Cryptographic circuitry for performing virtual cryptographic operations

Abstract

An encryption circuit includes a pipelined encryption core having a plurality of round cores. The pipelined encryption core is configured to perform a real round operation on each of a plurality of input data received; and to generate encrypted data from the input data using an encryption operation including the real round operation. An encryption controller coupled to the pipelined encryption core is provided. The encryption controller is configured to control the pipelined encryption core so that at least one of the plurality of round cores performs a virtual round operation as part of the encryption operation. The pipelined encryption core is configured to perform a virtual encryption operation using at least one of the following: (i) dummy data; and (ii) a dummy encryption key.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of Korean Patent Application No. 10-2018-0119306, filed on October 5, 2018, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The inventive concept relates to an encryption circuit for performing encryption operations and an operation method thereof, and more particularly, to an encryption circuit for performing virtual encryption operations and a method for performing virtual encryption. Background Art

[0004] Smart cards and integrated circuit (IC) cards include security information about users. An encryption circuit for preventing security information about users from being leaked due to hacker attacks, etc., is required, which generates and transmits a ciphertext of security information transmitted via a signature or authentication process.

[0005] A hacker may perform a side channel analysis attack instead of directly manipulating input or output data. In a side channel analysis attack, a hacker may collect a plurality of auxiliary information, such as the amount of power consumed by an encryption circuit and the waveform of an electromagnetic wave generated by the encryption circuit. A hacker may attack the encryption circuit based on the collected plurality of auxiliary information to detect a key used in the encryption circuit. Therefore, a side channel analysis attack prevention method may use a method of randomly or uniformly showing the power and electromagnetic waves each included in the information collected via the side channel. Summary of the invention

[0006] The inventive concept provides an encryption circuit for performing a real encryption operation and a virtual encryption operation on data and an operation method thereof.

[0007] According to one aspect of the inventive concept, there is provided an encryption circuit including a pipeline encryption core, the pipeline encryption core including a plurality of round cores configured to perform a real round operation on each of a plurality of input data input in sequence. The pipeline encryption core outputs encrypted data via an encryption operation using the real round operation. An encryption controller is provided, the encryption controller being configured to perform control so that at least one of the plurality of round cores additionally performs a virtual round operation. The encryption controller may be configured to perform control so that the virtual round operation of at least one round core is performed in parallel with the real round operation of at least one other round core of the plurality of round cores.

[0008] According to another aspect of the inventive concept, there is provided an encryption circuit including a first round core, a second round core, and a key scheduler, wherein the first round core is configured to perform a first real round operation on input data, the second round core is configured to perform a second real round operation on the input data based on a result of the first real round operation, and the key scheduler is configured to provide a round key (i.e., an encryption key) to each of the first round core and the second round core. The first round core may be further configured to perform a first virtual round operation based on dummy data or a first virtual round key provided by the key scheduler, and the first virtual round operation of the first round core may be performed in parallel with the second real round operation.

[0009] According to another aspect of the inventive concept, there is provided an encryption circuit including a first round core, a second round core, and a key scheduler, wherein the first round core is configured to perform a first real round operation on input data, and the second round core is configured to perform a second real round operation on the input data based on a result of the first real round operation. The key scheduler is configured to provide a round key to each of the first round core and the second round core. The second round core may be further configured to perform a virtual round operation based on dummy data or a virtual round key provided by the key scheduler, and the first real round operation may be performed in parallel with the virtual round operation of the second round core.

[0010] According to another embodiment of the present invention, there is provided an encryption circuit having a pipeline encryption core, wherein the pipeline encryption core has a plurality of round cores (i.e., encryption cores). The pipeline encryption core is configured to: (i) perform a real round operation on each of a plurality of input data received; and (ii) generate encrypted data from the input data using an encryption operation including the real round operation. An encryption controller is also provided, which is coupled to the pipeline encryption core. The encryption controller is configured to control the pipeline encryption core so that at least one of the plurality of round cores performs a virtual round operation as part of the encryption operation. In some of these embodiments of the present invention, a virtual round operation may be performed in a first round core of the plurality of round cores, and a real round operation may be performed in parallel with the virtual round operation in a second round core of the plurality of round cores. The pipeline encryption core may be configured to perform a virtual encryption operation using at least one of the following: (i) dummy data; and (ii) a dummy encryption key. In other embodiments of the present invention, the pipeline encryption core may include pipelined round cores that are spaced apart from each other in the pipeline arrangement by corresponding registers. The pipelined encryption core may also include a key scheduler configured to generate real keys and virtual keys that are used by the plurality of round cores when performing real and virtual encryption operations.

[0011] According to an additional embodiment of the present invention, the encryption circuit has an encryption core. This encryption core is configured to perform a real encryption operation on at least a portion of an input data stream using at least one real encryption key. The real encryption operation is performed in parallel with generating virtual encryption noise by performing a virtual encryption operation on virtual data using a virtual encryption key. The encryption core may include a pipeline encryption core having a plurality of round cores (e.g., encryption cores) arranged in a pipelined manner. In addition, during the real encryption operation, the first round core in the round core of the pipeline encryption core can encrypt the first input data using the first real encryption key. In addition, during the virtual encryption operation, the second round core in the round core of the pipeline encryption core can encrypt the first virtual data using the first virtual encryption key. The encryption of the first input data and the encryption of the first virtual data can be performed in parallel in the pipeline encryption core, thereby facilitating the favorable generation of virtual encryption noise. This virtual encryption noise can operate to prevent successful side channel analysis attacks. A key scheduler may also be provided and is configured to generate a first real encryption key and a first virtual encryption key at respective outputs thereof, the respective outputs being electrically coupled to a first one of the wheel cores and a second one of the wheel cores. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Embodiments of the present inventive concept will be more clearly understood from the following detailed description in conjunction with the accompanying drawings, in which:

[0013] Figure 1 is a block diagram of a computing device according to an embodiment;

[0014] Figure 2 is a block diagram of an encryption circuit according to an embodiment;

[0015] Figure 3 is a block diagram of a pipelined encryption core included in an encryption circuit according to an embodiment;

[0016] Figure 4 is a flow chart of an encryption operation performed by an encryption circuit according to an embodiment;

[0017] Figure 5 is a flowchart for describing the operation of an encryption controller of an encryption circuit according to an embodiment;

[0018] Figures 6 to 8 is a timing diagram of the operation of the encryption circuit according to the embodiment;

[0019] Fig. 9 is a flowchart for describing the operation of an encryption controller of an encryption circuit according to an embodiment;

[0020] Figures 10 to 12 is a timing diagram for describing the operation of an encryption circuit according to an embodiment; and

[0021] Fig.13 is a timing diagram for describing the operation of the encryption circuit according to the embodiment. DETAILED DESCRIPTION

[0022] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

[0023] Figure 1 is a block diagram of a computing device 1000 according to an embodiment. Figure 1 1 is a block diagram showing a computing device 1000 including an electronic device and an encryption circuit according to an embodiment. In one embodiment, the computing device 1000 may include a processor device 1100, a working memory 1200, a storage memory 1300, a user interface 1400, and a bus 1500.

[0024] For example, the computing device 1000 may be one of various electronic devices such as a desktop computer, a laptop computer, a tablet computer, a workstation, a server, a digital television (TV), a video game console, a smart phone, and a wearable device, but the present embodiment is not limited thereto.

[0025] The processor device 1100 may control the overall operation of the computing device 1000. The processor device 1100 may be configured to perform various arithmetic operations and / or logic operations. To this end, the processor device 1100 may be implemented as a dedicated logic circuit, such as a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or a similar type of circuit including one or more processor cores 1110. In an embodiment, the processor device 1100 may include a general-purpose processor, a dedicated processor, and / or an application processor.

[0026] In some embodiments, the processor device 1100 may execute an instruction set including a program code by using the processor core 1110. The one or more caches 1130 may temporarily store data to be used for executing the instruction set or data generated by executing the instruction set.

[0027] The processor device 1100 may encrypt data output from each of the processing core 1110 and / or the cache 1130 by using the encryption circuit 1150. In addition, by using the encryption circuit 1150, the processor 1100 may decrypt data to be input to the processor core 1110 and / or the cache 1130.

[0028] The working memory 1200 may temporarily store data used for the operation of the computing device 1000. For example, the working memory 1200 may store data obtained by processing by the processor device 1100 or data to be processed by the processor device 1100 in one or more memories 1210. In some embodiments, the memory 1210 may include a volatile memory such as a static random access memory (SRAM), a dynamic random access memory (DRAM), or a synchronous dynamic random access memory (SDRAM). The memory controller 1230 may control the memory 1210 so that the memory 1210 stores data or outputs the stored data.

[0029] The working memory 1200 may encrypt data to be stored in each memory 1210 by using the encryption circuit 1250. In addition, by using the encryption circuit 1250, the working memory 1200 may decrypt data output from each memory 1210. The storage memory 1300 may store data regardless of whether power is supplied. The storage memory 1300 may store system data for operating the computing device 1000 and / or user data for use by a user of the computing device 1000 in one or more nonvolatile memories 1310. For example, the nonvolatile memory 1310 may include at least one of the following nonvolatile memories, such as a flash memory, a phase change random access memory (PRAM), a magnetoresistive random access memory (MRAM), a resistive random access memory (ReRAM), and a ferroelectric random access memory (FRAM). The memory controller 1330 may control the nonvolatile memory 1310 so that the nonvolatile memory 1310 stores data or outputs the stored data. For example, the storage memory 1300 may include a storage medium such as a solid state drive (SSD), a hard disk drive (HDD), a solid state digital (SD) card, or a multimedia card (MMC).

[0030] The storage memory 1300 may encrypt data to be stored in each nonvolatile memory 1310 by using the encryption circuit 1350. In addition, the storage memory 1300 may decrypt data output from each nonvolatile memory 1310 by using the encryption circuit 1350.

[0031] The user interface 1400 may perform interactive communication between the user and the computing device 1000 according to the control of the processor device 1100. For example, the user interface 1400 may process input received via a keyboard, a mouse, a keypad, a button, a touch panel, a touch screen, a touch pad, a touch ball, or a microphone, or may process input from a camera, a gyro sensor, or a vibration sensor. In addition, the user interface 1400 may process output to be provided to a display device, a speaker, or a monitor.

[0032] The bus 1500 may provide a communication path between the elements of the computing device 1000. The elements of the computing device 1000 may exchange data based on a bus format. For example, the bus format may include one or more of a variety of communication protocols, such as Peripheral Component Interconnect (PCI), PCI Express (PIC-E), Non-Volatile Memory Express (NVMe), Small Computer System Interface (SCSI), Advanced Technology Attachment (ATA), Serial ATA (SATA), Parallel ATA (PATA), Serial Attached SCSI (SAS), and Universal Serial Bus (USB).

[0033] The encryption circuits 1150, 1250, and 1350 may convert data into encrypted data through an encryption operation. In this case, the encryption operation may include a process of sequentially performing a plurality of rounds of operations. For example, the encryption operation may include an initial encryption operation and first to nth rounds of operations, and the next round of operations may be performed based on the results of the previous round of operations.

[0034] The encryption circuits 1150, 1250, and 1350 may be configured so that the difficulty of detecting the execution time of the real round operation is significantly increased by additionally performing the virtual round operation before or after the real round operation performed on the data. In addition, the encryption units 1150, 1250, and 1350 may be configured so that when the real round operation is performed on the data, another circuit (e.g., another round core) performs the virtual round operation in parallel (e.g., simultaneously), so that there is noise in the information collected by the potential attacker through the side channel. Therefore, the security level of each of the encryption circuits 1150, 1250, and 1350 can be enhanced.

[0035] Figure 1 An example is shown in which encryption circuits 1150, 1250 and 1350 are respectively included in data input / output (I / O) devices (i.e., processor device 1100, working memory 1200 and storage memory 1300). However, in an embodiment, encryption circuits 1150, 1250 and 1350 can be implemented as encryption devices independent of data I / O devices (i.e., processor device 1100, working memory 1200 and storage memory 1300). In addition, bus 1500 and devices other than data I / O devices (i.e., processor device 1100, working memory 1200 and storage memory 1300) (e.g., user interface 1400) can each include encryption circuits. Encryption circuits can be applied to any path of input data or output data. The exemplary configuration and operation of encryption circuits 1150, 1250 and 1350 will be described below with reference to the following figures.

[0036] Figure 2 is a block diagram of an encryption circuit 100 according to an embodiment. Figure 2The block diagram of the encryption circuit 100 may be, for example Figure 1 Detailed block diagram of each of the encryption circuits 1150, 1250 and 1350. In the drawings, an encryption operation will be described, and the same description can be applied to a decryption operation.

[0037] refer to Figure 2 , the encryption circuit 100 may include an encryption controller 110, a pipeline encryption core 120, and a buffer 130. The encryption controller 110 may control the overall operation of the encryption unit 100 in response to the request REQ. Control values ​​indicating the environment and execution of the encryption operation may be stored in the encryption controller 110. The encryption controller 110 may send control signals CON_C and CON_B to the pipeline encryption core 120 and the buffer 130, respectively, for controlling the operations of the pipeline encryption core 120 and the buffer 130.

[0038] The encryption controller 110 can control the multiple round cores 121 included in the pipeline encryption core 120 based on the control signal CON_C so as to perform virtual encryption operations. In an embodiment, the encryption controller 110 can determine the number of virtual encryption operations to be performed by each of the multiple round cores 121 before performing a real encryption operation or the number of virtual encryption operations to be performed by each of the multiple round cores 121 after performing a real encryption operation based on random data D_RAN input from the outside. Alternatively, in the case where one of the multiple round cores 121 performs a real round operation, the encryption controller 110 can control the pipeline encryption core 120 so that other round cores perform virtual round operations. An example in which the encryption controller 110 receives random data D_RAN from the outside is shown in the accompanying drawings, but the present embodiment is not limited to this. In other embodiments, the encryption controller 110 can generate random data D_RAN internally.

[0039] The pipeline encryption core 120 may sequentially receive first to k-th real data PT1 to PTk from the buffer 130, corresponding to the unit performing the arithmetic operation. The pipeline encryption core 120 may perform a real encryption operation (using a real encryption key RK (e.g., RK0 to RKn)) on the first to k-th real data PT1 to PTk to output first to k-th encrypted data CT1 to CTk. The pipeline encryption core 120 may update the buffer 130 with the first to k-th encrypted data CT1 to CTk on which the real encryption operation has been performed. In this case, k may be a natural number equal to or greater than three, and is not limited thereto. In other embodiments, the pipeline encryption core 120 may sequentially receive one or more real data.

[0040] The pipeline encryption core 120 may perform a real encryption operation based on the real encryption key by performing a permutation operation of mixing the bit positions of the first to k-th real data PT1 to PTk. Alternatively, the pipeline encryption core 120 may perform an encryption operation based on the encryption key by performing a replacement operation of changing each of the first to k-th real data PT1 to PTk into other data mapped thereto.

[0041] The pipeline encryption core 120 may receive dummy data VPT or dummy encryption key VRK from the buffer 130. The pipeline encryption core 120 may perform a virtual encryption operation using the dummy data VPR or the dummy encryption key VRK. For example, the pipeline encryption core 120 may perform a virtual encryption operation using the dummy data VPT or the dummy encryption key VRK, perform a virtual encryption operation using the dummy data VPT and the real encryption key, or perform a virtual encryption operation using the first to kth real data PT1 to PTk and the dummy encryption key VRK.

[0042] In an embodiment, the pipeline encryption core 120 may include a plurality of round cores, each of which performs a round operation. The real encryption operation performed by the pipeline encryption core 120 may include real round operations respectively performed by the round cores 121. In addition, the virtual encryption operation performed by the pipeline encryption core 120 may include virtual round operations respectively performed by the round cores 121. The round operation performed by the pipeline encryption core 120 may be classified as one of a real round operation and a virtual round operation based on the type of the encryption key and the input data D_in.

[0043] The pipeline encryption core 120 may perform encryption operations on the first to kth real data PT1 to PTk in parallel. For example, at least two of the plurality of round cores 121 may perform a plurality of round operations of the real round operation and the virtual round operation in parallel.

[0044] In an embodiment, in response to a control signal CON_C provided from the encryption controller 110, the pipelined encryption core 120 may perform an initial virtual round operation at least once before an initial round core for performing an initial round operation performs an initial real round operation. Alternatively, in response to a control signal CON_C provided from the encryption controller 110, the pipelined encryption core 120 may perform an initial virtual round operation at least once after the initial round core performs an initial real round operation. Therefore, in the encryption circuit 100 according to the present embodiment, a potential attacker may find it difficult to detect when a real encryption operation is performed, thereby enhancing the security level of the encryption circuit 100. Figure 6 The round operations of the pipelined encryption core 120 are described in detail.

[0045] In an embodiment, in response to the control signal CON_C provided from the encryption controller 110, the first round core in the pipeline encryption core 120 can perform the first virtual round operation while the initial round core is performing the initial real round operation. Therefore, since the real encryption operation is performed together with the virtual encryption operation, noise will appear, thereby enhancing the security level of the encryption circuit 100. Fig.10 The round operations of the pipelined encryption core 120 are described in detail.

[0046] The buffer 130 may temporarily store input data D_in provided from the outside. That is, the buffer 130 may store data to be executed for a real operation for encryption. At this time, in response to a control signal CON_B provided from the encryption controller 110, the buffer 130 may divide the input data D_in according to the execution unit of the encryption operation, and may provide the divided input data to the pipeline encryption core 120. For example, the buffer 130 may sequentially provide the first to kth real data PT1 to PTk to the pipeline encryption core 120.

[0047] In addition, the buffer 130 may temporarily store random data D_RAN provided from the outside. In response to the control signal CON_B provided from the encryption controller 110, at least a portion of the random data D_RAN stored in the buffer 130 may be provided to the pipeline encryption core 120. For example, the buffer 130 may provide at least a portion of the random data D_RAN to the pipeline encryption core 120 as dummy data VPT for a virtual round operation. Alternatively, for example, the buffer 130 may provide at least a portion of the random data D_RAN to the pipeline encryption core 120 as a dummy encryption key VRK for a virtual round operation.

[0048] The buffer 130 may receive the first to kth encrypted data CT1 to CTk from the pipeline encryption core 120. The buffer 130 may output each of the first to kth encrypted data CT1 to CTk as output data D_out. Therefore, the output data D_out may be generated by encrypting the input data D_in.

[0049] Figure 3 1 is a block diagram of a pipelined encryption core 120 included in an encryption circuit according to an embodiment. In the drawings, an encryption operation will be described, and the same description can be applied to a decryption operation. Figure 3 , the pipeline encryption core 120 may include an initial round core 121_i, first to nth round cores 121_1 to 121_n, an initial register 123_i, first to nth registers 123_1 to 123_n, and a key scheduler 125. For example, the initial round core 121_i and the first to nth round cores 121_1 to 121vn may be Figure 2 In this case, n may be a natural number equal to or greater than three, and the present embodiment is not limited thereto. The number of round cores included in the pipeline encryption core 120 may be variously set to one or more. In an embodiment, the pipeline encryption core 120 may include only the first to nth round cores 121_1 to 121_n, without including the initial round core 121_i.

[0050] The encryption operation performed by the pipeline encryption core 120 may include multiple round operations to increase its security level, and the round operations may be performed by different round cores. For example, the initial round core 121_i may perform the initial round operation, the first round core 121_1 may perform the first round operation, and the nth round core 121_n may perform the nth round operation.

[0051] Each of the plurality of round operations may include a real round operation and a virtual round operation. For example, an initial round operation may include an initial real round operation and an initial virtual round operation, a first round operation may include a first real round operation and a first virtual round operation, and an nth round operation may include an nth real round operation and an nth virtual round operation.

[0052] The initial round core 121_i and the first to nth round cores 121_1 to 121vn may perform an initial encryption operation and the first to nth real encryption operations using real data (e.g., PT1 to PTk) and real encryption keys (e.g., RK0 to RKn). For example, the initial round core 121_i may perform an initial real encryption operation using the first to kth real data PT1 to PTk and the initial real encryption key RK0. In this case, the initial real encryption keys RK0 corresponding to the first to kth real data PT1 to PTk, respectively, may be different or may be the same. The description of the initial real encryption operation performed by the initial round core 121_i may be applied to the first to nth real encryption operations performed by the first to nth round cores 121_1 to 121_n, respectively.

[0053] The first to k-th real data PT1 to PTk may be input to the initial round core 121_i. For example, when the first real data PT1 is input to the initial round core 121_i, the initial round core 121_i may perform an initial real round operation on the first real data PT1, and the execution result may be stored in the initial register 123_i. The execution result may be provided to the first round core 121_1 again, and the first round core 121_1 may perform a first real round operation on the first real data PT1. The result obtained by performing the first real round operation on the first real data PT1 may be stored in the first register 123_1. That is, the first real data PT1 may be encrypted as the first encrypted data CT1 by performing the real round operation a total of (n+1) times, and may be output from the pipeline encryption core 120. The description of the real encryption operation performed on the first real data RT1 may be applied to the real encryption operations performed on the second to k-th real data PT2 to PTk, respectively.

[0054] The first to k-th real data PT1 to PTk may be sequentially input to the initial round core 121i. The pipeline encryption core 120 may perform encryption operations on the first to k-th real data PT1 to PTk input sequentially in parallel. That is, the pipeline encryption core 120 may perform encryption operations on the first to k-th real data PT1 to PTk by using a pipeline method. For example, when the first round core 121_1 is performing a first round operation on the first real data PT1, the initial round core 121_i may perform an initial round operation on the second real data PT2. When the second round core 121_2 is performing a second round operation on the first real data PT1, the first round core 121_1 may perform a first round operation on the second real data PT2, and the initial round core 121_i may perform a round operation on the third real data PT3.

[0055] The initial round core 121_i and each of the first to nth round cores 121_1 to 121_n may perform a virtual encryption operation using a plurality of dummy data VPT0 to VPTn or virtual encryption keys VRK0 to VRKn. For example, at least one of the initial dummy data VPT and the initial virtual encryption key VRK0 may be provided to the initial round core 121_i. For example, the initial round core 121_i may perform a virtual encryption operation using the initial dummy data VPT0 and the initial virtual encryption key VRK0, perform a virtual encryption operation using the initial dummy data VPT0 and the initial real encryption key RK0, or perform a virtual encryption operation using the first to kth real data PT1 to PTk and the initial virtual encryption key VRK0. The description of the initial virtual encryption operation performed by the initial round core 121_i may be applied to the first to nth virtual encryption operations respectively performed by the first to nth round cores 121_1 to 121_n.

[0056] In an embodiment, the initial register 123_i may include an initial real register and an initial virtual register. The result of the initial virtual round operation performed by the initial round core 121_i may be stored in the initial virtual register and may be provided to the first round core 121_1 as the next round core. The first round core 121_1 may also receive the result to perform the first virtual round operation. Alternatively, in an embodiment, the result of the initial virtual round operation performed by the initial round core 121_i may be stored in the initial virtual register, but may not be provided to the first round core 121_1. The description of the initial virtual encryption operation performed by the initial round core 121_i may be applied to the first to n-1 virtual encryption operations performed by the first to n-1th round cores 121_1 to 121_n-1, respectively.

[0057] The key scheduler 125 may respond to the encryption controller (e.g., Figure 2 110), manages encryption keys for encryption operations. For example, the key scheduler 125 may manage real encryption keys RK0 to RKn for real encryption operations to provide the initial round core 121_i and the first to nth round cores 121_1 to 121_n with real encryption keys RK0 to RKn to be used for real round operations. In addition, the key scheduler 125 may manage virtual encryption keys VRK0 to VRKn for virtual encryption operations in response to the control of the encryption controller 110. The key scheduler 125 may include a memory for storing real encryption keys RK0 to RKn and virtual encryption keys VRK0 to VRKn, or may access encryption keys stored in another memory.

[0058] In the drawings, dummy data (e.g., VPT0 to VPTn) is shown as being provided to the initial round core 121_i and each of the first to nth round cores 121_1 to 121_n, but the present embodiment is not limited thereto. In the pipelined encryption core 120 according to the present embodiment, dummy data may be provided to at least one of the initial round core 121_i and the first to nth round cores 121_1 to 121_n. In addition, in the drawings, virtual encryption keys (e.g., VRK0 to VRKn) are shown as being provided to the initial round core 121_i and each of the first to nth round cores 121_1 to 121_n, but the present embodiment is not limited thereto. In other embodiments, the virtual encryption key may be provided to at least one of the initial round core 121_i and the first to nth round cores 121_1 to 121_n. Therefore, the pipelined encryption core 120 according to the present embodiment may be configured such that at least one of the initial round core 121_i and the first to nth round cores 121_1 to 121_n performs a virtual round operation according to the control of the encryption controller 110 .

[0059] Figure 4is a flowchart for describing the encryption operation performed by the encryption circuit according to the embodiment, and is a diagram for describing the actual encryption operation. For example, Figure 4 Can describe Figure 3 The pipelined encryption core 120 of the embodiment of the present invention performs an example of encryption operation according to the Advanced Encryption Standard (AES) proposed by the National Institute of Standards and Technology (NIST). Figure 4 This is for the convenience of understanding, and the present embodiment is not limited thereto. The pipelined encryption core 120 may be configured according to the encryption controller (eg, Figure 2 110) controls the execution of encryption operations.

[0060] refer to Figure 3 and 4 In operation S110, the initial round core 121i may perform an "AddRoundKey (round key addition)" operation. The "AddRoundKey" operation may include performing a bitwise combinational logic operation (e.g., an OR operation, an AND operation, an XOR operation, etc.) on the real data (e.g., the first to k-th real data PT1 to PTk) and the initial real round key RK0. Therefore, each of the first to k-th real data PT1 to PTk may be converted into other data based on the selected initial real round key RK0. In an embodiment, the "AddRoundKey" operation may be implemented as an XOR operation.

[0061] In operation S120, the first round core 121_1 may perform a replacement operation on the data obtained by the conversion of the initial round core 121_i. In operation S122, the first round core 121_1 may perform a "ShiftRows" operation on the state of the data obtained by the replacement operation performed in operation S120. In the "ShiftRows" operation, the rows of the data state may be cyclically shifted. In operation S124, the first round core 121_1 may perform a "MixColumns" operation on the data state obtained by the "ShiftRows" operation performed in operation S122. In the "MixColumns" operation, the columns of the data state may be mixed.

[0062] Subsequently, in operation S126, the first round core 121_1 may perform an "AddRoundKey" operation on the converted data having the state obtained by the "MixColumns" operation performed in operation S124. The first round core 121_1 may perform a bitwise combinational logic operation on the converted data and the first real round key RK1.

[0063] In operation S130, an encryption controller (eg, Figure 2110) may determine whether the next round of operation is the final round of operation. The encryption controller 110 may manage the number of real round operations. When it is determined that the next round of operation is not the final round of operation, operation S120 may be performed again. For example, in operation S120, the second round core 121_2 may perform a replacement operation on the data obtained by the conversion performed in operation S126. On the other hand, when it is determined that the next round of operation is the final round of operation, operation S140 may be performed.

[0064] Operations S120 to S126 may configure one real round operation (i.e., each of the first to n-1th real round operations). The key scheduler 125 may select different real round keys RK1 to RKn-1 from the real encryption keys RK0 to RKn for the first to n-1th round cores 121_1 to 121_n-1 for the "AddRoundKey" operation performed in operation 126.

[0065] In operation S140, the n-th round core 121_n may perform a replacement operation on the data obtained by the conversion performed in operation S126. In operation S142, the n-th round core 121_n may perform a "ShiftRows" operation on the state of the data obtained by the replacement operation performed in operation S140. In operation S144, the n-th round core 121n may perform an "AddRoundKey" operation on the data having the state obtained by the "ShiftRows" operation performed in operation S142. For example, the final real round operation (n-th real round operation) may be completed, and then the encrypted data (e.g., the first to k-th encrypted data CT1 to CTk) may be output.

[0066] Since the initial real round operation and the first to nth real round operations are performed sequentially, the value of the data can be gradually changed. The final round operation including operations S140 to S144 can be completed, and then the final converted data can be output as encrypted data CT1 to CTk, so it may be difficult for an attacker to arbitrarily manipulate or damage the encrypted data CT1 to CTk.

[0067] In the accompanying drawings, an example is shown in which the initial round core 121_i and the first to nth round cores 121_1 to 121_n respectively perform the initial real round operation and the first to nth real round operation, but the example can be applied to the virtual round operation. For example, at least one of the initial dummy data VPT0 and the initial virtual encryption key VRK0 can be provided to the initial round core 121_i, and operation S110 can be performed by using at least one of the initial dummy data VPT0 and the initial virtual encryption key VRK0, thereby performing the initial virtual round operation. In addition, at least one of the first dummy data VPT1 and the first virtual encryption key VRK1 can be provided to the first round core 121_1, and the first round core 121_1 can perform operations S120 to S126 by using at least one of the first dummy data VPT1 and the first virtual encryption key VRK1 to perform the first virtual round operation. In addition, at least one of the nth dummy data VPTn and the nth virtual encryption key VRKn can be provided to the nth round core 121_n, and the nth round core 121_n can perform operations S140 to S144 by using at least one of the nth dummy data VPTn and the nth virtual encryption key VRKn to perform the nth virtual round operation.

[0068] Figure 5 is a flowchart for describing the operation of the encryption controller of the encryption circuit according to an embodiment. Figure 5 Describes encryption operations, and the description of encryption operations can be applied to decryption operations.

[0069] refer to Figure 2 , Figure 3 and Figure 5 , in operation S210, the encryption controller 110 may determine a round core to perform a virtual round operation from among a plurality of round cores. In an embodiment, the encryption controller 110 may determine a round core that is vulnerable to an attacker as a round core to perform a virtual round operation. For example, the encryption controller 110 may select an initial round core 121_i to which real data is input or an nth round core 121_n from which encrypted data is output from an initial round core 121_i and first to nth round cores 121_1 to 121_n. When the first real data PT1 is input into the initial round core 121_i, the first to nth round cores 121_1 to 121_n other than the initial round core 121_i may not perform a real round operation, and therefore, the initial round core 121_i may be vulnerable to a side channel analysis attack by an attacker. In addition, data may be first input to the nth round core 121n during the process of performing the decryption operation, and therefore, for the same reason as the initial round core 121_i, the nth round core 121n may be vulnerable to a side channel analysis attack by an attacker. In an embodiment, the round core determined in operation S210 may successively perform a real round operation and a virtual round operation.

[0070] In operation S220, the encryption controller 110 may determine a ratio of a virtual round operation to be performed by the determined round core to a real round operation. In an embodiment, the sum of the number of real round operations and the number of virtual round operations may be an exponent of 2. That is, the ratio of the virtual round operation to the real round operation may be a value obtained by subtracting one from the exponent of 2. For example, the encryption controller 110 may determine an operation as follows: allowing the virtual round operation to be performed three times when the real round operation is performed once.

[0071] In operation S230, the encryption controller 110 may determine the number of virtual round operations to be performed by the determined round core before or after the real round operation. In an embodiment, by using random data D_RAN input from the outside, the encryption controller 110 may randomly determine the number of virtual round operations to be performed before and after performing the real round operation for each of the first to kth real data PT1 to PTk. For example, according to some embodiments, the encryption controller 110 may set the number of preceding virtual round operations relative to the real round operation to zero and the number of succeeding virtual round operations to three, or may set the number of preceding virtual round operations to one and the number of succeeding virtual round operations to two. Alternatively, for example, the encryption controller 110 may set the number of preceding virtual round operations relative to the real round operation to two and the number of succeeding virtual round operations to one, or may set the number of preceding virtual round operations to three and the number of succeeding virtual round operations to zero.

[0072] The encryption controller 110 may output a control signal CON_C to the pipelined encryption core 120 based on the result of the determination performed at operations S210 to S230. The pipelined encryption core 120 may perform a real round operation and a virtual round operation based on the control signal CON_C.

[0073] Therefore, in the encryption circuit 100 according to the present embodiment, the virtual round operation may be performed at least once before or after the real round operation, so an attacker may find it difficult to detect when the real round operation is performed, thereby enhancing the security level of the encryption circuit 100.

[0074] Figures 6 to 8 is a timing diagram for describing the operation of the encryption circuit according to the embodiment. Figures 6 to 8 is based on Figure 5 The operation of the encryption controller 110 is described in detail in FIG. Figures 6 to 8 Describes encryption operations, and the description of encryption operations can be applied to decryption operations.

[0075] refer to Figure 6, a portion of the multiple wheel cores 121_i and 121_1 to 121_n may be determined as wheel cores for successively performing real wheel operations and virtual wheel operations. Here, the wheel core 121_i may be an initial wheel core 121_i, and the wheel cores 121_1 to 121_n may include the first to nth wheel cores 121_1 to 121_n. For example, the initial wheel core 121_i and the nth wheel core 121_n may be determined. However, the present embodiment is not limited to the example in which each of the initial wheel core 121_i and the nth wheel core 121_n performs a virtual wheel operation. In other embodiments, other wheel cores may perform a virtual wheel operation.

[0076] In an embodiment, the ratio of the virtual round operation to be performed by the initial round core 121_i to the real round operation may be the same as the ratio of the virtual round operation to be performed by the nth round core 121_n to the real round operation. In this case, the ratio of the virtual round operation to be performed by each of the initial round core 121_i and the nth round core 121_n to the real round operation may be three. One real round operation and three virtual round operations may be included in one round operation set OPS.

[0077] When a round operation set OPS executed by the initial round core 121_i on real data (for example, one of the first to kth real data PT1 to PTk) ends, the first round core 121_1 as the next round core can perform the first real round operation on the real data. When the first round core 121_1 performs the first real round operation immediately after the initial real round operation ends regardless of the initial round core 121_i ending a round operation set OPS, an attacker may easily detect the time when the initial round core 121_i executes the initial real round operation. Therefore, the first round core 121_1 can be configured to perform the first real round operation on the real data after the round operation set OPS executed on the real data ends.

[0078] In the case where the initial round core 121_i performs an initial real round operation on each of the first to k-th real data PT1 to PTk, the number of initial virtual round operations before / after the initial real round operation can be randomly set. For example, in one round operation set OPS, one initial real round operation and three initial virtual round operations can be randomly performed. In addition, in the case where the n-th round core 121_n performs an n-th real round operation on each of the first to k-th real data PT1 to PTk, the number of n-th virtual round operations before and after the n-th real round operation can be randomly set. Therefore, an attacker may find it difficult to detect the execution time of each of the initial real round operation and the n-th real round operation.

[0079] At least two of the multiple round cores 121_i and 121_1 to 121_n may include a period in which the at least two round cores simultaneously perform a virtual round operation or a real round operation. For example, the round operation set OPS operation performed by the initial round core 121_i on the second real data PT2 may be performed in parallel with the first real round operation performed by the first round core 121_1 on the first real data PT1. In addition, the round operation set OPS operation performed by the nth round core 121_n on the first real data PT1 may be performed in parallel with the n-1th real round operation performed by the n-1th round core 121_n-1 on the second real data PT2. Therefore, in the encryption circuit according to the present embodiment, encryption operations can be performed on different data simultaneously, and therefore, an attacker may find it difficult to perform a side channel analysis attack.

[0080] refer to Figure 7 , each of the multiple wheel cores 121_i and 121_1 to 121_n can successively perform real wheel operations and virtual wheel operations. Here, the wheel core 121_i can be an initial wheel core 121_i, and the wheel cores 121_1 to 121_n can include the first to nth wheel cores 121_1 to 121_n. In an embodiment, the ratio of the virtual wheel operation to the real wheel operation to be performed by the multiple wheel cores 121_i and 121_1 to 121_n, respectively, can be the same. For example, the ratio of the virtual wheel operation to the real wheel operation can be three. One real wheel operation and three virtual wheel operations can be included in one wheel operation set OPS.

[0081] At least two of the plurality of wheel cores 121_i and 121_1 to 121_n may include a period in which the at least two wheel cores simultaneously perform a virtual wheel operation or a real wheel operation. For example, the wheel operation set OPS operation performed by the initial wheel core 121_i on the second real data PT2 may be performed in parallel with the wheel operation set OPS operation performed by the first wheel core 121_1 on the first real data PT1. In addition, the wheel operation set OPS operation performed by the nth wheel core 121_n on the first real data PT1 may be performed in parallel with the wheel operation set OPS operation performed by the n-1th wheel core 121_n-1 on the second real data PT2.

[0082] refer to Figure 8 , each of at least a portion of the plurality of wheel cores 121_i and 121_1 to 121_n may successively perform a real wheel operation and a virtual wheel operation. Here, the wheel core 121_i may be an initial wheel core 121_i, and the wheel cores 121_1 to 121_n may include first to nth wheel cores 121_1 to 121_n. For example, each of the initial wheel core 121_i, the first wheel core 121_1, the n-1th wheel core 121_n-1, and the nth wheel core 121_n may successively perform a real wheel operation and a virtual wheel operation.

[0083] In an embodiment, the ratio of the virtual round operation to be performed by the initial round core 121_i, the first round core 121_1, the n-1th round core 121_n-1 and the n-th round core 121_n respectively to the real round operation may not be the same. For example, the encryption controller 110 may determine the ratio of the virtual round operation to be performed by the round core that is expected to be vulnerable to the attacker to the real round operation as a high ratio. For example, the ratio of the virtual round operation to be performed by each of the initial round core 121_i and the n-th round core 121_n to the real round operation may be three, and each of a round operation set OPSi and a round operation set OPSn may include one real round operation and three virtual round operations. On the other hand, the ratio of the virtual round operation to be performed by each of the first round core 121_1 and the n-1th round core 121_n-1 to the real round operation may be one, and each of a round operation set OPS1 and a round operation set OPSn-1 may include one real round operation and one virtual round operation. In each of one round operation set OPSi, one round operation set OPS1, one round operation set OPSn-1, and one round operation set OPSn, a real round operation and a virtual round operation may be randomly performed based on a predetermined ratio.

[0084] Fig. 9 is a flowchart for describing the operation of the encryption controller of the encryption circuit according to an embodiment. Fig. 9 Describes encryption operations, and the description of encryption operations can be applied to decryption operations.

[0085] refer to Figure 2 , Figure 3 and Fig. 9 In operation S310, the encryption controller 110 may determine a round core to perform a virtual round operation when another round core is performing a real round operation. For example, the encryption controller 110 may determine the first round core 121_1 as the round core to perform the virtual round operation.

[0086] In operation S320, the encryption controller 110 may set a virtual operation period during which the round core determined in operation S310 performs a virtual round operation. In an embodiment, the encryption controller 110 may set a virtual operation period, which includes a period from the time when the encryption operation is started to be performed on each of the first to kth real data PT1 to PTk to the time when the encryption operation is ended. In an embodiment, the encryption controller 110 may set a period that is vulnerable to a side channel analysis attack by an attacker as a virtual operation period. For example, the encryption controller 110 may set a period in which only one real round operation is performed or two real round operations are performed in parallel as a virtual operation period.

[0087] In operation S330, the encryption controller 110 may check whether a real round operation by the round core determined in operation S310 is scheduled. For example, the encryption controller 110 may check whether a real round operation by the first round core 121_1 is scheduled within the virtual operation period set in operation S320.

[0088] When it is determined that the real round operation performed by the determined round core is not scheduled during the virtual operation, in operation S340, the encryption controller 110 may perform control so that the virtual round operation is performed by the determined round core when another round core is performing the real round operation. On the other hand, when it is determined that the real round operation performed by the determined round core is scheduled, in operation S350, the encryption controller 110 may perform control so that the real round operation is performed by the determined round core.

[0089] In operation S360, the encryption controller 110 may check whether the virtual operation period ends. When it is determined that the virtual operation period has not ended, the encryption controller 110 may perform operation S330 again. On the other hand, when it is determined that the virtual operation period has ended, the encryption controller 110 may end the virtual round operation.

[0090] In the encryption circuit 100 according to the present embodiment, a virtual round operation can be performed by a round core that does not perform arithmetic operations other than a round core that is performing a real round operation, and therefore, noise can be generated. Therefore, an attacker may find it difficult to perform a side channel analysis attack, thereby enhancing the security level of the encryption circuit 100.

[0091] Figures 10 to 12 is a timing diagram for describing the operation of the encryption circuit according to the embodiment. Figures 10 to 12 is based on Fig. 9 The operation of the encryption controller 110 is described in detail in FIG. Figures 10 to 12 Describes encryption operations, and the description of encryption operations can be applied to decryption operations.

[0092] refer to Fig.10, a portion of the plurality of round cores 121_i and 121_1 to 121_n may be determined as a round core for performing a virtual round operation when another round core is performing a real round operation. Here, the round core 121_i may be an initial round core 121_i, and the round cores 121_1 to 121_n may include the first to nth round cores 121_1 to 121_n. For example, the first round core 121_1 and the n-1th round core 121_n-1 may be determined. In this case, the virtual operation period VOP in which the virtual round operation is to be performed by each of the first round core 121_1 and the n-1th round core 121_n-1 may be set to a period from the time when the encryption operation is started on the first to kth real data PT1 to PTk to the time when the encryption operation ends.

[0093] The first round core 121_1 and the n-1th round core 121_n-1 among the multiple round cores 121_i and 121_1 to 121_n can respectively perform the first virtual round operation and the n-1th virtual round operation when the first real round operation and the n-1th real round operation are not performed. In the encryption circuit according to the present embodiment, at least two round cores among the multiple round cores 121_i and 121_1 to 121_n may include a period in which the at least two round cores simultaneously perform a virtual round operation or a real round operation. Therefore, in the encryption circuit according to the present embodiment, since the real round operation and the virtual round operation are performed simultaneously, only the initial real round operation can be performed on the first real data PT1 after the encryption operation is started, thereby preventing the attacker from easily performing a side channel analysis attack. In addition, in the encryption circuit according to the present embodiment, only the nth real round operation can be performed on the kth real data PTk, thereby preventing the attacker from easily performing a side channel analysis attack.

[0094] refer to Fig.11 , the plurality of round cores 121_i and 121_1 to 121_n may be determined as round cores for performing a virtual round operation when another round core is performing a real round operation. In this case, a virtual operation period VOP in which a virtual round operation is to be performed by each of the plurality of round cores 121_i and 121_1 to 121_n may be set to a period from the time when the encryption operation is started on the first to kth real data PT1 to PTk to the time when the encryption operation is finished.

[0095] Each of the plurality of round cores 121_i and 121_1 to 121_n can perform a virtual round operation when not performing a real round operation. Therefore, in the encryption circuit according to the present embodiment, since the real round operation and the virtual round operation are performed simultaneously, only the initial real round operation can be performed on the first real data PT1 after the encryption operation is started, thereby preventing an attacker from easily performing a side channel analysis attack.

[0096] refer to Fig.12 , a portion of the plurality of round cores 121_i and 121_1 to 121_n may be determined as a round core for performing a virtual round operation when another round core is performing a real round operation. Here, the round core 121_i may be an initial round core 121_i, and the round cores 121_1 to 121_n may include the first to nth round cores 121_1 to 121_n. For example, the first round core 121_1 and the n-1th round core 121_n-1 may be determined.

[0097] In this case, the first virtual operation period VOP1 in which the virtual round operation is performed can be set to a period in which an initial real round operation is performed on the first real data PT1, a first real round operation is performed on the first real data PT1, and an initial real round operation is performed on the second real data PT2. In addition, the second virtual operation period VOP2 in which the virtual round operation is performed can be set to a period in which an nth real round operation is performed on the k-1th real data PTk-1, an n-1th real round operation is performed on the kth real data PTk, and an nth real round operation is performed on the kth real data PTk.

[0098] When the virtual round operation is not performed in the first virtual operation period VOP1 and the second virtual operation period VOP2, only one or two real round operations may be performed, and therefore, the first virtual operation period VOP1 and the second virtual operation period VOP2 may be vulnerable to attacks. Therefore, a period that is relatively vulnerable to attacks can be set as a virtual operation period, and a virtual round operation can be additionally performed, thereby protecting the virtual operation period from attacks. The first virtual operation period VOP1 and the second virtual operation period VOP2 can be set to some periods instead of the entire period in which the encryption operation is performed on the first to kth real data PT1 to PTk, and therefore, in the period determined to be vulnerable to attacks by attackers, the encryption circuit according to the present embodiment can allow noise to appear and can reduce power consumption.

[0099] Fig.13 is a timing diagram for describing the operation of the encryption circuit according to the embodiment. Fig.13 Is used based on Figure 5 and Fig. 9 The operation of the encryption controller 110 is described in detail in FIG. Fig.13 Describes encryption operations, and the description of encryption operations can be applied to decryption operations.

[0100] refer to Fig.13, a portion of the multiple wheel cores 121_i and 121_1 to 121_n may be determined as wheel cores for successively performing real wheel operations and virtual wheel operations. Here, the wheel core 121_i may be an initial wheel core 121_i, and the wheel cores 121_1 to 121_n may include the first to nth wheel cores 121_1 to 121_n. For example, the initial wheel core 121_i and the nth wheel core 121_n may be determined. However, the present embodiment is not limited thereto, and the multiple wheel cores 121_i and 121_1 to 121_n may be determined as wheel cores for successively performing real wheel operations and virtual wheel operations.

[0101] In an embodiment, the ratio of the virtual round operation to be performed by the initial round core 121_i to the real round operation may be the same as the ratio of the virtual round operation to be performed by the nth round core 121_n to the real round operation. For example, the ratio of the virtual round operation to be performed by each of the initial round core 121_i and the nth round core 121_n to the real round operation may be three. One real round operation and three virtual round operations may be included in one round operation set OPS. In other embodiments, the ratio of the virtual round operation to be performed by the initial round core 121_i to the real round operation may be different from the ratio of the virtual round operation to be performed by the nth round core 121_n to the real round operation.

[0102] In the case where the initial round core 121_i performs an initial real round operation on each of the first to kth real data PT1 to PTk, the number of initial virtual round operations performed before and after the initial real round operation can be randomly set. That is, in one round operation set OPS, one initial real round operation and three initial virtual round operations can be randomly performed. In addition, in one round operation set OPS, one nth real round operation and three nth virtual round operations can be randomly performed. Therefore, an attacker may find it difficult to detect the execution time of each of the initial real round operation and the nth real round operation.

[0103] At least a portion of the plurality of round cores 121_i and 121_1 to 121_n may be determined as a round core for performing a virtual round operation when another round core is performing a real round operation. For example, the first round core 121_1 and the n-1th round core 121_n-1 may be determined. In this case, the virtual operation period VOP in which the virtual round operation is to be performed by each of the first round core 121_1 and the n-1th round core 121_n-1 may include at least a portion of the period from the time when the encryption operation is started to be performed on the first to kth real data PT1 to PTk to the time when the encryption operation is finished. For example, the virtual operation period VOP may be the entire period in which the encryption operation is performed on each of the first to kth real data PT1 to PTk.

[0104] The first round core 121_1 and the n-1th round core 121_n-1 among the multiple round cores 121_i and 121_1 to 121_n can respectively perform the first virtual round operation and the n-1th virtual round operation when the first real round operation and the n-1th real round operation are not performed. Therefore, in the encryption circuit according to the present embodiment, since the real round operation and the virtual round operation are performed simultaneously, only the initial real round operation can be performed on the first real data PT1 after the encryption operation is started, thereby preventing the attacker from easily performing a side channel analysis attack. In addition, in the encryption circuit according to the present embodiment, only the nth real round operation can be performed on the kth real data PTk, thereby preventing the attacker from easily performing a side channel analysis attack.

[0105] While the inventive concept has been particularly shown and described with reference to embodiments thereof, it will be understood that various changes in form and details may be made therein without departing from the spirit and scope of the appended claims.

Claims

1. An encryption circuit, comprising: a pipelined encryption core configured to perform a real encryption operation on at least a portion of an input data stream using at least one real encryption key, and to perform a virtual encryption operation on virtual data using a virtual encryption key in parallel with the real encryption operation to generate virtual encryption noise, The pipeline encryption core includes a pipeline-arranged wheel core. wherein during the real encryption operation, a first round core of the round cores in the pipeline encryption core performs a real round operation of encrypting first input data using a first real encryption key, and during the virtual encryption operation, a second round core of the round cores in the pipeline encryption core performs a virtual round operation of encrypting first virtual data using a first virtual encryption key, The first round core is further configured to perform a virtual round operation, The first round core performs a virtual round operation and a real round operation based on a determined ratio. 2 . The encryption circuit according to claim 1 , wherein the encryption of the first input data and the encryption of the first dummy data are performed in parallel in the pipeline encryption core.

3. The encryption circuit according to claim 2 further includes a key scheduler, which is configured to generate the first real encryption key and the first virtual encryption key at corresponding outputs, and the corresponding outputs are electrically coupled to the first round core in the round cores and the second round core in the round cores.

4. An encryption circuit comprising: a pipeline encryption core including a plurality of round cores configured to perform a real round operation on each of a plurality of input data sequentially input, the pipeline encryption core outputting encrypted data by an encryption operation using the real round operation; as well as an encryption controller configured to perform control so that at least one of the plurality of wheel cores performs a real wheel operation and additionally performs a virtual wheel operation, wherein the encryption controller is configured to perform control so that the virtual round operation of the at least one round core is performed in parallel with the real round operation of at least one other round core of the plurality of round cores, The at least one wheel core performs a virtual wheel operation and a real wheel operation based on a determined ratio.

5. The encryption circuit according to claim 4, wherein the encryption controller is configured to: determining the at least one wheel core from the plurality of wheel cores as a wheel core to perform a virtual wheel operation; determining a ratio of virtual wheel operations to real wheel operations to be performed by the determined wheel core; as well as Control is performed so that the determined at least one wheel core performs the real wheel operation and the virtual wheel operation based on the ratio.

6. The encryption circuit according to claim 5, wherein the encryption controller is configured as: randomly determining the number of virtual wheel operations to be performed before the real wheel operation and the number of virtual wheel operations to be performed after the real wheel operation based on the ratio; and Control is performed so that the determined wheel core performs the real wheel operation and the virtual wheel operation based on the determined number. 7 . The encryption circuit according to claim 5 , wherein the encryption controller is configured to determine, from among the plurality of round cores, an initial round core to which first input data among the plurality of input data is input as a round core that performs the virtual round operation. 8 . The encryption circuit according to claim 5 , wherein the encryption controller is configured to determine a final round core from which the encryption data is output from among the plurality of round cores as a round core that performs the virtual round operation. 9 . The encryption circuit according to claim 5 , wherein the encryption controller is configured to determine the plurality of round cores as round cores that perform a virtual round operation.

10. The encryption circuit according to claim 5, wherein The encryption controller is configured to determine a different round core as a round core to perform a virtual round operation, and The ratios of the virtual wheel operations to the real wheel operations respectively performed by the different wheel cores are different.

11. The encryption circuit according to claim 4, wherein the encryption controller is configured to: determining a wheel core to perform a virtual wheel operation from among the plurality of wheel cores when another wheel core performs a real wheel operation; determining a virtual operation period during which the virtual wheel operation is to be performed by the determined wheel core; as well as Control is performed so that the determined wheel core additionally performs a virtual wheel operation during the virtual operation period. 12 . The encryption circuit according to claim 11 , wherein the encryption controller is configured to set a period during which the pipeline encryption core performs encryption operations as the virtual operation period.

13. The encryption circuit according to claim 11, wherein the encryption controller is configured to set the virtual operation period to include a period in which an initial round core among the plurality of round cores performs an operation on a first input data among the plurality of input data, wherein the first input data among the plurality of input data is input to the initial round core.

14. The encryption circuit according to claim 11, wherein the encryption controller is configured to set the virtual operation period to include a period in which a final round core from among the plurality of round cores, from which encryption data is output, performs an operation on last input data among the plurality of input data.

15. The encryption circuit according to claim 4, wherein the encryption controller is configured to: determining a first round core from the plurality of round cores for continuously performing a real round operation and a virtual round operation; When another round core performs a real round operation, determining a second round core for performing a virtual round operation from the plurality of round cores; and The execution control causes the first round core and the second round core to perform a real round operation and a virtual round operation.

16. An encryption circuit comprising: A first round core and a second round core arranged in a pipeline, the first round core being configured to perform a first real round operation on input data, and the second round core being configured to perform a second real round operation on the input data based on a result of the first real round operation; as well as a key scheduler configured to provide a round key to each of the first round core and the second round core; wherein the first round core is further configured to perform a first virtual round operation based on dummy data or a first virtual round key provided from the key scheduler; wherein a first virtual round operation of the first round core is performed in parallel with the second real round operation; The first round core performs a first virtual round operation and a first real round operation based on a determined ratio. 17 . The encryption circuit of claim 16 , wherein the second round core is further configured to perform a second virtual round operation based on dummy data or a second virtual round key provided from the key scheduler.

18. The encryption circuit according to claim 17, wherein A ratio of a first virtual wheel operation to a first real wheel operation has a first value, a ratio of a second virtual wheel operation to a second real wheel operation has a second value, and the first value is equal to the second value.

19. The encryption circuit according to claim 17, wherein A ratio of a first virtual wheel operation to a first real wheel operation has a first value, a ratio of a second virtual wheel operation to a second real wheel operation has a second value, and the first value is different from the second value.

20. The encryption circuit of claim 16, wherein the first round core is configured to execute the first virtual round operation after completing the first real round operation while the second real round operation is being executed.

21. An encryption circuit comprising: A first round core and a second round core arranged in a pipeline, the first round core being configured to perform a first real round operation on input data, and the second round core being configured to perform a second real round operation on the input data based on a result of the first real round operation; as well as a key scheduler configured to provide a round key to each of the first round core and the second round core; wherein the second round core is further configured to perform a virtual round operation based on dummy data or a virtual round key provided from the key scheduler; wherein the first real round operation is performed in parallel with the virtual round operation of the second round core; The second round core performs a virtual round operation and a second real round operation based on a determined ratio. 22 . The encryption circuit according to claim 21 , wherein the second round core is configured to perform the virtual round operation in a designated virtual operation period.

23. The encryption circuit of claim 21, wherein the second round core is configured to execute the virtual round operation while the first real round operation is being executed before executing the second real round operation.

Images