A Bluetooth device data encryption structure and encryption and decryption method

Abstract

The present invention discloses a Bluetooth device data encryption structure and encryption / decryption method. The structure includes a hybrid encryption module, wherein: the hybrid encryption module includes an AES / SM4 configurable byte replacement encryption algorithm module, a key encryption unit, a key tracking unit, a key decryption unit, a signature verification unit and an anti-power consumption design module; the AES / SM4 configurable byte replacement encryption algorithm module includes 7 selectors, 2 round key addition units, a configurable key expansion unit, a configurable byte replacement unit, a distributor, a row shift unit, a column obfuscation unit, a linear transformation unit, and a reverse transformation unit; the encryption module designed by the present invention has a greatly reduced area and power consumption performance compared with circuits implemented in traditional ways, and the configurable encryption algorithm encrypts data, has the advantages of fast encryption and decryption speed and flexible configuration, and to a certain extent increases the security of the device, can resist general side channel attacks, and greatly enhances the security of the device.

Description

Technical Field

[0001] The present invention relates to the field of encryption and decryption algorithms, and in particular to a Bluetooth device data encryption structure and encryption and decryption method. Background Art

[0002] We analyzed a certain brand of wristband that uses unencrypted authentication and encrypted data transmission. We downloaded the LightBlue Bluetooth testing app and connected it to the wristband. Once connected, we saw some UUID and SERVICE parameters. These UUIDs and SERVICEs correspond to different functions and communication protocols. We easily noticed that "Service:immediate Alert" was simply the plaintext Alert level setting. We controlled the wristband's vibration by clicking "Write new value" in the Alert Level field: 1 or 2 (vibration level: 0: no vibration, 1: mild & low vibration, 2: strong vibration). This method allowed us to control the vibrating behavior of any wristband within a certain range. Our experiments demonstrated that without software security measures, Bluetooth devices are insecure. Some apps can directly connect, access data, and control them using the UUID, infringing on consumer privacy. Therefore, data encryption technology for Bluetooth devices is imperative. Ensuring data security is a key requirement in the information age.

[0003] Currently, most solutions rely on simple AES128 or SM4 encryption for data transmission. However, if energy attacks are conducted on the AES and SM4 algorithms, unprotected AES and SM4 encryption algorithms will be highly vulnerable to CPA and DPA attacks. Furthermore, reusing the same modules for AES and SM4 algorithms significantly reduces design costs and device footprint, providing greater flexibility in practical applications. Summary of the Invention

[0004] The purpose of the present invention is to provide a Bluetooth device data encryption structure and encryption and decryption method to overcome the shortcomings of existing Bluetooth device data transmission security and the problem that it is easy to be attacked.

[0005] In order to achieve the above tasks, the present invention adopts the following technical solutions:

[0006] A Bluetooth device data encryption structure includes a hybrid encryption module, wherein:

[0007] The hybrid encryption module includes an AES / SM4 configurable byte replacement encryption algorithm module, which includes selectors 1 to 7, round key addition units 1 and 2, a configurable key expansion unit, a configurable byte replacement unit, a distributor, a row shift unit, a column obfuscation unit, a linear transformation unit, and a reverse transformation unit, wherein:

[0008] The initial key key enters selector 1 and is divided into key_A and key_B with the same value. After key_A enters the configurable key expansion unit for key expansion processing, if the algorithm is AES, it outputs ex_keyA. If the algorithm is SM4, it outputs ex_keyS to selector 2. Selector 2 uses ex_keyA in the round key addition unit 1 in the AES round transformation. Selector 2 enters ex_keyS and key_B from selector 1 into selector 3. If the algorithm is SM4, selector 3 outputs ex_keyS to the round key addition unit 2. If the algorithm is AES, it outputs key_B to the round key addition unit 2.

[0009] For the AES algorithm, the plaintext data X enters the selector 4 directly, while for the SM4 algorithm, the data is divided into a 4×4 plaintext data matrix X i 、X i+1 、X i+2 、X i+3 , for the high three digits of the matrix X i+1 、X i+2 、X i+3 The data obtained after XOR processing enters the selector 4; according to whether the algorithm is AES or SM4, the round key addition processing of the corresponding algorithm is performed in the round key addition unit 2, and the round key addition result X_A of AES or the round key addition result X_S of SM4 is obtained at the selector 5; X_A enters the selector 6 as the input data of the first round iteration of the AES algorithm and serves as the output of the first round. Then, the selector 6 outputs the round key addition result A_lun output by the round key addition unit 1 as the output to the configurable byte replacement unit, and the data X_S also enters the unit together. After the byte replacement processing of the configurable byte replacement unit, according to the algorithm A ES or SM4, obtaining X_byteA or X_byteS; the distributor distributes the AES or SM4 algorithm according to the algorithm, inputs the previously output X_byteA into the row shift unit for shift transformation processing, and then outputs the processing result to the column obfuscation unit; the output of the column obfuscation unit will enter the selector 7, where the data input into the round key addition unit 1 in the last round is the data directly output by the row shift unit, and the data output by the column obfuscation unit at other times; the output of the round key addition unit 1 will re-enter the selector 6 until the final AES encrypted ciphertext A is obtained after the round key addition unit 1 is operated in the last round of the AES algorithm;

[0010] The distributor distributes the obtained data X_byteS into the linear transformation unit, and the result obtained after the cyclic shift processing is combined with the lower one data matrix X i The XOR processing is performed, and the result obtained is used as the output of the first round of the SM4 algorithm. The output of the first round of the cycle is used as the input of the second round of the cycle, and then divided into a new 4×4 plaintext data matrix for iterative cycle. After reaching the number of cycle iterations, the result obtained by the XOR processing of the last round of data is reversed through the reverse transformation unit to obtain the final ciphertext S.

[0011] Furthermore, for the key key_A, the configurable key expansion unit iterates 10 rounds of the following formula 2 for the AES algorithm to obtain the expanded key ex_keyA, and iterates 32 rounds of the following formula 3 for the SM4 algorithm to obtain the expanded key ex_keyS:

[0012]

[0013]

[0014] In Formula 2, K0, K1, K2, and K3 represent the AES keys, and the superscript j represents the number of iterations. In Formula 3, the subscript i represents the number of iterations, and K i , K i+1 , K i+2 , K i+3 Indicates the SM4 key, rk i represents the key obtained in the i-th iteration, where i=0 in the first iteration; SBOX() represents the configurable byte replacement unit, which completes the replacement between bytes; Shift() represents the word loop operation, which shifts the last word of the input data left by one byte; Rcon(j) represents the round constant of each round of the AES algorithm, CK i It is a fixed constant in each round of the SM4 algorithm, and <<< indicates a circular left shift.

[0015] Furthermore, in the configurable byte replacement unit, the expressions for performing byte replacement on the AES algorithm and the SM4 algorithm are as shown in Formula 4 and Formula 5:

[0016] Z=M(δ -1 (δX) -1 )+V (4)

[0017] Y=A(T -1 (T(AX+C)) -1 )+C (5)

[0018] Among them, X represents the data input to the unit, Z represents the result of AES byte replacement, and Y represents the result of SM4 byte replacement; the matrix M represents the S-box affine operation matrix of the AES algorithm, and the constant in the transformation process is represented by V; the affine matrix and constant of the S-box of the SM4 algorithm are represented by A and C respectively; δ and T are the isomorphic mapping matrices of AES and SM4 respectively, δ -1 and T -1 They are the isomorphic mapping inverse matrices of AES and SM4 respectively;

[0019] The data entering this unit first selects the AES / SM4 algorithm, executes the corresponding affine operation and isomorphic mapping operation, and then performs inverse transformation on the result. Finally, inverse isomorphic mapping and inverse affine operation are performed to obtain the final output of the unit.

[0020] Furthermore, the row shift unit is used to cyclically shift the state matrix obtained after byte replacement; during the encryption process, except for the first row of data remaining unchanged, the number of each matrix row is increased by one, and the data in that row will be cyclically shifted left by one more byte; the decryption process is a cyclic right shift operation, which is exactly the opposite of the encryption process.

[0021] Furthermore, the column confusion unit is used to perform column transformation processing on the data matrix input into the unit, and multiply the data matrix by a matrix with a fixed parameter on the left;

[0022] The round key adding unit is used to perform a bitwise exclusive OR operation on the grouped data and the key.

[0023] Furthermore, the linear transformation unit is used for cyclic shift operation, and the operation process is described as follows:

[0024]

[0025] Among them, L represents the result obtained after the circular shift operation of data A, <<< represents circular left shift, and <<<2 represents circular left shift of the input data by 2 bits. Represents the exclusive OR operation.

[0026] Furthermore, the Bluetooth device data encryption structure also includes:

[0027] A legitimate user ID creation module includes a user connection request unit, a Bluetooth device ID query unit, a user ID creation unit, and a user data storage unit;

[0028] When a user sends an access request to access a Bluetooth device, the user connection request unit first marks the user; the Bluetooth device query ID unit first searches the user ID database in the local memory to see if there is a corresponding user ID locally. If not, it indicates that the user is accessing the Bluetooth device for the first time, and the user ID creation unit needs to create the user ID. After the creation, the user is a legitimate user, and a user data storage area corresponding to the user ID is established in the user data storage area unit. The legitimate user can access the user data information in the user data storage area after the signature verification is passed, thereby completing the user ID creation process; the ID of each legitimate user is related to the public key of the elliptic curve ECC algorithm. By taking different points G on the elliptic curve to generate different public keys P, and using a hash function to perform hash operations on different public keys, different user IDs can be obtained.

[0029] Furthermore, the hybrid encryption module further includes: an anti-power consumption attack design module;

[0030] The anti-power attack design module is used to introduce a random mask m1 to perform XOR masking on the data before it enters the AES / SM4 configurable byte replacement encryption algorithm module. The encryption result output by the AES / SM4 configurable byte replacement encryption algorithm module is then demasked and restored.

[0031] It is also used to perform XOR masking on the initial key key_A using the random mask m2, and the result is input into the configurable key expansion unit, and the masking and restoration operation is performed after the encryption and decryption key expansion is completed.

[0032] Furthermore, the hybrid encryption module further includes: a key encryption unit, a key tracking unit, a key decryption unit, and a signature verification unit, wherein:

[0033] The key encryption unit uses the SM2 algorithm to encrypt the key ex_keyA or ex_keyS expanded by the configurable key expansion unit and randomly appends the processed session key data key_AS_2 to the user's secret data X. Only by matching the correct user ID can the user's encrypted session key information be correctly accessed. The key tracing unit then finds the encrypted key information key_AS_2 in the encrypted plaintext data segment and inputs it into the key decryption unit, where it uses the SM2 private key data stored on the Bluetooth device to correctly decrypt the session key key_AS. This session key is then used to decrypt the encrypted data X entering the decryption unit, obtaining the final transmitted information.

[0034] The signature verification unit is used to implement signature verification.

[0035] A Bluetooth device data encryption method, comprising:

[0036] Step 1: When a user accesses a Bluetooth device, the user's legal ID information is verified based on the access request data sent by the user. If the user's ID information does not exist, the user is created as a legal user and the signature verification is performed for identity authentication;

[0037] Step 2: The user access data X must first be masked by the anti-power attack design module before transmission to obtain the masked access data X_MASK;

[0038] Step 3: Send the masked data X_MASK to the hybrid encryption module. It is first encrypted by the AES / SM4 configurable byte replacement encryption algorithm module. Based on the selected encryption algorithm, the encrypted data X_MASK_AS can be obtained.

[0039] Step 4: Perform SM2 encryption on the key ex_keyA or ex_keyS obtained by the configurable key expansion unit of the AES / SM4 configurable byte replacement encryption algorithm module to obtain the encrypted key key_AS_2, and randomly add the key to the encrypted data X_MASK_AS to form a complete encrypted data and send it out.

[0040] A method for decrypting data of a Bluetooth device, comprising:

[0041] Step 1: After receiving the encrypted data, the user uses the key tracking unit of the hybrid encryption module to obtain the encrypted session key key_AS_2 and the encrypted data X_MASK_AS;

[0042] Step 2: After decrypting the encrypted call key using the key decryption unit, the encrypted data is sent to the hybrid algorithm module for decryption to obtain the masked data X_MASK;

[0043] Step 3: After demasking by the anti-power attack design module, the data X accessed by the user is restored.

[0044] Compared with the prior art, the present invention has the following technical features:

[0045] 1. Creation of user ID information on the Bluetooth device. The user ID is related to the SM2 public key. Different ID information is generated through hashing function. Each accessing user has his or her own unique ID. The ID can be used for SM2 signature verification to verify the legal identity of the individual.

[0046] 2. The AES / SM4 configurable byte replacement encryption algorithm module significantly reduces the area and power consumption of circuits implemented by traditional methods, and to a certain extent increases the security of the device.

[0047] 3. The anti-power attack design module can resist general side-channel attacks, greatly enhancing the security of the device.

[0048] 4. The hybrid encryption module uses the AES / SM4 configurable encryption algorithm to encrypt data, which has the advantages of fast encryption and decryption speed and flexible configuration.

[0049] 5. The hybrid encryption module uses SM2 to encrypt the call key, which has the advantage of a long key length and higher security performance. At the same time, the key is randomly added to the secret data X, further enhancing the security of the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A schematic diagram of a Bluetooth device data encryption structure of the present invention;

[0051] Figure 2 Flowchart of creating a module for a valid user ID;

[0052] Figure 3 This is a schematic diagram of the structure of the AES / SM4 configurable byte replacement encryption algorithm module;

[0053] Figure 4 It is a structural diagram of a configurable byte replacement unit;

[0054] Figure 5 Schematic diagram of the structure of the module designed for anti-power consumption;

[0055] Figure 6 This is a schematic diagram of the working process of the hybrid encryption module;

[0056] Figure 7 Schematic diagram of the SM2 signature verification process. DETAILED DESCRIPTION

[0057] See attached Figure 1 , a Bluetooth device data encryption structure of the present invention includes a legitimate user ID creation module and a hybrid encryption module:

[0058] 1. Legal user ID creation module

[0059] like Figure 2 As shown, the legal user ID creation module is used to create a legal user ID, including a user sending connection request unit, a Bluetooth device query ID unit, a user ID creation unit, and a user data storage unit; wherein:

[0060] The user connection request unit is used to receive access request information sent by the user and mark the user to prevent multiple accesses by different users; the Bluetooth device query ID unit is used for the Bluetooth device to query whether the user's ID information exists in the local memory after receiving the user access request; the user ID creation unit is used to use the public key to create the user's legal ID after determining that the user is accessing the Bluetooth device for the first time, and to create the user data storage area for the user in the user data storage area unit; the user data storage area unit contains the user storage area of ​​each user, and the user storage area is used to store user data information. Only legitimate users and those who have passed the signature verification can access the data in the user storage area. In addition, this module also includes functional units such as deleting user IDs and related data, which will not be described in detail here.

[0061] The working process of this module is:

[0062] When a user sends an access request to a Bluetooth device, the user connection request unit first identifies the user. The Bluetooth device's ID query unit searches the local user ID database to see if a corresponding user ID exists. If not, this indicates the user is accessing the Bluetooth device for the first time and requires the user ID creation unit to create a user ID. Once created, the user is deemed legitimate and a user data storage area corresponding to the user ID is established in the user data storage area. After signature verification, the legitimate user can access the user data within the user data storage area, completing the user ID creation process. It's important to note that each legitimate user's ID is associated with the public key of the elliptic curve ECC algorithm. Different public keys P are generated by taking different points G on the elliptic curve. Different user IDs are obtained by hashing these public keys using a hash function. Once a user ID is created, the user will be identified as the corresponding user ID the next time they access the device. The user ID is used for signature verification to verify their identity, and each user has their own unique ID.

[0063] P=[d]G (1)

[0064] 2. Hybrid encryption module

[0065] Since the AES / SM4 algorithm has a fast encryption speed but has key management problems, and the SM2 algorithm has a long key but a slow encryption speed, the two methods can be combined for encryption to complement each other's advantages and disadvantages. The hybrid encryption module is used for data encryption and key encryption, such as Figure 1 and Figure 6As shown. It includes an AES / SM4 configurable byte replacement encryption algorithm module and a power consumption attack resistance design module; it also includes: a key encryption unit, a key tracing unit, a key decryption unit, and a signature verification unit. The AES / SM4 configurable byte replacement encryption algorithm module is used for encryption and decryption of transmitted data; the key encryption unit is used to encrypt the key ex_keyA or ex_keyS; the key decryption unit is used to decrypt the encrypted key obtained by tracing; the key tracing unit is used to find the encryption key randomly added to the plaintext encrypted data segment; and the signature verification unit is used to implement signature verification.

[0066] The working process of this module is:

[0067] First, the input data enters the AES / SM4 configurable byte replacement encryption algorithm module, and the user's data information m to be transmitted is encrypted to obtain the secret data X( Figure 3 At the same time, the key encryption unit uses the SM2 algorithm to encrypt the key ex_keyA or ex_keyS expanded by the configurable key expansion unit that needs to be transmitted, and randomly adds the processed call key data key_AS_2 to the user's secret data X. Only by matching the correct user ID can the user's encrypted call key information be correctly accessed. Afterwards, the key tracing unit finds the encrypted key information key_AS_2 in the encrypted plaintext data segment, inputs it into the key decryption unit, and uses the SM2 private key data stored on the Bluetooth device to correctly decrypt and obtain the call key key_AS. The encrypted data X entering the decryption unit is then decrypted using the call key to obtain the final transmission information. The above process is a two-way process. Whether the user needs to transmit data to the Bluetooth device or the user wants to read data on the Bluetooth device, a mixed encryption process is required.

[0068] 2.1AES / SM4 configurable byte replacement encryption algorithm module

[0069] This module is used for the encryption and decryption of user data information. Its structure is as follows: Figure 3 As shown, it includes 7 selectors, 2 round key addition units, a configurable key expansion unit, a configurable byte replacement unit, a distributor, a row shift unit, a column confusion unit, a linear transformation unit, and a reverse transformation unit, wherein:

[0070] ① The configurable key expansion unit divides the input 128-bit data key_A into a 4×4 key matrix as the initial key, and iterates the following operation expression for 10 rounds (AES) or 32 rounds (SM4) to obtain the corresponding expanded key ex_keyA or ex_keyS:

[0071]

[0072] In Formula 2, K0, K1, K2, and K3 represent the AES keys, and the superscript j represents the number of iterations. In Formula 3, the subscript i represents the number of iterations, and rk i represents the key obtained in the i-th iteration, where i=0 in the first iteration; SBOX() represents the configurable byte replacement unit, which performs byte-to-byte replacement; Shift() represents the word loop operation, which shifts the last word of the input data left by one byte. In simple terms, it transforms [C0, C1, C2, C3] into [C1, C2, C3, C0]; Rcon(j) represents the round constant of each round of AES. The following Table 1 shows the round constant data of each round of AES; CK i is a fixed constant for each round of SM4, and the specific parameters are given below:

[0073] Table 1 AES round constant data

[0074]

[0075] CK0=32'h00070e15, CK1=32'h1c232a31, CK2=32'h383f464d, CK3=32'h545b6269,

[0076] CK4=32'h70777e85, CK5=32'h8c939aa1, CK6=32'ha8afb6bd, CK7=32'hc4cbd2d9,

[0077] CK8=32'he0e7eef5,CK9=32'hfc030a11,CK 10 =32'h181f262d,CK 11 =32'h343b4249,

[0078] CK 12 =32'h50575e65,CK 13 =32'h6c737a81,CK 14 =32'h888f969d,CK 15 =32'ha4abb2b9,

[0079] CK 16 =32'hc0c7ced5,CK 17 =32'hdce3eaf1,CK 18 =32'hf8ff060d,CK 19 =32'h141b2229,

[0080] CK 20 =32'h30373e45,CK 21 =32'h4c535a61,CK 22 =32'h686f767d,CK 23 =32'h848b9299,

[0081] CK 24 =32'ha0a7aeb5,CK 25 =32'hbcc3cad1,CK 26 =32'hd8dfe6ed,CK 27 =32'hf4fb0209,

[0082] CK 28 =32'h10171e25,CK 29 =32'h2c333a41,CK 30 =32'h484f565d,CK 31 =32'h646b7279.

[0083] For the above CK0 to CK 31 , where 32' represents 32-bit data, and the h after 32' indicates that the data after h is a hexadecimal number. For the entire unit, the input 128-bit key data key_A is divided into a 4×4 key matrix K1, K2, K3, and K4. Using Equation 2, the second AES extended key is obtained through word rotation, byte replacement, and round constant addition. This key is used as input, and after 9 rounds of transformation, the final AES extended key ex_keyA is obtained. Using Equation 3, the second SM4 extended key is obtained through fixed parameter addition and linear transformation. This key is used as input, and after 31 rounds of transformation, the final SM4 extended key ex_keyS is obtained.

[0084] ② The configurable byte replacement unit is used to replace bytes, such as Figure 4 As shown, in this scheme, the byte replacement unit operation expressions corresponding to AES and SM4 are as follows:

[0085] Z=M(δ -1 (δX) -1 )+V (4)

[0086] Y=A(T -1 (T(AX+C)) -1 )+C (5)

[0087] Where X represents the data input to the unit, Z represents the result after AES byte replacement, and Y represents the result after SM4 byte replacement; the AES S-box affine operation matrix can be represented by the operation matrix M, and the constant in the transformation process is represented by V; the affine matrix and constant of the SM4 S-box are represented by A and C respectively; δ and T are the isomorphic mapping matrices of AES and SM4 respectively, δ -1 and T -1 They are the isomorphic mapping inverse matrices of AES and SM4 respectively. The specific parameter expressions are as follows:

[0088]

[0089]

[0090] For the whole unit, the data byte_in entering the unit first selects the AES / SM4 algorithm, performs the corresponding affine operation and isomorphic mapping operation, and then performs the inverse transformation on the result. Finally, the inverse isomorphic mapping and inverse affine operation are performed to obtain the final output byte_out of the unit, that is, Figure 4 In this solution, for the selection of the algorithm in each module, a tag value is generated when data encryption begins. The tag value is used to select the encryption algorithm in the global state, and the tag value is passed through a register.

[0091] For the application of AES and SM4 algorithms together, the byte replacement module of the traditional method is implemented in the form of a lookup table, which will cause a large area. The configurable method designed by this solution can be achieved through Figure 4 The calculation method calculates the corresponding values ​​of the byte replacement units and the key values ​​related thereto to implement this lookup table, which greatly reduces the area of ​​the design unit.

[0092] The row shift unit is used to circularly shift the 4×4 byte matrix data block after byte substitution, that is, the state matrix obtained by SBOX. During the encryption process, except for the first row of data, the data is left-shifted one byte for each subsequent row incremented by one. The decryption process is a circular right shift operation, the exact opposite of the encryption process.

[0093] ④ The column confusion unit is used to perform column transformation on the input matrix. The transformations of the encryption process and the decryption process are as follows:

[0094]

[0095] The above column transformation describes that the matrix input into the unit will be left-multiplied by a matrix of a fixed parameter, that is, the leftmost matrix in Equations 10 and 11.

[0096] The ⑤ round key addition unit is used to perform bitwise XOR operation on the packet data and the key obtained by key expansion. The key here is the key obtained in each round of key expansion.

[0097] ⑥The linear transformation unit is used for circular shift operation. The operation process can be described by the following formula:

[0098]

[0099] Among them, L represents the result obtained after the circular shift operation of data A, <<< represents circular left shift, and <<<2 represents circular left shift of the input data by 2 bits. Represents the exclusive OR operation.

[0100] So Figure 3 The process is described as:

[0101] The initial key, key, enters selector 1 and is divided into key_A and key_B, each with the same value, which then enter different units for processing. After key_A enters the configurable key expansion unit for key expansion processing, it outputs ex_keyA if the algorithm is AES, or ex_keyS if the algorithm is SM4, which is sent to selector 2. Selector 2 uses ex_keyA in the round key addition unit 1 of the AES round transformation. Selector 2 then passes ex_keyS and key_B from selector 1 to selector 3. Depending on the algorithm, selector 3 outputs ex_keyS to round key addition unit 2 if the algorithm is SM4, or key_B to round key addition unit 2 if the algorithm is AES. The above is the key-related processing process.

[0102] Plaintext data X is input into this module. For AES algorithm, plaintext data X directly enters selector 4, while in SM4 algorithm, 128-bit data is divided into 4×4 plaintext data matrix (X i 、X i+1 、X i+2 、X i+3 ), the high three-digit data matrix (X i+1 、X i+2 、X i+3) is XOR-ed and the data XS_321 is obtained, and enters the selector 4; according to whether the algorithm is AES or SM4, the round key addition processing of the corresponding algorithm is performed in the round key addition unit 2, and the round key addition result X_A of AES or the round key addition result X_S of SM4 is obtained at the selector 5; X_A enters the selector 6 as the input data of the first round iteration of the AES algorithm and serves as the output of the first round. Then, the selector 6 outputs the round key addition result A_lun output by the round key addition unit 1 as the output into the configurable byte replacement unit, and the data X_S also enters the unit together. After the byte replacement processing of the configurable byte replacement unit, X_byteA or X_byteS is obtained according to whether the algorithm is AES or SM4. The distributor distributes the data according to the algorithm, AES or SM4, and inputs the previously output X_byteA into the row shift unit for shift transformation processing, and then outputs the processing result to the column confusion unit (it should be noted that the result obtained after the last round of row shift does not need to enter the column confusion unit again and directly enters the selector 7); the output of the column confusion unit will enter the selector 7, where the last round of data input into the round key addition unit 1 is judged. The data input into the round key addition unit 1 in the last round is the data directly output by the row shift unit, and the data output by the column confusion unit at other times; the output of the round key addition unit 1 will re-enter the selector 6 until the final AES encrypted ciphertext A is obtained after the round key addition unit 1 operation in the last round of the AES algorithm; the distributor distributes the obtained data X_byteS into the linear transformation unit, and the result obtained after the cyclic shift processing is combined with the lower-order data matrix X of the plaintext data matrix into which the previously input plaintext data X is divided. i The result of XOR processing is used as the output of the first cycle of SM4 algorithm, and the output of the first cycle is used as the input of the second cycle, and then divided into a new 4×4 plaintext data matrix (X i 、X i+1 、X i+2 、X i+3 ) for iterative loop; after 32 rounds of loop iteration, the result obtained by the last round of data XOR processing is reversed to obtain the final ciphertext S.

[0103] The working process of this module is:

[0104] First, the module input is: initial key, plain text input and the specified encryption algorithm. Then the initial key is expanded by the configurable key to obtain all the keys of the selected algorithm. After the plain text is input, if the AES algorithm is selected for encryption, it is Figure 3The module finally outputs the ciphertext A after 10 rounds of transformation of the round key addition unit, configurable byte replacement unit, row shift unit, column confusion unit and other units. If the SM4 algorithm is selected for encryption, then Figure 3 After 32 rounds of similarity transformations, the module finally outputs the ciphertext S. In this way, the ciphertext data of AES and SM4 can be obtained respectively.

[0105] In terms of module design advantages:

[0106] exist Figure 3 In the algorithm implementation, the byte replacement module is the most frequently used and resource-intensive circuit module in the entire algorithm design. It is particularly the core module for key expansion and round robin, and is also a reusable unit module for both the AES and SM4 algorithms. In particular, implementing a configurable byte replacement module in the composite domain, instead of a lookup table, significantly reduces area and power consumption. The integration of both AES and SM4 implementations makes the circuit more suitable for resource-constrained and demanding applications, resulting in lower overall area and power consumption for Bluetooth devices, making them more compact and flexible.

[0107] Figure 4 It is a configurable byte replacement module structure, directly in GF(2 8 ) domain, the algebraic solution is very complex and difficult to implement in hardware. Using composite domain decomposition technology, the operations on finite fields are converted to composite fields, which can greatly reduce the computational complexity.

[0108] 2.2 Anti-power attack design module

[0109] This mainly involves non-invasive attacks in side-channel attacks. Non-invasive attacks can recover the complete correct key from power consumption and electromagnetic leakage without destroying the internal circuits and timing of the chip. The principle of non-invasive attacks is to collect the power consumption leaked by the encryption device during encryption and decryption operations, and observe and analyze through statistical methods to crack the key. Common non-invasive attacks include power consumption attacks, time attacks, and electromagnetic attacks. In the side-channel attack example, the implementation of a non-invasive side-channel attack usually requires connecting a resistor of about 10 to 100 Ω in series to the chip power supply. Since the chip and the resistor are connected in series, their currents are consistent, so the potential difference across the resistor collected by an oscilloscope and a voltage probe can directly reflect the power consumption of the chip. Therefore, even an encryption algorithm that has been proven to be very secure in theory may appear very vulnerable to side-channel attacks and can be easily attacked to recover the complete key. Therefore, this patent adds MASK masking technology before data input to achieve resistance to power analysis attacks. Figure 5 A flowchart of the implementation is shown.

[0110] This module is used to resist power analysis attacks, mainly including random number masking unit and demasking unit. The masking unit is used to add a random mask MASK to the input data, and the demasking unit is used to remove the random mask MASK after the operation.

[0111] The working process of this module is:

[0112] For the input data, after the masking unit, a random number mask m1 is introduced to perform XOR masking on the data input to the AES / SM4 encryption algorithm, and the result is input into the AES / SM4 configurable byte replacement encryption algorithm module (i.e. Figure 3 The AES / SM4 configurable byte replacement encryption algorithm module outputs the ciphertext A and ciphertext S, which are then demasked and restored by the demasking unit. This ensures that the entire calculation process is masked, ensuring that the calculated value is different each time.

[0113] Similarly, for the initial key key_A, after passing through the masking unit, a random number mask m2 is introduced to perform XOR masking on the key, and the result is input into the configurable key expansion unit. After the encryption and decryption key expansion is completed, the masking and restoration operation is performed by the demasking unit, so that the entire calculation process is covered by the mask, ensuring that the value of each calculation is different. The AES process of masking the call key is the same as the AES encryption process, except that the 16 bytes are XOR masked and then the key is expanded. After the key is expanded, the mask is removed by XOR. Since the AES decryption process is the same as the AES encryption process, it will not be described. Similarly, for the SM4 encryption algorithm, the call key is also masked XORed, and the process is similar, so it will not be repeated.

[0114] 2.3 Signature Verification Unit

[0115] In addition, since SM2 also has the function of signature verification, a signature verification unit is designed. We can first match the user information with the generated legitimate user ID, identify it by sending the user ID information m, and use m as the signature. If the signature is inconsistent, it will be judged as an illegal user. The signature verification process is as follows Figure 7 shown.

[0116] Assume the device receives the signature value (r`, s`) and message m` sent by the app. The device also has the same elliptic curve system parameters, public key P, private key d, and received signature value (r`, s`) and m` as the app. Next, verify the message. The point (x2, y2) calculated from the received message should be the same as the point (x1, y1) obtained by multiplying point G by k on the app. The following is the theoretical derivation of this process:

[0117] It is not difficult to obtain from the signing process (k is a random number):

[0118] (1+d)s=(k-rd)modn (13)

[0119] From the signature verification process and equations (1) and (13), we can get the following equations and Figure 7 The process:

[0120]

[0121] We can see that when the message and signature are sent, the values ​​of (x,y) should be equal due to the public key P. So we need to verify:

[0122] Is Ar` in [1,n-1], where n represents the modulus?

[0123] Is Bs` in [1,n-1]?

[0124] C. Verify that the calculated R value is equal to the received r` value

[0125] If all the conditions are met, the device will send a message of "signature received, verification passed" to the user's APP. If not, it means that the APP is an illegal APP, and the APP will receive a message of "signature rejected, verification failed".

[0126] The above technical contents are all implemented at the hardware level, which facilitates modularization and integration, making the overall area and power consumption of the equipment lower, making it more suitable for occasions with limited resources and higher requirements.

[0127] Based on all the above modules, the encryption process of this application is as follows:

[0128] In step 1, when a user accesses a Bluetooth device, they send an access request to the User ID Creation Module, which verifies the user's legal ID information. If the user's ID information does not exist in the database, a legal user account is created for that user. This way, every user accessing the Bluetooth device has their own user ID and data storage area. Dual authentication, using the Legal User ID Creation Module and the signature verification unit in the hybrid encryption module, verifies the legitimacy of the user's ID and grants access to the data storage area associated with that ID.

[0129] Step 2: Before being transmitted, the data X accessed by the user must first be masked by the anti-power attack design module to obtain the masked access data X_MASK.

[0130] Step 3, after passing through the anti-power attack design module, the masked data X_MASK is sent to the hybrid encryption module. First, it is encrypted by the AES / SM4 configurable byte replacement encryption algorithm module. According to the selected encryption algorithm, the encrypted data X_MASK_AS ( Figure 3 Ciphertext A and ciphertext S shown).

[0131] Step 4: Then perform SM2 encryption on the key ex_keyA or ex_keyS obtained by the configurable key expansion unit of the AES / SM4 configurable byte replacement encryption algorithm module to obtain the encrypted key key_AS_2, and randomly add the key to the encrypted data X_MASK_AS to integrate it into a complete encrypted data and send it out.

[0132] The data decryption process is as follows:

[0133] Step 1: After receiving the encrypted data, the user uses the key tracking unit of the hybrid encryption module to obtain the encrypted session key key_AS_2 and the encrypted data X_MASK_AS;

[0134] Step 2: After decrypting the encrypted call key using the key decryption unit, the encrypted data is sent to the hybrid algorithm module for decryption to obtain the masked data X_MASK;

[0135] Step 3: After demasking by the anti-power attack design module, the data X accessed by the user is restored.

[0136] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A Bluetooth device data encryption structure, characterized in that: Includes a hybrid encryption module, which: The hybrid encryption module includes an AES / SM4 configurable byte replacement encryption algorithm module, which includes selectors 1 to 7, round key addition units 1 and 2, a configurable key expansion unit, a configurable byte replacement unit, a distributor, a row shift unit, a column obfuscation unit, a linear transformation unit, and a reverse transformation unit, wherein: The initial key key enters selector 1 and is divided into key_A and key_B with the same value. After key_A enters the configurable key expansion unit for key expansion processing, if the algorithm is AES, it outputs ex_keyA. If the algorithm is SM4, it outputs ex_keyS to selector 2. Selector 2 uses ex_keyA in the round key addition unit 1 in the AES round transformation. Selector 2 enters ex_keyS and key_B from selector 1 into selector 3. If the algorithm is SM4, selector 3 outputs ex_keyS to the round key addition unit 2. If the algorithm is AES, it outputs key_B to the round key addition unit 2. For the AES algorithm, the data X accessed by the user directly enters the selector 4, while for the SM4 algorithm, the data is divided into a 4×4 plaintext data matrix X i 、X i+1 、X i+2 、X i+3 , for the high three digits of the matrix X i+1 、X i+2 、X i+3 The data obtained after XOR processing enters the selector 4; according to whether the algorithm is AES or SM4, the round key addition processing of the corresponding algorithm is performed in the round key addition unit 2, and the round key addition result X_A of AES or the round key addition result X_S of SM4 is obtained at the selector 5; X_A enters the selector 6 as the input data of the first round iteration of the AES algorithm and serves as the output of the first round. Then, the selector 6 outputs the round key addition result A_lun output by the round key addition unit 1 as the output to the configurable byte replacement unit, and the data X_S also enters the unit together. After the byte replacement processing of the configurable byte replacement unit, according to the algorithm A ES or SM4, obtaining X_byteA or X_byteS; the distributor distributes the AES or SM4 algorithm according to the algorithm, inputs the previously output X_byteA into the row shift unit for shift transformation processing, and then outputs the processing result to the column obfuscation unit; the output of the column obfuscation unit will enter the selector 7, where the data input into the round key addition unit 1 in the last round is the data directly output by the row shift unit, and the data output by the column obfuscation unit at other times; the output of the round key addition unit 1 will re-enter the selector 6 until the final AES encrypted ciphertext A is obtained after the round key addition unit 1 is operated in the last round of the AES algorithm; The distributor distributes the obtained data X_byteS into the linear transformation unit, and the result obtained after the cyclic shift processing is combined with the lower one data matrix X i The XOR processing is performed, and the result obtained is used as the output of the first round of the SM4 algorithm. The output of the first round of the cycle is used as the input of the second round of the cycle, and then divided into a new 4×4 plaintext data matrix for iterative cycle. After reaching the number of cycle iterations, the result obtained by the XOR processing of the last round of data is reversed through the reverse transformation unit to obtain the final ciphertext S.

2. The Bluetooth device data encryption structure according to claim 1, characterized in that: For the key key_A, the configurable key expansion unit iterates 10 rounds of the following formula 2 for the AES algorithm to obtain the expanded key ex_keyA, and iterates 32 rounds of the following formula 3 for the SM4 algorithm to obtain the expanded key ex_keyS: In Formula 2, K0, K1, K2, and K3 represent the AES keys, and the superscript j represents the number of iterations. In Formula 3, the subscript i represents the number of iterations, and K i , K i+1 , K i+2 , K i+3 Indicates the SM4 key, rk i represents the key obtained in the i-th iteration, where i=0 in the first iteration; SBOX() represents the configurable byte replacement unit, which completes the replacement between bytes; Shift() represents the word loop operation, which shifts the last word of the input data left by one byte; Rcon(j) represents the round constant of each round of the AES algorithm, CK i It is a fixed constant in each round of the SM4 algorithm, and <<< indicates a circular left shift.

3. The Bluetooth device data encryption structure according to claim 1, characterized in that: In the configurable byte replacement unit, the expressions for performing byte replacement on the AES algorithm and the SM4 algorithm are as shown in Formula 4 and Formula 5: Z=M(δ -1 (δX) -1 )+V (4) Y=A(T -1 (T(AX+C)) -1 )+C (5) Among them, X represents the data input to the unit, Z represents the result of AES byte replacement, and Y represents the result of SM4 byte replacement; the matrix M represents the S-box affine operation matrix of the AES algorithm, and the constant in the transformation process is represented by V; the affine matrix and constant of the S-box of the SM4 algorithm are represented by A and C respectively; δ and T are the isomorphic mapping matrices of AES and SM4 respectively, δ -1 and T -1 They are the isomorphic mapping inverse matrices of AES and SM4 respectively; The data entering this unit first selects the AES / SM4 algorithm, executes the corresponding affine operation and isomorphic mapping operation, and then performs inverse transformation on the result. Finally, inverse isomorphic mapping and inverse affine operation are performed to obtain the final output of the unit.

4. The Bluetooth device data encryption structure according to claim 1, characterized in that: The row shift unit is used to cyclically shift the state matrix obtained after byte replacement; during the encryption process, except for the first row of data remaining unchanged, the number of rows of each matrix is ​​increased by one, and the data of that row is cyclically shifted to the left by one more byte; The decryption process is a circular right shift operation, which is exactly the opposite of the encryption process.

5. The Bluetooth device data encryption structure according to claim 1, characterized in that: The column confusion unit is used to perform column transformation processing on the data matrix input into the unit, and multiply the data matrix by a matrix with a fixed parameter on the left; The round key adding unit is used to perform a bitwise exclusive OR operation on the grouped data and the key.

6. The Bluetooth device data encryption structure according to claim 1, characterized in that: The Bluetooth device data encryption structure also includes: A legitimate user ID creation module includes a user connection request unit, a Bluetooth device ID query unit, a user ID creation unit, and a user data storage unit; When a user sends an access request to access a Bluetooth device, the user connection request unit first marks the user; the Bluetooth device query ID unit first searches the user ID database in the local memory to see if there is a corresponding user ID locally. If not, it indicates that the user is accessing the Bluetooth device for the first time, and the user ID creation unit needs to create the user ID. After the creation, the user is a legitimate user, and a user data storage area corresponding to the user ID is established in the user data storage area unit. The legitimate user can access the user data information in the user data storage area after the signature verification is passed, thereby completing the user ID creation process; the ID of each legitimate user is related to the public key of the elliptic curve ECC algorithm. By taking different points G on the elliptic curve to generate different public keys P, and using a hash function to perform hash operations on different public keys, different user IDs can be obtained.

7. The Bluetooth device data encryption structure according to claim 1, characterized in that: The hybrid encryption module also includes: an anti-power consumption attack design module; The anti-power attack design module is used to introduce a random mask m1 to perform XOR masking on the data before it enters the AES / SM4 configurable byte replacement encryption algorithm module. The encryption result output by the AES / SM4 configurable byte replacement encryption algorithm module is then demasked and restored. It is also used to perform XOR masking on the initial key key_A using the random mask m2, and the result is input into the configurable key expansion unit, and the masking and restoration operation is performed after the encryption and decryption key expansion is completed.

8. The Bluetooth device data encryption structure according to claim 1, characterized in that: The hybrid encryption module further includes: a key encryption unit, a key tracking unit, a key decryption unit, and a signature verification unit, wherein: The key encryption unit uses the SM2 algorithm to encrypt the key ex_keyA or ex_keyS expanded by the configurable key expansion unit and randomly appends the processed session key data key_AS_2 to the user's encrypted data X_MASK_AS. Only by matching the correct user ID can the user's encrypted session key information be correctly accessed. The key tracking unit then finds the session key data key_AS_2 in the encrypted plaintext data segment and inputs it into the key decryption unit, where it uses the SM2 private key data stored on the Bluetooth device to correctly decrypt the session key key_AS. This session key is then used to decrypt the encrypted data X_MASK_AS entering the decryption unit to obtain the final transmission information. The signature verification unit is used to implement signature verification.

9. A Bluetooth device data encryption method based on the Bluetooth device data encryption structure according to any one of claims 1 to 8, characterized in that: include: Step 1: When a user accesses a Bluetooth device, the user's legal ID information is verified based on the access request data sent by the user. If the user's ID information does not exist, the user is created as a legal user and the signature verification is performed for identity authentication; Step 2: The user access data X must first be masked by the anti-power attack design module before transmission to obtain the masked access data X_MASK; Step 3: Send the masked access data X_MASK to the hybrid encryption module. It is first encrypted by the AES / SM4 configurable byte replacement encryption algorithm module. Based on the selected encryption algorithm, the encrypted data X_MASK_AS can be obtained. Step 4: Perform SM2 encryption on the key ex_keyA or ex_keyS obtained by the configurable key expansion unit of the AES / SM4 configurable byte replacement encryption algorithm module to obtain the call key data key_AS_2, and randomly add the key to the encrypted data X_MASK_AS to integrate it into a complete encrypted data and send it out.

10. A method for decrypting Bluetooth device data based on the Bluetooth device data encryption structure according to any one of claims 1 to 8, characterized in that: include: Step 1: After receiving the encrypted data, the user uses the key tracking unit of the hybrid encryption module to obtain the call key data key_AS_2 and the encrypted data X_MASK_AS; Step 2: After decrypting the encrypted session key using the key decryption unit, the encrypted data is sent to the hybrid encryption module for decryption to obtain the masked access data X_MASK; Step 3: After demasking by the anti-power attack design module, the data X accessed by the user is restored.

Images