Processor with block cipher algorithm and processing method thereof

Abstract

A processor with a block cipher algorithm and a processing method thereof, wherein the processor uses a register to store an input key pointer pointing to the input key. In response to a single block cipher algorithm instruction of an instruction set architecture, the processor obtains input data from a first memory space, performs a block cipher algorithm on the input data based on the input key, encrypts or decrypts output data, and stores the output data in a second memory space or an internal hardware storage space.

Description

Technical Field

[0001] The invention relates to a processor with a cryptographic algorithm and a processing method thereof. Background Art

[0002] China's State Cryptography Administration has released a variety of cryptographic algorithms, including SM2, SM3, and SM4, to replace internationally accepted cryptographic algorithms such as RSA (Rivest-Shamir-Adleman), SHA (Secure Hash Algorithm), and AES (Advanced Encryption Standard).

[0003] The SM4 cipher algorithm is a block cipher algorithm used in wireless LAN products. The data block length and key length of the SM4 cipher algorithm are both 128 bits.

[0004] In the known technologies, multiple instruction set architecture instructions are used to implement block cipher algorithms in the processor, which cannot effectively protect the intermediate data generated during the operation process, so the security is poor.

[0005] How to complete the SM4 cryptographic algorithm efficiently and more securely is a major issue in this technical field. Summary of the invention

[0006] In order to improve security, the present invention provides a processor with a block cipher algorithm (SM4) and a processing method thereof.

[0007] A processor implemented according to an embodiment of the present invention uses a first register to store an input key pointer pointing to an input key. In response to a single block cipher algorithm instruction of an instruction set architecture, the processor obtains input data from a first memory space, performs a block cipher algorithm on the input data based on the input key, encrypts or decrypts output data, and stores the output data in a second memory space or an internal hardware storage space.

[0008] The processor groups the input data into a plurality of input data blocks of a fixed size according to the number of 16-byte blocks of the input data. The processor performs N rounds of operations on each input data block to generate an output data block corresponding to each input data block to form the output data, where N is an integer. The processor expands N extended keys based on the input key, so that different rounds of operations on each input data block use different extended keys.

[0009] In one embodiment, the processor includes a cryptographic execution unit, a set of architectural registers, a microcode storage device storing microcode, and a decoder. The decoder responds to the single block cipher algorithm instruction and decodes a plurality of microinstructions according to the microcode. The plurality of microinstructions include defining, using, and managing the contents of the set of architectural registers, and operating the cryptographic execution unit to perform the block cipher algorithm on the input data based on the input key.

[0010] In one embodiment, the cryptographic execution unit includes a block cipher algorithm accelerator. The plurality of microinstructions include an accelerator operation microinstruction. In response to the accelerator operation microinstruction, the block cipher algorithm accelerator performs N rounds of operations for each input data block of the input data, respectively, to generate an output data block corresponding to each input data block, forming the output data, where N is an integer.

[0011] In one embodiment, the block cipher algorithm accelerator includes key expansion logic hardware and a first accelerator internal storage space. The key expansion logic hardware receives the input key and expands N expansion keys based on the input key, so that different rounds of operations of each input data block use different expansion keys. The first accelerator internal storage space caches the N expansion keys into N sequential keys according to the generation order for encryption.

[0012] In one embodiment, the block cipher algorithm accelerator includes key reverse conversion hardware and a second accelerator internal storage space. The key reverse conversion hardware reverses the N sequential keys stored in the first accelerator internal storage space into N reverse keys. The second accelerator internal storage space caches the N reverse keys for decryption.

[0013] In one embodiment, the block cipher algorithm accelerator includes a round of operation logic hardware, a multiplexer, and control logic hardware. The multiplexer supplies the N sequential keys cached in the internal storage space of the first accelerator or the N reverse keys cached in the internal storage space of the second accelerator to the round of operation logic hardware, so that the round of operation logic hardware performs N rounds of operations on each input data block, and generates output data blocks corresponding to each input data block. The control logic hardware receives a control word, and when the encryption and decryption setting bit of the control word indicates encryption, operates the multiplexer to supply the N sequential keys to the round of operation logic hardware, and when the encryption and decryption setting bit indicates decryption, operates the multiplexer to supply the N reverse keys to the round of operation logic hardware.

[0014] A processing method of a processor implemented according to one embodiment of the present invention includes: responding to a single block cipher algorithm instruction of an instruction set architecture, obtaining input data from a first memory space, performing a block cipher algorithm on the input data based on an input key, encrypting or decrypting output data, and storing the output data in a second memory space or an internal hardware storage space.

[0015] Through the processor with a block cipher algorithm (SM4) and the processing method thereof provided by the present invention, the block cipher algorithm can be implemented using only one instruction set architecture instruction, and the intermediate data generated in the process of implementing the block cipher algorithm can be stored in the processor's internal hardware storage space, making it impossible to access these intermediate data outside the processor, thereby greatly improving security.

[0016] The following is a detailed description of the present invention with reference to the embodiments and accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a block diagram illustrating a processor 100 according to one embodiment of the present invention;

[0018] FIG. 2A to FIG. 2C The format of the SM4 cryptographic algorithm instruction of the ISA and the related microcode ucode design are illustrated according to different embodiments of the present invention;

[0019] Figure 3 An implementation method for writing ISA instructions is illustrated;

[0020] Figure 4 is a flow chart illustrating a step procedure triggered by an SM4 cryptographic algorithm instruction according to an embodiment of the present invention, and a plurality of microinstructions converted from the corresponding SM4 cryptographic algorithm instruction; and

[0021] Figure 5 An SM4 engine 500 is illustrated according to one embodiment of the present invention. DETAILED DESCRIPTION

[0022] The following description lists various embodiments of the present invention. The following description introduces the basic concept of the present invention and is not intended to limit the content of the present invention. The actual scope of the invention should be defined according to the claims.

[0023] The present invention discloses a processor with a block cipher algorithm (SM4 cipher algorithm). The present invention designs a block cipher algorithm instruction (SM4 cipher algorithm instruction) of an instruction set architecture (ISA) for the SM4 cipher algorithm. In one embodiment, corresponding to the SM4 cipher algorithm instruction, the present invention designs the microcode (ucode) of the processor, and adds a block cipher algorithm accelerator (SM4 engine) to the cryptographic execution unit of the processor. When processing the SM4 cipher algorithm instruction, the processor generates a plurality of microinstructions according to the microcode, including interpreting the contents of the architecture registers, and then operating the SM4 engine accordingly to implement the SM4 cipher algorithm. The instruction set supported by the processor may include the x86 instruction set. The intermediate data of the SM4 cipher algorithm (for example, an extended key, or the intermediate operation content of converting input data to output data) can be properly hidden in the internal hardware storage space of the processor.

[0024] Figure 1is a block diagram illustrating a processor 100 according to one embodiment of the present invention. According to the branch predictor 102, the instruction is loaded into the instruction cache 104 according to the translation result of the instruction translation lookaside buffer ITLB, and then cached in the instruction buffer (XIB) 106, and then pushed into the format instruction queue (FIQ) 108, and handed over to the decoder 110 to decode into a plurality of microinstructions recognizable by the pipeline according to the microcode (ucode, stored in a microcode storage), and pushed into the instruction queue (XIQ) 112, and then stored in the corresponding reservation station RS through the rename unit 114, driving the arithmetic logical unit ALU, the address generating unit AGU of the memory order buffer 116, and the corresponding hardware Fadd, Fmul, Fmisc, MMX, or the cryptographic execution unit 118 of various instructions. The data required for the operation can be loaded into the data cache 120 according to the translation result of the data translation lookaside buffer (DTLB), and then cached in the memory sequential buffer area 116. The processor 100 also includes a reorder buffer (ROB) 122 and architecture registers 124 to implement the operation.

[0025] The cryptographic execution unit 118 includes an SM4 engine 126. The microcode ucode includes microinstructions for accessing the architecture register 124 of the corresponding SM4 cryptographic algorithm instruction, specifically including microinstructions for accessing the control word (for example, indicating encryption or decryption, which mode of the SM4 cryptographic algorithm is) register, the number of 16-byte blocks register, the input key pointer register, and even the information register of the input and output data. The decoder 110 decodes the SM4 cryptographic algorithm instruction (an ISA instruction) of the present invention into a plurality of microinstructions that can be recognized by the pipeline of the processor 100 according to the microcode ucode, and interprets the content of the architecture register 124 accordingly to obtain the control word, the input key, and the input data, and then drives the SM4 engine 126 to complete the encryption or decryption of the SM4 cryptographic algorithm of the input data based on the input key, and generates output data. The generated output data can be stored in a memory space (the memory space described in the present invention can be a system memory (such as RAM) space connected to the processor, which can follow the ES segment segmentation technology), or stored in an internal hardware storage space (in the processor 100). The decoded multiple microinstructions include using an accelerator operation microinstruction (SM4 engine microinstruction), which is responsible for driving the SM4 engine 126. The decoded multiple microinstructions also include accessing and managing the contents of the group of architectural registers, and operating the cryptographic execution unit 118 to perform the block cipher algorithm on the input data based on the input key.

[0026] FIG. 2A to FIG. 2C The format of the SM4 cryptographic algorithm instruction of the ISA and the related microcode ucode design are illustrated according to different embodiments of the present invention.

[0027] Figure 2A The format 202 of the ISA SM4 cryptographic algorithm instruction is illustrated, and the related microcode ucode design is introduced in table 204. The prefix, operation code (opcode), and field ModR / M of the format 202 are: 0xF3 0x0F 0xA 0xF0. The fields SIB, Displacement, and Immediate are not filled (non). After the decoder 110 recognizes the code "0xF3 0x0F 0xA70xF0", it generates multiple microinstructions according to the microcode ucode, including defining, using, and managing the architecture register 124 to operate the cryptographic execution unit 118 to perform the SM4 cryptographic algorithm on the input data based on the input key.

[0028] First, referring to Table 204, we discuss how the microcode ucode defines input registers corresponding to the ISA's SM4 cryptographic algorithm instructions, using registers EBX (first register), ECX (second register), EAX (third register), ESI (fourth register), and EDI (fifth register) in the architecture register 124.

[0029] The third register EAX stores the control word, and its bit 0 (Bit[0]) can be '0' for encryption and '1' for decryption; Bits [10:6] represent the mode setting of the SM4 cipher algorithm, '1' sets a codebook mode (ECB mode), '2' sets a ciphertext block link mode (CCB mode), '4' sets a ciphertext feedback mode (CFB mode), '8' sets an output feedback mode (OFB mode), and '10' sets a calculator mode (CTR mode). The second register ECX stores the number of input data blocks, with 16 bytes (128 bits) as a data block. The first register EBX stores an input key pointer (pointing to a system memory space where the input key is stored), which can follow the ES segment segmentation technology. The fourth register ESI stores an input data pointer (pointing to another system memory space where the input data is stored), which can follow the ES segment segmentation technology; when the control word is encrypted, it points to plaintext; when the control word is decrypted, it points to ciphertext. The fifth register EDI stores an output data pointer (pointing to another system memory space for storing output data), which can follow the ESegment segmentation technology; when the control word is encrypted, it indicates the storage of ciphertext; when the control word is decrypted, it indicates the storage of plaintext.

[0030] In addition, Table 204 also shows how the microcode ucode defines output registers corresponding to the ISA's SM4 cryptographic algorithm instructions. When the SM4 cryptographic algorithm for all input data blocks of an input data is completed, the second register ECX is cleared to 0. The input data pointer maintained on the fourth register ESI and the output data pointer maintained on the fifth register EDI will increase with each completion of the SM4 cryptographic algorithm for an input data block. After executing the block cipher algorithm, the processor increases the content of the fourth register ESI by a displacement based on the number of bytes of the input data (the increased displacement is the number of bytes of the input data), and increases the content of the fifth register EDI by a displacement based on the number of bytes of the output data (the increased displacement is the number of bytes of the output data).

[0031] In particular, the register usage defined in the input / output register table may also have other variations, depending on the user's design.

[0032] Figure 2B The format 212 of the ISA's SM4 cryptographic algorithm instruction is illustrated, and the related microcode ucode design is introduced in Table 214. The format 212 is the same as the format 202. After the decoder 110 recognizes the encoding "0xF3 0x0F 0xA7 0xF0", it generates multiple microinstructions according to the microcode ucode, uses the architecture register 124, and operates the SM4 engine 126. Another implementation is to set other encodings for the format 212 that are sufficiently distinguished from the encoding "0xF3 0x0F 0xA7 0xF0" of the format 202, so that the processor is capable of performing the SM4 cryptographic algorithm according to SM4 cryptographic algorithm instructions of multiple formats.

[0033] Different from the microcode ucode design shown in Table 204, which provides the fourth register ESI and the fifth register EDI for the input data pointer and the output data pointer respectively, the microcode ucode design shown in Table 214 uses the fourth register ESI to store an input and output information pointer, pointing to a system memory space, in which an input data pointer and an output data pointer are stored. The input data pointer points to an input data stored in the system memory. The output data pointer indicates a system memory space for storing output data. Regarding the output register of the SM4 cryptographic algorithm, the microcode ucode design shown in Table 214 does not change the fourth register ESI.

[0034] Figure 2C The format 222 of the ISA's SM4 cryptographic algorithm instruction is illustrated, and the related microcode ucode design is introduced in table 224. Different from formats 202 and 212, format 222 has fields InPointer and OutPointer, which respectively store an input data pointer and an output data pointer pointing to system memory. The input data pointer points to an input data stored in the system memory. The output data pointer indicates a system memory space for storing output data. After the decoder 110 recognizes the code "0xF3 0x0F 0xA7 0xF0" (or a special numerical code specifically for identifying format 222), multiple microinstructions are generated according to the microcode ucode design 224, including defining, using, and managing the architecture register 124 to operate the cryptographic execution unit 118 to perform the SM4 cryptographic algorithm on the input data based on the input key. The microcode ucode design shown in table 224 does not need to define an architecture register for the information of input and output data. In one embodiment, the fields InPointer and OutPointer are 32 bits respectively.

[0035] Figure 3An embodiment of ISA instruction writing is illustrated. The program code 300 may include an SM4 cryptographic algorithm instruction 302 in the above format 202, 212, or 222. The SM4 cryptographic algorithm instruction 302 may include at least one register setting instruction 304 before it to fill in the architecture register 124 to prepare for the execution of the SM4 cryptographic algorithm instruction 302.

[0036] Figure 4 It is a flow chart illustrating the step procedure triggered by the SM4 cryptographic algorithm instruction according to one embodiment of the present invention, and the multiple microinstructions converted from the corresponding SM4 cryptographic algorithm instruction.

[0037] Step S402 checks the number of input data blocks (for example, reading the second register ECX). If the number of input data blocks is 0 (ECX is 0), the process enters step S404 and ends the SM4 cryptographic algorithm. If the number of input data blocks is not 0 (ECX is not 0), the process enters step S406, and the SM4 engine 126 is ordered to operate according to the control word, the input key, and an input data block (decomposed from an input data). Step S408, an output data block generated by the SM4 engine 126 is stored in the memory to form the output data. Then, the SM4 engine 126 reduces the value in the second register ECX by 1. Step S410 checks whether the SM4 cryptographic algorithm for all input data blocks is completed. For example, check whether the second register ECX is 0. If ECX is not 0, the process returns to step S406, and the SM4 cryptographic algorithm engine 126 is ordered to operate according to the control word, the input key, and the next input data block. If ECX is 0, the process enters step S412, and the SM4 cryptographic algorithm ends. In another embodiment, the step of the SM4 engine 126 subtracting 1 from the value in the second register ECX is arranged after executing step S406 and before executing step S408.

[0038] The above-mentioned SM4 engine microinstruction corresponding to step S406 is used to drive the SM4 engine 126 to complete the SM4 cryptographic algorithm of each input data block.

[0039] Figure 5 According to one embodiment of the present invention, an SM4 engine 500 is illustrated, wherein the hardware is used as: control logic 502, rounding logic 504, key extension logic 506, and key anti-tone transform 508, and includes accelerator internal storage space M1-M3 and a multiplexer Mux.

[0040] According to the input key pointer stored in the second register EBX, an input key 510 is taken from the system memory and input into the SM4 engine 500. Based on the input key 510, the key expansion logic 506 generates 32 keys rk0...rk required for 32 rounds of operations on a data block. 31 , stored in the accelerator internal storage space M1 as 32 sequential keys. The key reverse conversion 508 converts the 32 sequential keys rk0...rk 31 Reverse order is rk 31 ...rk0, stored in the accelerator's internal storage space M2 as 32 reverse keys. The sequential and reverse keys are both delivered to the multiplexer MUX input terminal.

[0041] The control word 512 is taken from the third register EAX. The control logic 502 provides a selection signal dec / enc to switch the multiplexer MUX according to the control word 512, so that the sequential keys rk0...rk 31 Encrypt the round of operation logic 504, or provide the reverse key rk 31 ...rk0 is sent to the round operation logic 504 for decryption. The round operation logic 504 can also switch between encryption and decryption according to the selection signal dec / enc.

[0042] Input data 514 is taken from the system memory and input into the round operation logic 504 data block by data block. The round operation logic 504 performs 32 rounds of encryption or decryption on each data block using 32 keys transmitted from the multiplexer MUX.

[0043] The round operation logic 504 includes a multi-XOR logic 516, a non-linear transform 518, a linear transform 520, a single XOR logic 522, and a reverse transform 524. The round operation logic 504 uses the key obtained from the multiplexer MUX i=0,1,2,...31,32 rounds of operations are performed. Encryption and decryption are both performed using this hardware. The internal hardware design is as follows.

[0044] Multiple XOR logic 516 performs operations:

[0045] (X i+1 ^X i+2 ^X i+3 ^k i )

[0046] ^ is 32-bit XOR.

[0047] Non-linear transformation 518 performs the following operations:

[0048] B = t(A), that is

[0049] (b0, b1, b2, b3)=(Sbox(a0), Sbox(a1), Sbox(a2), Sbox(a3)),

[0050] Sbox is an S-box operation, which is a permutation of a fixed 8-bit input and 8-bit output. A is a hardware block 518

[0051] enter, B is the output of hardware block 518,

[0052] The linear transformation 520 performs the operation:

[0053] L(B)=B^(B<<<2)^(B<<<10)^(B<<<18)^(B<<<24)

[0054] <<<i is a 32-bit circular left shift of i bits.

[0055] Single XOR logic 522 performs operation:

[0056] X i+4 =X i ^T(X i+1 ^X i+2 ^X i+3 ^k i )

[0057] T is a reversible transformation, T(X i+1 ^X i+2 ^X i+3 ^k i ) that is, nonlinear transformation 518, and linear transformation

[0058] The calculation result of 520 is T(.)=L(t(.)).

[0059] · Reverse conversion 524 to perform operation:

[0060] R(A0,A1,A2,A3)=(A3,A2,A1,A0)

[0061] A is the input of hardware block 524. After 32 rounds of operation, the reverse conversion 524 outputs the output data block of the target data block (X0, X1, X2, X3) R(X 32 , X 33 , X 34 , X 35 )=(X 35 , X 34 , X33 , X 32 ).

[0062] Taking encryption as an example, The 32-round key is a 32-round sequential key from the accelerator's internal storage space M1. i=0, 1, 2, ...31.

[0063] Taking decryption as an example, The 32-round key is the 32 reverse-order keys taken from the accelerator's internal storage space M2. i=31, 30, 29, ...0.

[0064] The key expansion logic 506 includes a key-XOR logic 526, a multi-XOR logic 528, a non-linear transform 530, a linear transform 532, and a single XOR logic 534. The key expansion logic 506 generates a key-XOR logic 526 according to the input key 510 (i.e., MK=(MK0, MK1, MK2, MK3), MK0, MK1, MK2, MK3 are 32 bits each), a system parameter FK (=(FK0, FK1, FK2, FK3), FK0, FK1, FK2, FK3 are 32 bits each), and a fixed parameter CK (=(CK0, CK1, ..., CK 31 ), CK0, CK1, ..., CK 31 Each is 32 bits) operation. The system parameter FK and the fixed parameter CK can be provided by the internal storage space M3. The internal hardware design is as follows.

[0065] The key XOR logic 526 performs the operation:

[0066] (K0, K1, K2, K3) = (MK0^FK0, MK1^FK1, MK2^FK2, MK3^FK3)

[0067] ^ is 32-bit XOR.

[0068] Multiple XOR logic 528 operations:

[0069] (K i+1 ^K i+2 ^K i+3 ^CK i )

[0070] The non-linear transformation 530 performs the following operations:

[0071] B = t(A), that is

[0072] (b0, b1, b2, b3)=(Sbox(a0), Sbox(a1), Sbox(a2), Sbox(a3)),

[0073] Sbox is an S-box operation, which is a permutation of a fixed 8-bit input and 8-bit output. A is a hardware block 530

[0074] enter, B is the output of hardware block 530,

[0075] Linear transformation 532 performs the operation:

[0076] L'(B)=B^(B<<<13)^(B<<<23)

[0077] <<<i is a 32-bit circular left shift of i bits.

[0078] Single XOR logic 534 performs operation:

[0079] rk i =K i+4 =K i ^T′(K i+1 ^X i+2 ^X i+3 ^CK i )

[0080] T' is a reversible conversion, T'(K i+1 ^X i+2 ^X i+3 ^CK i ) is the result of the nonlinear transformation 530 and the linear transformation 532, T'(.) = L'(t(.)). i , i=0, ..., 31 are calculated sequentially and stored sequentially in the accelerator internal storage space M1, and then the key reverse conversion hardware 508 performs reverse conversion to form a reverse key and stores it in the accelerator internal storage space M2.

[0081] Extended key rk i Regardless of the order or reverse order, they are all properly protected in the SM4 engine 500. Even more, the round operation logic 504 and the key expansion logic 506 also make the intermediate data of the round operation and the key expansion operation properly protected in the SM4 engine 500. The design of the present invention provides a cryptographic algorithm hardware with a higher security.

[0082] In one embodiment, the processor performs N rounds of operations on each input data block to generate an output data block corresponding to each input data block to form the output data, where N is an integer. The processor expands N extended keys based on the input key, so that different rounds of operations on each input data block use different extended keys. N is not limited to 32.

[0083] In one embodiment, the cryptographic execution unit 118 is not specifically designed with the SM4 engine 126. This embodiment converts a single ISA SM4 cryptographic algorithm instruction into multiple microinstructions to operate the logic operation unit ALU by planning the microcode ucode content, that is, to complete the SM4 cryptographic algorithm. In particular, this embodiment can also protect important intermediate data of the SM4 cryptographic algorithm in the internal storage space of the processor.

[0084] In one implementation, the SM4 engine is not as powerful as the SM4 engine 500, but some functional modules (e.g., the cryptographic expansion logic 506) of the SM4 engine 500 are implemented by configuring the microcode ucode to operate the microinstruction operation logic unit ALU. This embodiment can also protect important intermediate data of the SM4 cryptographic algorithm in the internal storage space of the processor.

[0085] In summary, a processor implemented according to one embodiment of the present invention includes a cryptographic execution unit, a group of architectural registers, a microcode storage device storing a microcode, and a decoder. Corresponding to a block cipher algorithm instruction of an instruction set architecture (ISA), the decoder generates a plurality of microinstructions according to the microcode. The plurality of microinstructions include defining, using, and managing the contents of the group of architectural registers, and operating the cryptographic execution unit to perform a block cipher algorithm (SM4) on an input data based on an input key, and generating and storing an output data. Regarding the block cipher algorithm of the input data, a plurality of extended keys derived from the input key can be protected in the internal hardware storage space of the processor, thereby greatly improving security. The present invention designs a dedicated ISA SM4 cryptographic algorithm instruction for the SM4 cryptographic algorithm.

[0086] As can be seen from the above, in the known technology, multiple instruction set architecture instructions are required to implement the block cipher algorithm, and the intermediate data generated during the operation process cannot be effectively protected, so the security is poor. However, through the processor with a block cipher algorithm (SM4) and the processing method thereof provided by the present invention, only one instruction set architecture instruction is needed to implement the block cipher algorithm, and the intermediate data generated during the implementation of the block cipher algorithm can be stored in the processor's internal hardware storage space, so that these intermediate data cannot be accessed outside the processor, thereby greatly improving security.

[0087] Although the present invention has been disclosed as above with preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art may make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be defined by the claims.

[0088] [Explanation of symbols]

[0089] 100: processor;

[0090] 102: branch predictor;

[0091] 104: instruction cache;

[0092] 106: instruction buffer (XIB);

[0093] 108: format instruction queue (FIQ);

[0094] 110: decoder;

[0095] 112: instruction queue (XIQ);

[0096] 114: Rename unit;

[0097] 116: Memory sequential buffer area;

[0098] 118: cryptographic execution unit;

[0099] 120: data cache;

[0100] 122: Rearrange the buffer area;

[0101] 124: Architecture registers;

[0102] 126: SM4 engine (block cipher algorithm accelerator);

[0103] 202, 212, 222: Format of SM4 cryptographic algorithm instructions;

[0104] 204, 214, 224: Table, corresponding to the input and output register design of the SM4 cryptographic algorithm;

[0105] 300: program code;

[0106] 302: SM4 cryptographic algorithm instructions;

[0107] 304: At least one register setting instruction;

[0108] 500: SM4 engine;

[0109] 502: Hardware, used as control logic;

[0110] 504: hardware, used as round operation logic;

[0111] 506: Hardware, used as key expansion logic;

[0112] 508: Hardware, used for key reverse conversion;

[0113] 510: Enter the key;

[0114] 512: control word;

[0115] 514: Input data;

[0116] 516: Hardware, used as multiple XOR logic;

[0117] 518: Hardware, used for nonlinear conversion;

[0118] 520: Hardware, used for linear conversion;

[0119] 522: Hardware, used as single XOR logic;

[0120] 524: Hardware, used for reverse conversion;

[0121] 526: Hardware, used as key XOR logic;

[0122] 528: Hardware, used as multiple XOR logic;

[0123] 530: Hardware, used for nonlinear conversion;

[0124] 532: Hardware, used for linear conversion;

[0125] 534: Hardware, used as single XOR logic;

[0126] AGU: Address Generation Unit;

[0127] ALU: logic operation unit;

[0128] dec / enc: select signal;

[0129] DTLB: Data Translation Lookaside Buffer;

[0130] EAX, ECX, EBX, ESI, EDI: registers;

[0131] Fadd, Fmul, Fmisc, MMX: corresponding hardware for various instructions;

[0132] InPointer, OutPointer: fields, fill in input data pointer, output data pointer;

[0133] ITLB: instruction translation backup buffer;

[0134] M1, M2, M3: internal storage space of accelerator;

[0135] MUX: multiplexer;

[0136] non: no value;

[0137] Opcode, ModR / M, SIB, Displacement, immediate: fields;

[0138] RS: reserved station;

[0139] S402…S412: steps;

[0140] ucode: microcode.

Claims

1. A processor having a block cipher algorithm, comprising: The first register stores an input key pointer, pointing to the input key; In response to a single block cipher algorithm instruction of the instruction set architecture, the processor obtains input data from the first memory space, performs a block cipher algorithm on the input data based on the input key, encrypts or decrypts output data, and stores the output data in the second memory space or the internal hardware storage space. The processor further includes: The third register stores a control word, and the control word includes a plurality of mode setting bits for setting the block cipher algorithm to a codebook mode, a ciphertext block concatenation mode, a ciphertext feedback mode, an output feedback mode, or a calculator mode.

2. The processor having a block cipher algorithm as claimed in claim 1, wherein: The parameters of the single block cipher algorithm instruction include the input key pointer, an input data pointer pointing to the input data, and an output data pointer indicating the storage of the output data.

3. The processor having a block cipher algorithm as claimed in claim 1, wherein: The processor groups the input data into a plurality of input data blocks of a fixed size according to the number of input data blocks of the input data; The processor performs N rounds of operations on each input data block to generate an output data block corresponding to each input data block to form the output data, where N is an integer; as well as The processor expands N extended keys based on the input key, so that different rounds of operations of each input data block use different extended keys.

4. The processor with a block cipher algorithm as claimed in claim 3, comprising: The second register stores the number of input data blocks.

5. The processor having a block cipher algorithm according to claim 1, wherein: The control word also includes an encryption and decryption setting bit for setting the processor to encrypt or decrypt the input data based on the input key using the block cipher algorithm.

6. The processor having a block cipher algorithm as claimed in claim 1, further comprising: The fourth register stores an input data pointer pointing to the first memory space. After executing the block cipher algorithm, the processor increases the content of the fourth register by a displacement based on the number of bytes of the input data.

7. The processor having a block cipher algorithm as claimed in claim 6, further comprising: The fifth register stores the output data pointer, pointing to the second memory space. After executing the block cipher algorithm, the processor increases the content of the fifth register by a displacement based on the number of bytes of the output data.

8. The processor having a block cipher algorithm as claimed in claim 1, further comprising: The fourth register stores an input / output information pointer pointing to a third memory space, and the third memory space stores an input data pointer pointing to the first memory space and an output data pointer pointing to the second memory space.

9. The processor having a block cipher algorithm as claimed in claim 1, wherein: The block cipher algorithm instruction includes an input data pointer field, and an output data pointer field; The input data pointer field carries an input data pointer pointing to the first memory space, and the output data pointer field carries an output data pointer pointing to the second memory space.

10. The processor having a block cipher algorithm according to claim 1, further comprising: Cryptographic execution unit; a set of architectural registers including the first register; A microcode storage device for storing microcode; as well as A decoder, responsive to the single block cipher algorithm instruction, decodes a plurality of microinstructions according to the microcode; in: The plurality of microinstructions include accessing and managing the contents of the group of architectural registers, and operating the cryptographic execution unit to perform the block cipher algorithm on the input data based on the input key.

11. The processor having a block cipher algorithm as claimed in claim 10, wherein: The cryptographic execution unit includes a block cipher algorithm accelerator; The plurality of microinstructions include accelerator operation microinstructions; In response to the accelerator operation microinstruction, the block cipher algorithm accelerator performs N rounds of operations for each input data block of the input data to generate an output data block corresponding to each input data block to form the output data, where N is an integer.

12. The processor having a block cipher algorithm according to claim 11, wherein: The block cipher algorithm accelerator includes: Key expansion logic hardware receives the input key and expands N expansion keys based on the input key, so that different rounds of operations on each input data block use different expansion keys; and The first accelerator internal storage space caches the N extended keys into N sequential keys according to the generation order for use in encryption.

13. The processor having a block cipher algorithm according to claim 12, wherein: The block cipher algorithm accelerator includes: The key reverse conversion hardware is used to reverse the N sequential keys stored in the internal storage space of the first accelerator into N reverse keys; and The second accelerator has internal storage space for caching the N reverse keys for use in decryption.

14. The processor having a block cipher algorithm according to claim 13, wherein: The block cipher algorithm accelerator includes: round operation logic hardware, and a multiplexer, wherein the multiplexer supplies the N sequential keys cached in the internal storage space of the first accelerator or the N reverse keys cached in the internal storage space of the second accelerator to the round operation logic hardware, so that the round operation logic hardware performs N rounds of operations on each input data block, and generates output data blocks corresponding to each input data block; and The control logic hardware receives the control word and, when the encryption / decryption setting bit of the control word indicates encryption, operates the multiplexer to supply the N sequential keys to the round operation logic hardware, and, when the encryption / decryption setting bit indicates decryption, operates the multiplexer to supply the N reverse keys to the round operation logic hardware.

15. The processor having a block cipher algorithm as claimed in claim 13, wherein: The key expansion logic hardware includes serially connected key XOR logic hardware, multiple XOR logic hardware, non-linear conversion hardware, linear conversion hardware, and single XOR logic hardware.

16. The processor having a block cipher algorithm according to claim 15, wherein: The block cipher algorithm accelerator includes: The internal storage space of the third accelerator stores FK which is a system parameter and CK which is a fixed parameter; FK=(FK0, FK1, FK2, FK3), where FK0, FK1, FK2, and FK3 are 32 bits each; and CK=(CK0,CK1,…,CK 31 ), CK0, CK1, …, CK 31 Each is 32 bits.

17. The processor having a block cipher algorithm as claimed in claim 16, wherein: The input key obtained by the key expansion logic hardware is MK=(MK0, MK1, MK2, MK3), MK0, MK1, MK2, MK3 are 32 bits each, and the key expansion logic hardware obtains FK and CK from the internal storage space of the third accelerator; The key XOR logic hardware is operated, (K0,K1,K2,K3)=(MK0^FK0,MK1^FK1,MK2^FK2,MK3^FK3); The multiple XOR logic hardware performs a 32-bit XOR operation (K i+1 ^K i+2 ^K i+3 ^CK i ); The nonlinear conversion hardware performs an S-box operation B = t(A), that is, (b0,b1,b2,b3)=(Sbox(a0),Sbox(a1),Sbox(a2),Sbox(a3)), A is the input of the nonlinear conversion hardware, and B is the output of the nonlinear conversion hardware, The linear transformation hardware performs the operation L'(B), namely L'(B)=B^(B<<<13)^(B<<<23); as well as The single XOR logic hardware performs the operation to obtain the sequential key for encryption. rk i =K i+4 =K i ^T′(K i+1 ^K i+2 ^K i+3 ^CK i ), i＝0,…,31。 18. The processor having a block cipher algorithm as claimed in claim 17, wherein: The key reverse conversion hardware performs reverse conversion R(rk0,rk1,…,rk 31 )=(rk 31 ,rk 30 ,…,rk0), and get the reverse key for decryption.

19. The processor having a block cipher algorithm as claimed in claim 14, wherein: The round of operation logic hardware includes serially connected multiple XOR logic hardware, non-linear conversion hardware, linear conversion hardware, single XOR logic hardware, and reverse conversion hardware.

20. The processor having a block cipher algorithm as claimed in claim 19, wherein: A target data block obtained by the operation logic hardware from the first memory space is And the key obtained from the multiplexer is 2,…31, when encrypting, k i The 32 sequential keys cached in the internal storage space of the first accelerator are used for decryption. i 32 reverse keys cached in the internal storage space of the second accelerator; The multiple XOR logic hardware performs a 32-bit XOR operation (X i+1 ^X i+2 ^X i+3 ^k i ); The nonlinear conversion hardware performs an S-box operation B = t(A), that is, (b0,b1,b2,b3)=(Sbox(a0),Sbox(a1),Sbox(a2),Sbox(a3)), A is the input of the nonlinear conversion hardware, and B is the output of the nonlinear conversion hardware, The linear conversion hardware performs the operation L(B), that is, L(B)=B^(B<<<2)^(B<<<10)^(B<<<18)^(B<<<24); The single XOR logic hardware performs the operation X i+4 =X i ^T(X i+1 ^X i+2 ^X i+3 ^k i ), where T(.) = L(t(.)); and The reverse conversion hardware performs the reverse conversion R(X 32 ,X 33 ,X 34 ,X 35 )=(X 35 ,X 34 ,X 33 ,X 32 ), as an output data block of the target data block 21. A processing method of a processor, comprising: In response to a single block cipher algorithm instruction of the instruction set architecture, obtain input data from the first memory space, perform a block cipher algorithm on the input data based on an input key, encrypt or decrypt output data, and store the output data in the second memory space or the internal hardware storage space; as well as A control word is stored, wherein the control word includes a plurality of mode setting bits for setting the block cipher algorithm to a codebook mode, a ciphertext block concatenation mode, a ciphertext feedback mode, an output feedback mode, or a calculator mode.

22. The process of claim 21, wherein: The parameters of the single block cipher algorithm instruction include the input key pointer, an input data pointer pointing to the input data, and an output data pointer indicating the storage of the output data.

23. The processing method of claim 21, further comprising: According to the number of input data blocks of the input data, grouping the input data into a plurality of input data blocks of a fixed size; Performing N rounds of operations on each input data block to generate an output data block corresponding to each input data block to form the output data, wherein N is an integer; as well as N extended keys are extended based on the input key, wherein different rounds of operations on each input data block use different extended keys.

24. The processing method of claim 21, further comprising: In response to the single block cipher algorithm instruction, a plurality of microinstructions are decoded according to the microcode; The plurality of microinstructions include performing the block cipher algorithm on the input data based on the input key.

25. The processing method of claim 24, wherein the plurality of microinstructions include accelerator operation microinstructions, the processing method further comprising: In response to the accelerator operation microinstruction, the block cipher algorithm accelerator performs N rounds of operations for each input data block of the input data to generate an output data block corresponding to each input data block to form the output data, wherein N is an integer.

26. The processing method of claim 25, further comprising: receiving the input key, and expanding N expanded keys based on the input key, wherein different rounds of operations of each input data block use different expanded keys; as well as The N extended keys are cached as N sequential keys in the order of generation for use in encryption.

27. The processing method of claim 26, further comprising: Reverse-convert the N sequential keys into N reverse-sequence keys; as well as The N reverse keys are cached for use in decryption.

28. The processing method of claim 27, further comprising: According to the N cached sequential keys or the N cached reversed sequential keys, N rounds of operations are performed on each input data block to generate output data blocks corresponding to each input data block; Among them, when an encryption and decryption setting bit of the control word indicates encryption, N rounds of operations are performed on each input data block according to the N sequential keys, and when the encryption and decryption setting bit indicates decryption, N rounds of operations are performed on each input data block according to the N reverse keys.

Images