an exemplary embodiment, a unit of virtual operation may include a plurality of round operations. Each round operation may be, for example, a real round operation or a virtual round operation. The virtual operation may be performed by, for example, the data function module 130.

[0096] Next, in operation S20, the encryption device 10 may determine whether a real operation request signal is received. When a real operation request signal is not received (S20, No), the encryption device 10 may continue to perform a virtual operation. For example, the encryption device 10 may complete the currently executing virtual operation and may start to perform a new virtual operation.

[0097] On the other hand, when the real operation request signal is received (S20, yes), the encryption device 10 may determine whether the currently executed virtual operation has been completed. When it is determined that the virtual operation is not completed (S30, no), the encryption device 10 may continue to execute the virtual round operation included in the virtual operation in operation S40. In addition, when it is determined that the virtual operation is completed (S30, yes), the encryption device 10 may then start to execute the real operation in operation S50.

[0098] According to an exemplary embodiment, although a real operation request signal is received, since the encryption device 10 may not immediately perform a real operation and may continue to perform a virtual operation to complete the virtual operation, the real operation portion may not be determined despite the presence of a side channel attack (e.g., power waveform analysis by an attacker) on the encryption device 10. That is, the real operation is not immediately started in response to the real operation request signal, thereby obfuscating the side channel attack on the encryption device 10. Therefore, the encryption device 10 may have an enhanced defense function with respect to the side channel attack.

[0099] Figure 4 is a flow chart of a method of operating an encryption device according to an exemplary embodiment. For example, Figure 4 Can Figure 2 The operation of the encryption device 10 is shown in the flowchart. Figure 3 Provide instructions.

[0100] Reference Figure 4 , the encryption device 10 may perform a virtual operation in operation S110 and may determine in operation S120 whether a real operation request signal is received while performing the virtual operation. When no real operation request signal is received (S120, No), the encryption device 10 may continue to perform the virtual operation.

[0101] When the real operation request signal is received (S120, yes), the encryption device 10 may receive a delay number NUM_D indicating the number of delays in operation S130. For example, the delay number NUM_D may be a value received from a host (not shown) located outside the encryption device 10, or may be a random value received from a random value generator (not shown) located outside the encryption device 10. The random value may be generated by, for example, a linear feedback shift register (LFSR) or a random number generator (RNG) located outside the encryption device 10.

[0102] After receiving the delay number, the encryption device 10 may determine whether the virtual operation is completed in operation S140. When it is determined that the virtual operation is not completed (S140, No), the encryption device 10 may continue to perform the virtual round operation included in the virtual operation in operation S150.

[0103] In addition, when it is determined that the virtual operation has been completed (S140, yes), the encryption device 10 may repeat the virtual operation in operation S160 for a number of times equal to the delay number NUM_D. For example, when the delay number NUM_D indicates that the number of delays is equal to N (where N is a natural number equal to or greater than 1), in addition to the virtual operation being executed when the real operation request signal is received, the encryption device 10 may also perform the virtual operation N-1 times. However, exemplary embodiments are not limited to this. When the delay number NUM_D is equal to N, in addition to the virtual operation being executed when the real operation request signal is received, the encryption device 10 may perform the virtual operation N times. That is, the delay number may or may not include the virtual operation being executed when the real operation request signal is received. As another example, the encryption device 10 may control the number of virtual operations to be performed before performing the real operation at operation S170 based on a random value R_NUM received from the outside.

[0104] In the present exemplary embodiment, it has been described that the encryption device 10 receives the real operation request signal in operation S120 and then receives the delay number NUM_D indicating the delay number in operation S130. However, the exemplary embodiment is not limited thereto. That is, the encryption device 10 may receive the delay number at any time while the virtual operation is being performed.

[0105] According to an exemplary embodiment, although a real operation request signal is received, the real operation is not immediately performed, and the real operation is performed after further repeating the virtual operation as many times as the delay number NUM_D. Therefore, although there is a side channel attack on the encryption device 10, the real operation part is not determined. Therefore, the encryption device 10 can have an enhanced defense function with respect to the side channel attack.

[0106] Figure 5 is a timing diagram for explaining each operation of the encryption device according to an exemplary embodiment. For example, Figure 5 Can be used to explain Figure 2 The timing diagram of the operation of the encryption device 10 is shown in FIG. Figure 2 Explanation Figure 5 Timing diagram shown.

[0107] Reference Figure 5, the virtual operation request signal S_V_op may be activated at the first time point t1. For example, when the option to perform the virtual operation of the encryption device 10 is turned on, the encryption device 10 may be reset, and the virtual operation request signal S_V_op may be activated. As another example, when the option to perform the virtual operation of the encryption device 10 is turned off, the option to perform the virtual operation of the encryption device 10 is turned on, and the virtual operation request signal S_V_op may be activated.

[0108] The virtual operation may be performed based on the activated virtual operation request signal S_V_op. In addition, at the first time point t1, the encryption device 10 may receive a delay number NUM_D indicating the number of delays. Figure 5 In the exemplary embodiment shown in FIG. 1 , each signal is described as being activated in a logic high state. However, the exemplary embodiment is not limited thereto, and the signal may be activated in a logic low state. In addition, in the exemplary embodiment, the delay number NUM_D is equal to '4', but this is only an example provided for ease of explanation, and the exemplary embodiment is not limited thereto.

[0109] The first virtual operation (①) and the second virtual operation (②) may be performed in response to the virtual operation request signal S_V_op. While the third virtual operation (③) is performed in response to the virtual operation request signal S_V_op, the real operation request signal S_R_op may be activated at the second time point t2. In an exemplary embodiment, the encryption device 10 may not stop and may continue to perform the third virtual operation (③) at the second time point t2, thereby completing the third virtual operation (③). That is, the encryption device 10 may perform all round operations included in the third virtual operation (③) and may complete the third virtual operation (③) by the third time point t3.

[0110] In an exemplary embodiment, after the third time point t3, the encryption device 10 may further perform the virtual operation three times, for example: Figure 5 , the fourth virtual operation (④), the fifth virtual operation (⑤) and the sixth virtual operation (⑥) shown in . That is, since the delay number NUM_D is equal to '4' and the third virtual operation (③) is completed after the real operation request signal S_R_op is activated until the third time point t3, the encryption device 10 can also perform other virtual operations (fourth virtual operation ④ to sixth virtual operation ⑥) three times. However, the exemplary embodiment is not limited to this. The encryption device 10 may not count the virtual operations completed at the third time point t3, and may also perform the virtual operation four times.

[0111] The additional virtual operation may be completed by the fourth time point t4, and the real operation may be performed. The real operation may be performed from the fourth time point t4 to the fifth time point t5, and the real operation request signal S_R_op may be deactivated at the fifth time point t5.

[0112] Figure 6 is a diagram showing a portion of an encryption device for performing encryption operations according to an exemplary embodiment. For example, Figure 6 It can be shown that the Figure 4 An example of a logic circuit structure for the operation shown. For example, Figure 6 The logic circuit structure shown may include Figure 2 The virtual operation controller 112 is shown.

[0113] Reference Figure 6 The encryption device 10 may include a logic circuit, a delay counter 250 and a comparator 260 to perform Figure 4 1. In the operation shown, the logic circuit includes a subtractor 210, a first multiplexer 220, a second multiplexer 230, and a third multiplexer 240. Based on the output from the comparator 260, the first multiplexer 220 may select the value input from the subtractor 210 or the value input from the delay counter 250 as the output value. For example, in the case where the comparator 260 determines that the count value of the delay counter 250 is not equal to '0', the first multiplexer 220 may select the value input from the subtractor 210 as the output value.

[0114] The second multiplexer 230 may select the delay number or the value input from the first multiplexer 220 as the output value in response to the real operation request signal S_R_op. For example, in the case where the real operation request signal S_R_op is activated, the second multiplexer 230 may select the value input from the first multiplexer 220 as the output value.

[0115] The third multiplexer 240 may select a value input from the delay counter 250 or a value input from the second multiplexer 230 as an output value in response to the last round signal. For example, the last round signal may be a signal activated during the last round operation included in the virtual operation or the real operation. In the case where the last round signal is activated, the third multiplexer 240 may select a value input from the second multiplexer 230 as an output value.

[0116] While the virtual operation is being performed, when the real operation request signal S_R_op is activated, the first multiplexer 220 may be set to select the value input from the subtractor 210 as the output value, and the second multiplexer 230 may be set to select the value input from the first multiplexer 220 as the output value. In addition, the third multiplexer 240 may be set to select the value input from the second multiplexer 230 as the output value.

[0117] Therefore, when the real operation request signal S_R_op is activated, the delay counter 250 can perform counting by subtracting '1' from the delay number NUM_D each time. The comparator 260 can determine whether the value output from the delay counter 250 is equal to 0, and when the value output from the delay counter 250 is equal to 0, a signal can be output to perform a real operation. In addition, since the third multiplexer 240 selects an output value based on whether the last round signal is activated, when the delay number NUM_D is equal to '0', although the real operation request signal S_R_op is activated, the encryption device 10 can still complete the execution of the last round operation of the virtual operation that is already being executed and then can execute the next real operation.

[0118] Figure 7 is a flow chart of a round formation operation of an encryption device according to an exemplary embodiment. For example, Figure 7 Can Figure 2 The flowchart of the operation of the encryption device 10 is shown. Figure 2 Explanation Figure 7 Flowchart shown.

[0119] Reference Figure 7 In operation S210, the encryption device 10 may initialize a counter and a random value and may start a round. The counter may count sub-round operations performed sequentially. The random value may be a value that becomes a basis of a time point when a real sub-round operation is performed in one round. For example, the random value may be stored in a register. In an exemplary embodiment, the encryption device 10 may store a random value R_NUM input from the outside of the encryption device 10 as an initialization value in the register.

[0120] In operation S220, the encryption device 10 may count the sub-round operations using a counter and may derive a count value. In operation S230, the encryption device 10 may determine whether the derived count value is equal to the initialized random value. For example, a comparator may compare the count value with the random value and determine whether the output count value is equal to the random value.

[0121] When the count value is equal to the random value (S230, Yes), the encryption device 10 may perform a real sub-round operation in operation S240. On the contrary, when the count value is different from the random value (S230, No), the encryption device 10 may perform a virtual sub-round operation in operation S250.

[0122] In operation S260, a determination may be made to determine whether the derived count value is equal to a reference count value. The reference count value may be preset. In an exemplary embodiment, the reference count value may be a maximum count value. The maximum count value may be, for example, the number of sub-round operations to be included in one round. In an exemplary embodiment, the maximum count value may be a 'value obtained by subtracting 1 from a power of 2'. For example, a comparator may compare the count value with the reference count value and determine whether the outputted count value is equal to the reference count value.

[0123] When the count value is equal to the reference count value (S260, Yes), the encryption device 10 may complete one round. On the contrary, when the count value is different from the reference count value (S260, No), the encryption device 10 may return to operation S220 again.

[0124] Figure 8 is a diagram showing a portion of an encryption device for round formation operation according to an exemplary embodiment. For example, Figure 8 It can be shown that the Figure 7 An example of a logic circuit structure for the operation shown. For example, Figure 8 The logic circuit structure shown may include Figure 2 The virtual operation controller 112 is shown.

[0125] Reference Figure 8 , the encryption device 10 may include a logic circuit, a counter 340, a register 350, and a first comparator 360 and a second comparator 370 for a round forming operation, and the logic circuit includes an adder 310, a first multiplexer 320, and a second multiplexer 330. In an exemplary embodiment, the counter 340 may count the sub-round operations performed sequentially, and in addition to inputting an initialization value, the counter 340 may increase the number of counts by 1.

[0126] When the count value has a maximum value, the counter 340 may perform initialization. For example, when the count value is expressed as an 8-bit binary number, the maximum value may be 2'b1111_1111. For example, the initial value I_V1 of the counter 340 may be a value obtained by subtracting the number of times the real sub-round operation and the virtual sub-round operation included in one round are performed from the maximum value. The second comparator 370 may compare the maximum count value with the count value of the counter 340 and may output a signal indicating the end of one round based on whether the two values ​​(i.e., the maximum count value and the count value) are equal to each other.

[0127] The register 350 may store a random value that is the execution basis of the real sub-round operation. For example, the random value may form at least some of the bits used to form the initial value I_V2. The register 350 may perform initialization of the random value by inputting the initial value I_V2. For example, the initial value I_V2 may be a random value R_NUM received from outside the encryption device 10.

[0128] The first comparator 360 may compare the count value of the counter 340 with the random value stored in the register 350. For example, when the count value of the counter 340 is equal to the random value stored in the register 350, the first comparator 360 may output the real sub-round operation execution signal Sub_Real_on. Therefore, the time point when the read sub-round operation is performed in one round may be randomly determined.

[0129] Fig. 9 is a table showing examples of various options that may be set during a round formation operation according to an exemplary embodiment. For example, Fig. 9 The reference is performed based on 8 bits. Figure 7 and Figure 8 However, this is only an example provided for the convenience of explanation, and the exemplary embodiments are not limited thereto. Figure 8 Explanation Fig. 9 Table shown.

[0130] Reference Fig. 9 , based on 8 bits, the initial value I_V1 of the counter 340 may be expressed as eight different bits. In addition, the initial value I_V2 of the random value input to the register 350 may correspond to the initial value I_V1 of the counter 340 and may be expressed as eight different bits. In the bit formation of the initial value I_V2, 'rand[]' may be a random function. Fig. 9 In the present example shown in FIG. 1 , each of the initial values ​​I_V1 and I_V2 is written in a hardware technology language (e.g., Verilog). sub_round_cnt is a count value of a sub-round operation processed by the counter 340. However, this is merely an example provided for ease of explanation, and exemplary embodiments are not limited thereto.

[0131] In an exemplary embodiment, the ratio of the real sub-round operations and the virtual sub-round operations included in executing one round can be set as an option. For example, when the virtual sub-round operation option is given as n (where n is an integer equal to or greater than 0), the sum of the number of real sub-round operations and the number of virtual sub-round operations can be set to 2. n+1That is, when a real sub-round operation and a virtual sub-round operation are executed in one round, and when the virtual sub-round operation option is given as n, the number of times the virtual sub-round operation is executed can be set to 2. n+1 -1.

[0132] According to an exemplary embodiment, the encryption device 10 may set a ratio of a real sub-round operation and a virtual sub-round operation included in executing one round as an option, and thus may implement the round forming operation using simple logic in a binary register structure.

[0133] Fig.10 is a conceptual diagram of an example of executing a round when forming a round according to an exemplary embodiment. For example, Fig.10 Show Figure 7 and Figure 8 The rounds shown are examples of results of the operations.

[0134] Reference Fig.10 , performing an encryption operation including five rounds of operations. For example, the encryption operation may be referenced Figure 5 Real or virtual operations described. Fig.10 It can be shown that the real sub-round operation and the virtual sub-round operation included in each round are executed at a ratio of 1:3. That is, in each of the five round operations, one real sub-round operation and three virtual sub-round operations can be randomly executed. In each round operation, the time point when the virtual sub-round operation is executed can be determined based on the random bit included in the initial value I_V2. Therefore, when performing the encryption operation, the randomness of the real sub-round operation can be ensured, and the real sub-round operation can be uniformly executed.

[0135] Fig.11 is a flow chart of a method of operating an encryption device according to an exemplary embodiment. For example, Fig.11 Can Figure 2 The flowchart of the operation of the encryption device 10 is shown. Figure 2 Explanation Fig.11 Flowchart shown.

[0136] Reference Fig.11 In operation S310, the encryption device 10 may receive a random bit. For example, based on the random bit, one of the virtual operation registers 114 may be selected. In an exemplary embodiment, the random bit may be included in a random value R_NUM received from outside the encryption device 10. The random bit may be generated by, for example, an LFSR or RNG located outside the encryption device 10 as described above.

[0137] In operation S320, the encryption device 10 may select one of the virtual operation registers 114 based on the random bit. For example, the selection of one of the virtual operation registers 114 may be performed by a multiplexer that operates based on the random bit. In an exemplary embodiment, each virtual operation register 114 may store a pair of dummy data and a dummy encryption key for a virtual sub-round operation. In operation S330, the encryption device 10 may perform one sub-round operation based on the dummy data and the dummy encryption key stored in the selected virtual operation register 114.

[0138] Fig.12 is a table for explaining the operation of the encryption device according to the exemplary embodiment.

[0139] Reference Fig.12 In Table T1, combinations of virtual operations V_op, real operations R_op, virtual sub-round operations Virtual_sub_round, and real sub-round operations Real_sub_round are shown. Specifically, in one virtual operation V_op, virtual sub-round operations Virtual_sub_round and real sub-round operations Real_sub_round can be executed. In addition, in one real operation R_op, virtual sub-round operations Virtual_sub_round and real sub-round operations Real_sub_round can be executed.

[0140] In an exemplary embodiment, in a virtual operation V_op, an encryption operation may be performed based on a pair of dummy data and a dummy encryption key, regardless of whether the sub-round operation is a virtual sub-round operation Virtual_sub_round or a real sub-round operation Real_sub_round. As another example, in a virtual operation V_op, an encryption operation may be performed based on a pair of dummy data and a real encryption key or a pair of real data and a dummy encryption key.

[0141] In an exemplary embodiment, in a real operation R_op, in the case of a virtual sub-round operation Virtual_sub_round, an encryption operation may be performed based on the pair of dummy data and the dummy encryption key. As another example, in a real operation R_op, in the case of a virtual sub-round operation Virtual_sub_round, an encryption operation may be performed based on the pair of dummy data and the real encryption key or the pair of real data and the dummy encryption key.

[0142] In an exemplary embodiment, in a real operation R_op, in the case of a real sub-round operation Real_sub_round, an encryption operation may be performed based on the pair of real data and a real encryption key. In other words, in a real operation R_op, an encryption operation based on real data and a real encryption key may be a real sub-round operation Real_sub_round in the real operation R_op.

[0143] Fig.13 is a diagram of a portion of an encryption device for performing encryption operations according to an exemplary embodiment. For example, Fig.13 It can be shown that the implementation Fig.11 An example of a logic circuit structure for the operation shown. For example, Fig.13 The logic circuit structure shown may include Figure 2 The virtual operation register 114 is shown.

[0144] Reference Fig.13 The encryption device 10 may include a logic circuit and a second multiplexer 450 to implement Fig.11 In the operation shown, the logic circuit includes a first virtual operation register 410, a second virtual operation register 420, a real operation register 430, and a first multiplexer 440. In this embodiment, there are two virtual operation registers. However, one or more embodiments are not limited thereto.

[0145] The first virtual operation register 410 can store first virtual data and a first virtual encryption key (virtual data / key 1). The second virtual operation register 420 can store second virtual data and a second virtual encryption key (virtual data / key 2).

[0146] The first multiplexer 440 may receive a pair of first dummy data and a first dummy encryption key from the first virtual operation register 410 and may receive a pair of second dummy data and a second dummy encryption key from the second virtual operation register 420. The first multiplexer 440 may also receive a random bit R_B and may selectively receive one of the pair of first dummy data and the first dummy encryption key and the pair of second dummy data and the second dummy encryption key based on the random bit R_B. The selection of the first multiplexer 440 may be performed in each virtual sub-round operation. Therefore, even when the virtual sub-round operation is continuously performed, the encryption device 10 may randomly perform the switching of registers for data / encryption key.

[0147] The second multiplexer 450 may select one of the output from the first multiplexer 440 and the output from the real operation register 430 (i.e., real data / key) in response to the real sub-round operation execution signal Sub_Real_on, and may output the selected output. Since the encryption device 10 according to the exemplary embodiment may randomly perform the switching of the register regardless of whether the continuous sub-round operation is a virtual sub-round operation or a real sub-round operation, the real operation part may not be determined despite the presence of a side channel attack (specifically, power waveform analysis). Therefore, the encryption device 10 may have an enhanced defense function against a side channel attack.

[0148] Fig.14 is a graph showing a power waveform that varies with the operation of an encryption device according to an exemplary embodiment. Specifically, Fig.14 The graph shown shows the transition power between each sub-round operation. For example, Fig.14 Can be followed by Fig.11 A graph of power waveforms that vary with the operation of the encryption device shown. Fig.14 An example of a power waveform graph when a real sub-round operation and a virtual sub-round operation are performed at a ratio of 1:3 is shown. However, this is merely an example provided for convenience of explanation, and exemplary embodiments are not limited thereto.

[0149] Reference Fig.14 , the power consumed in the continuous virtual sub-round operation VR may be the same as the power consumed when the virtual sub-round operation VR is switched to the real sub-round operation RR, for example, with a probability of 50%. Therefore, since it is not usually inferred that the real sub-round operation RR is performed before and after the part with the most power consumption, the stability of the encryption operation can be improved.

[0150] In addition, the virtual sub-round operation VR can be randomly selected, and therefore, it can generally not be inferred that a specific operation is performed before and after a portion where the power waveform is low. In addition, since the ratio of the virtual sub-round operation VR is greater than the ratio of the real sub-round operation RR, interference with the position of the real round operation can be effectively prevented.

[0151] Fig.15 is a block diagram of a memory card 1000 according to an exemplary embodiment.

[0152] Reference Fig.15 , the memory card 1000 may include a host interface 1010, a memory controller 1020, and a flash memory interface (flash I / F) 1030. In addition, the memory controller 1020 may further include an encryption device 1022 according to an exemplary embodiment.

[0153] The host interface 1010 may perform an interface with the host 900 based on a card protocol to exchange various types of data between the host 900 and the memory card 1000. The memory card 1000 may be applied to a Multimedia Card (MMC), a Security Digital (SD) card, a mini SD card, a memory stick, a smart media, a TransFlashcard, etc. The memory controller 1020 may receive data from / transmit data to a flash memory (not shown) through a flash memory interface 1030. The flash memory may be a non-volatile memory, such as a NAND flash memory. The memory controller 1020 may control various operations of the flash memory through the flash memory interface 1030. The memory card 1000 includes an encryption device 1022 according to an exemplary embodiment, and although there is a side channel attack on the memory card 1000, the real operation part will not be determined. Therefore, the stability of the memory card 1000 may be improved.

[0154] While the inventive concept has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood that various changes in form and details may be made therein without departing from the spirit and scope of the following claims.

Claims

1. A method for operating an encryption device, characterized in that: The method comprises: performing a plurality of virtual operations unrelated to real operations, wherein the plurality of virtual operations include cryptographic operations using at least one of dummy data or dummy cryptographic keys, and the real operations and the plurality of virtual operations are used to perform the cryptographic operations; When a real operation request signal is received while a current virtual operation among the plurality of virtual operations is being executed, continuing to execute the current virtual operation; and In response to the end of the current virtual operation, under the execution of the encryption operation, the real operation of the encryption operation requested by the real operation request signal is executed based on the data to be encrypted and the encryption key associated with the data to be encrypted, The multiple virtual operations are performed to mask the real operations.

2. The method according to claim 1, characterized in that Also includes receiving a delay number from outside the encryption device, In response to the end of the current virtual operation, before executing the real operation, the plurality of virtual operations are continuously executed for a number of times equal to the delay number.

3. The method according to claim 2, characterized in that The delay number includes a value received from a host external to the encryption device.

4. The method according to claim 2, characterized in that: The delay number includes a random value received from a random value generator external to the encryption device.

5. The method according to claim 1, characterized in that: Each of the plurality of virtual operations and the real operation includes a plurality of round operations, and One round of the virtual operation and one round of the real operation each include a plurality of sub-round operations.

6. The method according to claim 5, characterized in that The plurality of sub-round operations are classified into real sub-round operations and virtual sub-round operations, and The method also includes forming a plurality of rounds, each of the plurality of rounds including a real sub-round operation and a first number of a plurality of virtual sub-round operations.

7. The method according to claim 6, characterized in that The encryption device further comprises a counter and a real sub-round operation register, wherein the real sub-round operation register is configured to store a random value, and Forming the plurality of rounds comprises: Initialize the counter and the random value and start forming the first round; The counter sequentially counts the plurality of sub-round operations and derives the count value; When the count value is equal to the random value, the real sub-round operation is performed, and when the count value is different from the random value, a virtual sub-round operation is performed; and When the count value is equal to the reference count value, the first round is completed.

8. The method according to claim 6, characterized in that The first number is 2 n The value obtained by -1, where n is a positive integer.

9. The method according to claim 6, characterized in that wherein the virtual operation includes the encryption operation based on the dummy data and the dummy encryption key, and The encryption device comprises a plurality of virtual operation registers, each of the plurality of virtual operation registers is configured to store the dummy data and the dummy encryption key, and the virtual sub-round operation is based on the dummy data and the dummy encryption key.

10. The method according to claim 9, characterized in that Also includes: receiving a plurality of random bits; selecting one of the plurality of virtual operating registers based on the plurality of random bits; as well as A sub-round operation is performed based on the dummy data and the dummy encryption key stored in the one of the plurality of virtual operation registers.

11. A method of operating an encryption device for performing real operations and virtual operations unrelated to the real operations, characterized in that: Each of the virtual operation and the real operation includes a plurality of round operations, each of the plurality of round operations includes a plurality of sub-round operations, the plurality of sub-round operations are classified into real sub-round operations and virtual sub-round operations, the real operation and the virtual operation are used to perform encryption operations, and the method includes: Initializing count values ​​and random values ​​associated with the plurality of sub-round operations, and starting to form a round of the plurality of sub-round operations including one real sub-round operation including an encryption operation based on data to be encrypted and an encryption key associated with the data to be encrypted and a plurality of virtual sub-round operations of the encryption operation based on at least one of dummy data or a dummy encryption key; deriving the count value by counting the plurality of sub-round operations; When the count value is equal to the random value, the one real sub-round operation is performed, and when the count value is different from the random value, one of the plurality of virtual sub-round operations is performed; and When the count value is equal to the reference count value, the round is completed, The virtual operation is performed to mask the real operation.

12. The method according to claim 11, characterized in that The sum of the first number of times the one real sub-round operation is executed and the second number of times the multiple virtual sub-round operations are executed is equal to 2 n , where n is a positive integer, and The one real sub-round operation and the multiple virtual sub-round operations are included in the round.

13. The method according to claim 11, characterized in that Also includes: Under the execution of the encryption operation, executing the virtual operation; When a real operation request signal is received, determining whether the plurality of rounds of operations included in the virtual operation being executed have been completed; as well as In response to the plurality of rounds of operations being completed, the real operation is performed in response to the real operation request signal.

14. The method according to claim 13, characterized in that Also includes a delay number received from outside the encryption device, The actual operation includes: In response to the plurality of rounds of operations being completed, the virtual operation is executed a number of times equal to the delay number before the real operation is executed under the execution of the encryption operation.

15. The method according to claim 11, characterized in that The encryption device includes a first virtual operation register and a second virtual operation register, each of the first virtual operation register and the second virtual operation register is configured to store the dummy data and the dummy encryption key, the plurality of virtual sub-round operations are based on the dummy data and the dummy encryption key, The method further comprises: selecting one of the first virtual operating register and the second virtual operating register based on a random bit; and A sub-round operation is performed based on the dummy data and the dummy encryption key stored in the selected one of the first virtual operation register and the second virtual operation register.

16. The method according to claim 15, characterized in that The random value includes the random bits.

17. An encryption device, characterized in that: include: a logic circuit for executing a real operation and a virtual operation unrelated to the real operation, wherein the virtual operation and the real operation each include a plurality of round operations, wherein the plurality of round operations each include a plurality of sub-round operations, wherein the plurality of sub-round operations are classified into a real sub-round operation of an encryption operation based on data to be encrypted and an encryption key corresponding to the data to be encrypted and a virtual sub-round operation of the encryption operation based on at least one of dummy data or a dummy encryption key, and the real operation and the virtual operation are used to execute the encryption operation, The logic circuit comprises: a first virtual operation register configured to store first dummy data and a first dummy encryption key, the virtual sub-round operation being based on the first dummy data and the first dummy encryption key; a second virtual operation register configured to store second dummy data and a second dummy encryption key, the virtual sub-round operation being based on the second dummy data and the second dummy encryption key; a first multiplexer configured to receive a first output from the first virtual operation register and a second output from the second virtual operation register, select one of the first output or the second output based on a random bit when performing the encryption operation, and output the selected one of the first output or the second output, The virtual operation is performed to mask the real operation.

18. The encryption device according to claim 17, characterized in that: The logic circuit further comprises: a real operation register configured to store real data and a real encryption key, the real sub-round operation being based on the real data and the real encryption key; and The second multiplexer is configured to receive a third output from the real operation register and a fourth output from the first multiplexer, select one of the third output or the fourth output in response to a real sub-round operation execution signal when executing the encryption operation, and output the selected one of the third output or the fourth output.

19. The encryption device according to claim 17, characterized in that: The logic circuit further comprises: a data function module configured to perform the encryption operation based on the virtual operation and the real operation; and The encryption / decryption controller is configured to receive a delay number from outside the encryption device, and when the data function module receives a real operation execution request while the virtual operation is being executed, control the data function module to execute the virtual operation a number of times equal to the delay number while executing the encryption operation.

20. The encryption device according to claim 17, characterized in that: Each of the plurality of round operations includes one real sub-round operation and a plurality of virtual sub-round operations.

Images