Data encryption method, device and equipment using cryptographic instruction processor

Abstract

The present invention discloses a data encryption method using a cryptographic instruction processor, comprising: parsing a received data encryption request to obtain the data to be encrypted and the target encryption algorithm; searching for a target domain-specific language algorithm program corresponding to the target encryption algorithm from an algorithm program set; mapping the target domain-specific language algorithm program to a cryptographic instruction assembler using a preset mapping tool; translating the cryptographic instruction assembler into a binary program file using a cryptographic instruction set assembler; and performing encryption operations on the data to be encrypted based on the binary program file using a cryptographic instruction processor. The application of the data encryption method using a cryptographic instruction processor provided by the present invention reduces the time required for algorithm development, reduces the design difficulty of mapping tools, and improves the performance of generated programs. The present invention also discloses a device, equipment, and storage medium having corresponding technical effects.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data encryption method, device, equipment and computer-readable storage medium using a cryptographic instruction processor. Background Art

[0002] With the continuous advancement of information technology, data security has become a growing concern. Cryptographic algorithms are an effective means of addressing privacy threats and are widely used in various scenarios, such as encrypted storage and network data transmission. To balance the flexibility of general-purpose processors with the high performance of application-specific integrated circuits (ASICs), researchers have designed a variety of cryptographic instruction processors.

[0003] To implement data encryption using cryptographic instruction processors, existing technologies have developed simulators and assemblers for cryptographic instruction sets. These accelerate the implementation of cryptographic algorithms using cryptographic instruction processors and facilitate debugging of cryptographic instruction assembly programs on general-purpose processors. However, since cryptographic instruction processors still use assembly language for programming, program development is time-consuming for developers. The computational granularity of general-purpose high-level languages ​​is small, while that of cryptographic instruction processors is large, and the data types do not match. This makes compiling general-purpose high-level languages ​​into cryptographic instruction processors difficult and results in low program performance.

[0004] In summary, how to effectively solve the existing data encryption method using cryptographic dedicated instruction processors, the difficulty of compiling general high-level languages ​​into cryptographic dedicated instruction processors, and the low performance of the generated programs are issues that technical personnel in this field urgently need to solve. Summary of the Invention

[0005] The purpose of the present invention is to provide a data encryption method using a cryptographic dedicated instruction processor, which reduces the time required for algorithm development, reduces the design difficulty of mapping tools, and improves the performance of generated programs; another purpose of the present invention is to provide a data encryption device, equipment and computer-readable storage medium using a cryptographic dedicated instruction processor.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] A data encryption method using a cryptographic instruction processor, comprising:

[0008] Parse the received data encryption request to obtain the data to be encrypted and the target encryption algorithm;

[0009] Searching for a target domain-specific language algorithm program corresponding to the target encryption algorithm from an algorithm program set; wherein the algorithm program set contains a correspondence between each encryption algorithm and each domain-specific language algorithm program;

[0010] Mapping the target domain-specific language algorithm program into a cryptographic-specific instruction assembly program using a preset mapping tool;

[0011] translating the cryptographic-specific instruction set assembler into a binary program file;

[0012] The cryptographic instruction processor is used to perform an encryption operation on the data to be encrypted based on the binary program file.

[0013] In a specific embodiment of the present invention, mapping the target domain-specific language algorithm program into a cryptographic-specific instruction assembly program using a preset mapping tool includes:

[0014] Scanning the target domain-specific language algorithm program using a lexical analyzer to obtain a target word stream;

[0015] Using a syntax analyzer to build an abstract syntax tree for the target word stream according to the grammatical rules of the domain-specific language to obtain a target abstract syntax tree;

[0016] Traversing the target abstract syntax tree to obtain a source operand bit width and a destination operand bit width;

[0017] Determine the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width;

[0018] Converting each of the operators into a corresponding number of cryptographic-specific instructions according to the bit width corresponding to each of the operators;

[0019] The cryptographic-specific instructions are scheduled in combination with the architecture of the cryptographic-specific instruction processor, and the operands in each cryptographic-specific instruction are allocated to registers to obtain the cryptographic-specific instruction assembly program.

[0020] In a specific embodiment of the present invention, it also includes:

[0021] The target abstract syntax tree is traversed to perform syntax rule checking.

[0022] In a specific embodiment of the present invention, traversing the target abstract syntax tree to perform syntax rule checking includes:

[0023] The target abstract syntax tree is traversed to check whether there is a duplicately defined variable name.

[0024] In a specific embodiment of the present invention, after traversing the target abstract syntax tree to obtain the source operand bit width and the destination operand bit width, and before determining the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width, the method further includes:

[0025] Determine whether the source operand bit width and the destination operand bit width are correct;

[0026] If yes, then executing the step of determining the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width;

[0027] If not, a prompt message for modifying the algorithm program is outputted. When it is detected that the modification of the target domain-specific language algorithm program is completed, the step of scanning the target domain-specific language algorithm program with a lexical analyzer to obtain a target word stream is repeated.

[0028] A data encryption device using a cryptographic instruction processor, comprising:

[0029] The request parsing module is used to parse the received data encryption request to obtain the data to be encrypted and the target encryption algorithm;

[0030] A program search module, configured to search an algorithm program set for a target domain-specific language algorithm program corresponding to the target encryption algorithm; wherein the algorithm program set contains a correspondence between each encryption algorithm and each domain-specific language algorithm program;

[0031] A program mapping module, configured to map the target domain-specific language algorithm program into a cryptographic-specific instruction assembly program using a preset mapping tool;

[0032] A program translation module, configured to translate the cryptographic instruction assembly program into a binary program file using a cryptographic instruction set assembler;

[0033] The data encryption module is used to perform encryption operation on the data to be encrypted based on the binary program file by using a cryptographic instruction processor.

[0034] In a specific embodiment of the present invention, the program mapping module includes:

[0035] A word stream acquisition submodule is used to use a lexical analyzer to scan the target domain-specific language algorithm program to obtain a target word stream;

[0036] A syntax tree building submodule is used to build an abstract syntax tree for the target word stream according to the domain-specific language syntax rules using a syntax analyzer to obtain a target abstract syntax tree;

[0037] An operand bit width obtaining submodule, configured to traverse the target abstract syntax tree to obtain a source operand bit width and a destination operand bit width;

[0038] An operator bit width determination submodule, configured to determine the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width;

[0039] An instruction acquisition submodule, configured to convert each of the operators into a corresponding number of cryptographic-specific instructions according to the bit width corresponding to each of the operators;

[0040] The cryptographic instruction assembler obtaining submodule is used to schedule each cryptographic instruction in combination with the architecture of the cryptographic instruction processor and to perform register allocation on the operands in each cryptographic instruction to obtain the cryptographic instruction assembler.

[0041] In a specific embodiment of the present invention, it also includes:

[0042] The grammar rule checking module is used to traverse the target abstract syntax tree to perform grammar rule checking.

[0043] A data encryption device using a cryptographic instruction processor, comprising:

[0044] memory for storing computer programs;

[0045] The processor is used to implement the steps of the data encryption method using a cryptographic instruction processor as described above when executing the computer program.

[0046] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the data encryption method using a cryptographic-specific instruction processor as described above.

[0047] The data encryption method using a cryptographic-specific instruction processor provided by the present invention parses a received data encryption request to obtain data to be encrypted and a target encryption algorithm; searches for a target domain-specific language algorithm program corresponding to the target encryption algorithm from an algorithm program set; wherein the algorithm program set contains a correspondence between each encryption algorithm and each domain-specific language algorithm program; uses a preset mapping tool to map the target domain-specific language algorithm program to a cryptographic-specific instruction assembler; uses a cryptographic-specific instruction set assembler to translate the cryptographic-specific instruction assembler into a binary program file; and uses a cryptographic-specific instruction processor to perform encryption operations on the data to be encrypted based on the binary program file.

[0048] As can be seen from the above technical solution, by pre-establishing an algorithm program set containing the correspondence between each encryption algorithm and each domain-specific language algorithm program, a time-saving, high-performance program mapping method based on the domain-specific language is provided for the cryptographic instruction processor. A preset mapping tool is used to map the target domain-specific language algorithm program into a cryptographic instruction assembly program. The cryptographic instruction set assembler then translates the cryptographic instruction assembly program into a binary program file, and encryption operations are performed on the encrypted data based on the binary program file. Compared to assembly language programming, this method does not require understanding complex instruction formats. Instead, it only requires describing the operational relationships between data in the domain-specific language, and the mapping tool converts the domain-specific language into assembly instructions, reducing the time required for algorithm development. Compared to the method of directly compiling a general programming language into a cryptographic instruction processor, the domain-specific language provides common data types and coarse-grained operators in cryptographic algorithms. This eliminates the need for tree overwriting and operator merging when traversing the abstract syntax tree, thereby reducing the design difficulty of the mapping tool and improving the performance of the generated program.

[0049] Correspondingly, the present invention also provides a data encryption device, equipment and computer-readable storage medium using a cryptographic instruction processor corresponding to the above-mentioned data encryption method using a cryptographic instruction processor, which has the above-mentioned technical effects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0051] Figure 1 This is a flowchart of an implementation of a data encryption method using a cryptographic instruction processor in an embodiment of the present invention;

[0052] Figure 2 Another implementation flow chart of a data encryption method using a cryptographic instruction processor according to an embodiment of the present invention;

[0053] Figure 3 This is a structural block diagram of a data encryption device using a cryptographic instruction processor according to an embodiment of the present invention;

[0054] Figure 4 This is a structural block diagram of a data encryption device using a cryptographic instruction processor according to an embodiment of the present invention;

[0055] Figure 5This is a schematic diagram of the specific structure of a data encryption device using a cryptographic instruction processor provided by this embodiment. DETAILED DESCRIPTION

[0056] In order to enable those skilled in the art to better understand the present invention, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0057] See also Figure 1 , Figure 1 This is a flowchart of an implementation of a data encryption method using a cryptographic instruction processor in an embodiment of the present invention. The method may include the following steps:

[0058] S101: Parse the received data encryption request to obtain the data to be encrypted and the target encryption algorithm.

[0059] When data encryption is required using a cryptographic instruction processor, a data encryption request is sent to the data encryption management center. The data encryption request contains the data to be encrypted and the target encryption algorithm. The data to be encrypted and the target encryption algorithm are obtained by parsing the received data encryption request.

[0060] The target encryption algorithms may include block cipher algorithms, stream cipher algorithms, hash cipher algorithms and public key cipher algorithms, etc.

[0061] S102: Searching for a target domain-specific language algorithm program corresponding to a target encryption algorithm from an algorithm program set.

[0062] Among them, the algorithm program set contains the correspondence between each encryption algorithm and the algorithm program of the special language of each field.

[0063] Pre-program the domain-specific language algorithm program for each encryption algorithm using a domain-specific language, including dedicated identifiers, bit-level data types, and coarse-grained operators. This creates an algorithm program set that contains the corresponding relationships between each encryption algorithm and each domain-specific language algorithm program. After parsing the data to be encrypted and the target encryption algorithm, the target domain-specific language algorithm program corresponding to the target encryption algorithm is searched for in the algorithm program set.

[0064] S103: Mapping the target domain-specific language algorithm program into a cryptography-specific instruction assembly program using a preset mapping tool.

[0065] After finding the target domain-specific language algorithm program corresponding to the target encryption algorithm from the algorithm program collection, a preset mapping tool is used to map the target domain-specific language algorithm program into a cryptographic-specific instruction assembly program. Because the computational granularity of both the target domain-specific language algorithm program and the cryptographic-specific instruction assembly program is relatively large, compared to assembly language programming, embodiments of the present invention do not require understanding complex instruction formats. Instead, they only need to describe the computational relationships between data in the domain-specific language. The mapping tool then converts the domain-specific language into assembly instructions, reducing the time required for algorithm development.

[0066] S104: Utilizing a cryptographic-specific instruction set assembler, the cryptographic-specific instruction assembly program is translated into a binary program file.

[0067] After the target domain-specific language algorithm program is mapped into a cryptographic-specific instruction assembler using a preset mapping tool, the cryptographic-specific instruction set assembler is used to translate the cryptographic-specific instruction assembler into a binary program file that can be executed on a cryptographic-specific instruction processor.

[0068] S105: Using a cryptographic instruction processor to perform encryption operations on the data to be encrypted based on the binary program file.

[0069] After translating the cryptographic instruction assembly program into a binary program file using a cryptographic instruction set assembler, the cryptographic instruction processor is used to perform encryption operations on the encrypted data based on the binary program file, thereby realizing the encryption of the encrypted data using the cryptographic instruction processor. Compared with the programming method of assembly language, the present invention does not require understanding of complex instruction formats. It only needs to use a domain-specific language to describe the operational relationship between data, and the domain-specific language is converted into assembly instructions by a mapping tool, which reduces the time required for algorithm development. Compared with the method of directly compiling a general programming language into a cryptographic instruction processor, the domain-specific language provides common data types and coarse-grained operators in cryptographic algorithms. When traversing the abstract syntax tree, there is no need to perform tree coverage and operator merging, thereby reducing the design difficulty of the mapping tool and improving the performance of the generated program.

[0070] As can be seen from the above technical solution, by pre-establishing an algorithm program set containing the correspondence between each encryption algorithm and each domain-specific language algorithm program, a time-saving, high-performance program mapping method based on the domain-specific language is provided for the cryptographic instruction processor. A preset mapping tool is used to map the target domain-specific language algorithm program into a cryptographic instruction assembly program. The cryptographic instruction set assembler then translates the cryptographic instruction assembly program into a binary program file, and encryption operations are performed on the encrypted data based on the binary program file. Compared to assembly language programming, this method does not require understanding complex instruction formats. Instead, it only requires describing the operational relationships between data in the domain-specific language, and the mapping tool converts the domain-specific language into assembly instructions, reducing the time required for algorithm development. Compared to the method of directly compiling a general programming language into a cryptographic instruction processor, the domain-specific language provides common data types and coarse-grained operators in cryptographic algorithms. This eliminates the need for tree overwriting and operator merging when traversing the abstract syntax tree, thereby reducing the design difficulty of the mapping tool and improving the performance of the generated program.

[0071] It should be noted that, based on the above embodiment, the embodiment of the present invention also provides corresponding improved solutions. In subsequent embodiments, the same steps or corresponding steps as those in the above embodiment can be referenced to each other, and the corresponding beneficial effects can also be referenced to each other, and will not be described in detail in the following improved embodiments.

[0072] See also Figure 2 , Figure 2 This is another implementation flow chart of a data encryption method using a cryptographic instruction processor in an embodiment of the present invention. The method may include the following steps:

[0073] S201: Parse the received data encryption request to obtain the data to be encrypted and the target encryption algorithm.

[0074] S202: Searching for a target domain-specific language algorithm program corresponding to a target encryption algorithm from an algorithm program set.

[0075] Among them, the algorithm program set contains the correspondence between each encryption algorithm and the algorithm program of the special language of each field.

[0076] Taking the E-box extension permutation operation of the DES algorithm as an example, the target domain-specific language algorithm program found is:

[0077] / def

[0078] PermTable E = {32, 1, 2, 3, 4, 5, 4, 5, 6, 7, 8, 9, 8, 9, 10, 11, 12, 13, 12, 13, 14, 15, 16, 17, 16, 17, 18, 19, 20, 21, 20, 21, 22, 23, 24, 25, 24, 25, 26, 27, 28, 29, 28, 29, 30, 31, 32, 1}; / / PermTable is a permutation table configuration identifier used to configure the permutation table for the E-box extended permutation operation;

[0079] \def

[0080] / main

[0081] bit 32 dataIn = 0x00000000; / / bit 32 indicates that the bit width of the input data dataIn is 32 bits, 0x indicates that the input data is described in hexadecimal, and the input data is expressed in hexadecimal as 00000000;

[0082] bit 48 dataOut; / / bit 48 indicates that the bit width of the output data dataOut is 48 bits;

[0083] dataOut = permute(dataIn, E); / / permute represents the permutation operator, dataIn is the data involved in the operation, E is the permutation table, and dataOut is the output result;

[0084] \main

[0085] S203: Using a lexical analyzer to scan the target domain-specific language algorithm program to obtain a target word stream.

[0086] After searching for the target domain-specific language algorithm program corresponding to the target encryption algorithm from the algorithm program set, the target domain-specific language algorithm program is scanned using a lexical analyzer, and the target domain-specific language algorithm program is scanned character by character from left to right to generate word symbols one by one. The target domain-specific language algorithm program as a character string is transformed into an intermediate program of a word symbol string to obtain a target word stream.

[0087] Following the example in step S202, a lexical analyzer is used to generate a word stream:

[0088] / def

[0089] PermTable

[0090] E

[0091] =

[0092] {

[0093] …

[0094] permute (

[0096] dataIn

[0097] E ) ;

[0100] \main

[0101] S204: Using a syntax analyzer to create an abstract syntax tree for the target word stream according to the domain-specific language syntax rules to obtain a target abstract syntax tree.

[0102] After using a lexical analyzer to scan the target domain-specific language algorithm program to obtain a target word stream, a syntax analyzer is used to establish an abstract syntax tree for the target word stream according to the domain-specific language grammar rules to obtain a target abstract syntax tree.

[0103] S205: Traverse the target abstract syntax tree to obtain the source operand bit width and the destination operand bit width.

[0104] After the target abstract syntax tree is established, the target abstract syntax tree is traversed to obtain the source operand bit width and the destination operand bit width.

[0105] S206: Determine whether the source operand bit width and the destination operand bit width are correct. If not, execute step S207; if so, execute step S208.

[0106] After traversing the target abstract syntax tree to obtain the source operand bit width and the destination operand bit width, determine whether the source operand bit width and the destination operand bit width are correct. If not, it indicates that an error occurred in the target abstract syntax tree construction process, and step S207 is executed. If so, it indicates that the target abstract syntax tree is well constructed, and step S208 is executed.

[0107] S207: Outputting prompt information for modifying the algorithm program. When it is detected that the modification of the target domain-specific language algorithm program is completed, the process returns to step S203.

[0108] When it is determined that the source operand bit width and the destination operand bit width are incorrect, it indicates that an error has occurred in the target domain-specific language algorithm program, and a prompt message for modifying the algorithm program is output. The operation and maintenance personnel modify the target domain-specific language algorithm program. When it is detected that the modification of the target domain-specific language algorithm program is completed, the operation returns to step S203, that is, the modified target domain-specific language algorithm program is scanned by the lexical analyzer to obtain a newly generated target word stream, the abstract syntax tree is re-established, and the target abstract syntax tree is traversed to obtain a new source operand bit width and destination operand bit width.

[0109] S208: Determine the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width.

[0110] When it is determined that the source operand bit width and the destination operand bit width are correct, it means that the target abstract syntax tree is well constructed, and the bit width corresponding to each operator in the target abstract syntax tree is determined according to the source operand bit width and the destination operand bit width.

[0111] S209: Convert each operator into a corresponding number of cryptographic-specific instructions according to the bit width corresponding to each operator.

[0112] After determining the bit width corresponding to each operator in the target abstract syntax tree, each operator is converted into a corresponding number of cryptographic-specific instructions according to the bit width corresponding to each operator.

[0113] For example, the permutation table E is suitable for 32-bit to 48-bit permutation, so the 64-bit permutation table configuration instruction CfgPermTable64 bank, page, addr, #imme32, #imme32 is selected, and 4 such instructions are required for configuration.

[0114] For example, the bit width of the source operand dataIn is 32 bits, so the li rd, #imme32 instruction is selected, and 1 such instruction is required.

[0115] S210: Schedule each cryptographic instruction in combination with the architecture of the cryptographic instruction processor, and allocate registers to operands in each cryptographic instruction to obtain a cryptographic instruction assembly program.

[0116] After converting each operator into a corresponding number of cryptographic-specific instructions, the instructions are scheduled based on the architecture of the cryptographic-specific instruction processor, and registers are allocated for each operand within the instruction, resulting in a cryptographic-specific instruction assembly program. Compared to assembly language programming, this approach eliminates the need for instruction scheduling and register allocation. Instead, the computational relationships between data are described using a domain-specific language. A mapping tool then converts the domain-specific language into assembly instructions, performs instruction scheduling, and allocates registers, reducing the time required for algorithm development.

[0117] The cryptography-specific instruction processor uses a four-way parallel very long instruction word architecture with four instruction slots. The CfgPermTable64, li, and Perm64 instructions occupy two, one, and two instruction slots, respectively. Based on data dependencies, the scheduling scheme shown in Table 1 is derived.

[0118] Table 1

[0119]

[0120] Perform register allocation on the operands in the instruction and obtain the register allocation scheme shown in Table 2.

[0121] Table 2

[0122]

[0123] S211: translating the cryptographic instruction set assembler into a binary program file.

[0124] The cryptographic instruction set simulator can be used on a general-purpose processor to simulate the running results of the cryptographic instruction assembly program. If the running is successful, the cryptographic instruction set assembler is used to translate the assembly program into a binary program file that can be executed on the cryptographic instruction processor.

[0125] S212: Perform encryption operations on the data to be encrypted based on the binary program file using a cryptographic instruction processor.

[0126] In a specific embodiment of the present invention, the method may further comprise the following steps:

[0127] Traverse the target abstract syntax tree to check the syntax rules.

[0128] After establishing the target abstract syntax tree, the target abstract syntax tree is traversed to perform a syntax rule check to detect possible syntax errors. The compiler's syntax analyzer takes word symbols as input and analyzes whether the word symbol string forms a grammatical unit that conforms to the syntax rules, such as expressions, assignments, loops, etc. Finally, it checks whether it constitutes a program that meets the requirements. According to the syntax rules used by the language, each statement is analyzed to check whether it has the correct logical structure. For example, check whether variable names are defined repeatedly; check whether the assignment of data with different bit widths is correct; based on the contents of the substitution table, supplement relevant information: Substitution table E has a total of 48 data, with a maximum value of 32, indicating that the substitution table is suitable for 32-bit to 48-bit substitution operations; check whether the data bit width involved in the operation is correct: the source operand dataIn is 32-bit data, and the destination operand dataOut is 48-bit data. Substitution table E is suitable for 32-bit to 48-bit substitution operations, so the data bit width involved in the operation is correct.

[0129] In a specific embodiment of the present invention, traversing the target abstract syntax tree to perform syntax rule checking includes:

[0130] Traverse the target abstract syntax tree to check whether there are any duplicate variable names.

[0131] When traversing the target abstract syntax tree to perform syntax rule checking, the target abstract syntax tree is traversed to check whether there are any duplicate variable names. If duplicate variable names are found, the duplicate variable names are modified.

[0132] When using a domain-specific language to write the algorithm program for each encryption algorithm, Backus–Naur Form (BNF) can be used to describe the abstract syntax of the cryptographic domain-specific language. As shown below, the program consists of three parts: declaration, body, and comments.

[0133]

[0134]

[0135] The declaration section begins with / def and ends with \def. The declaration section describes algorithm-specific parameters. Examples include S-box parameters for S-box substitution, permutation table parameters for permutation, configuration parameters for nonlinear Boolean functions, and finite field parameters for finite field multiplication. Specific identifiers must be added before the corresponding parameters to facilitate processing by mapping tools. For example, SboxTable must be added before S-box parameters, and PermTable must be added before permutation table parameters. These parameters must be preconfigured in specific registers in cryptographic instruction processors to accelerate the execution of cryptographic operations.

[0136] The main body begins with / main and ends with \main. It describes the general parameters and algorithm flow of the algorithm, including key generation, round operations, and different operating modes for block ciphers; feedback shift registers, feedback functions, clocked logic, and nonlinear filtering functions for stream ciphers; padding, expansion, and round operations for hash ciphers; and encryption / decryption and signing / verification for public key ciphers.

[0137] In addition to traditional scalar operators, vector operators commonly used in cryptographic algorithms have been added, such as the permutation operator (permute) and the substitution operator (substitute), as well as the point multiplication operator (pointmul) and the point addition operator (pointadd) on elliptic curves. See Table 3, which shows the operators in various domain-specific languages.

[0138] Table 3

[0139]

[0140]

[0141] The source program written in the domain-specific language needs to be mapped into an assembly program described by the cryptography-specific instruction set, ultimately generating a binary file that can be recognized by the cryptography-specific instruction processor before it can be executed on the target platform. The implementation process of program mapping includes the following steps:

[0142] a) Lexical Analysis

[0143] The lexical analysis phase reads the character stream from the source program, organizes the characters into words defined by a regular grammar, and provides these to the syntax analysis phase. The lexical rules of a domain-specific language include identifiers, keywords, numbers, operators, bit strings, and comments. Identifiers include specialized identifiers such as PermTable and SboxTable. Bit strings are a data type that facilitates describing cryptographic operations. Operators include not only basic operators such as addition, subtraction, multiplication, and division, but also vector operators commonly used in cryptographic operations, such as permute, substitute, modmul, and pointmul.

[0144] b) Syntax analysis

[0145] Syntax analysis builds an abstract syntax tree (ABST) based on the grammatical rules of the domain-specific language, using the words generated during the lexical analysis phase. A recursive descent parser is generated from these grammatical rules. A recursive descent parser is a collection of recursive methods. The recursive descent process essentially starts at the root node of the parse tree and parses toward the leaf nodes. The first rule called is the starting point for semantic symbolization. When parsing a rule with multiple options, the next word or words in the input are examined to make a decision.

[0146] c) Semantic Analysis

[0147] The syntax analysis phase creates a standardized abstract syntax tree for the source program based on grammatical rules. The semantic analysis phase traverses this abstract syntax tree, analyzing the parent nodes, child nodes, and sibling nodes of different nodes to check whether the syntax of the source program complies with the grammatical rules. This includes checking whether variable definitions are correct, whether both ends of equations conform to assignment specifications, and whether operations between bit strings of different bit widths overflow. Simultaneously, the relevant information of the parent node is filled in based on the information of the child nodes or sibling nodes, including determining the bit width of the operator based on the bit width of the source and destination operands.

[0148] d) Instruction Scheduling

[0149] The cryptography-specific instruction processor utilizes a very long instruction word (VLIW) architecture and employs a priority-based list scheduling strategy for instruction scheduling. The abstract syntax tree is simplified into a data flow graph, where nodes represent instructions and edges represent data dependencies between instructions. Based on the data flow graph, instructions are scheduled using ASAP and ALAP methods, respectively. The earliest and latest execution times are determined, and the difference between the two represents the instruction's mobility. The less mobile an instruction is, the higher its priority, and the more likely it is to be executed first.

[0150] e) Register allocation

[0151] The cryptography-specific instruction processor has multiple register files, each containing different register types. Register allocation begins by establishing a variable's "value-reference chain." The intersection of candidate register type sets at the value and reference points is calculated to determine the variable's register type. The register bank for the destination operand is determined based on the instruction slot where the instruction resides. If register type or register bank conflicts arise, move instructions are inserted to resolve them. Finally, a linear scan algorithm is used to complete register allocation for the variables in each register file.

[0152] Corresponding to the above method embodiment, the present invention also provides a data encryption device using a cryptographic dedicated instruction processor. The data encryption device using a cryptographic dedicated instruction processor described below and the data encryption method using a cryptographic dedicated instruction processor described above can be referenced to each other.

[0153] See also Figure 3 , Figure 3 This is a structural block diagram of a data encryption device using a cryptographic instruction processor according to an embodiment of the present invention. The device may include:

[0154] The request parsing module 31 is used to parse the received data encryption request to obtain the data to be encrypted and the target encryption algorithm;

[0155] A program search module 32 is configured to search for a target domain-specific language algorithm program corresponding to a target encryption algorithm from an algorithm program set; wherein the algorithm program set contains a correspondence between each encryption algorithm and each domain-specific language algorithm program;

[0156] A program mapping module 33 is used to map the target domain-specific language algorithm program into a cryptographic-specific instruction assembly program using a preset mapping tool;

[0157] A program translation module 34 is used to translate the cryptographic instruction assembly program into a binary program file using a cryptographic instruction set assembler;

[0158] The data encryption module 35 is used to perform encryption operations on the data to be encrypted based on the binary program file using a cryptographic instruction processor.

[0159] As can be seen from the above technical solution, by pre-establishing an algorithm program set containing the correspondence between each encryption algorithm and each domain-specific language algorithm program, a time-saving, high-performance program mapping method based on the domain-specific language is provided for the cryptographic instruction processor. A preset mapping tool is used to map the target domain-specific language algorithm program into a cryptographic instruction assembly program. The cryptographic instruction set assembler then translates the cryptographic instruction assembly program into a binary program file, and encryption operations are performed on the encrypted data based on the binary program file. Compared to assembly language programming, this method does not require understanding complex instruction formats. Instead, it only requires describing the operational relationships between data in the domain-specific language, and the mapping tool converts the domain-specific language into assembly instructions, reducing the time required for algorithm development. Compared to the method of directly compiling a general programming language into a cryptographic instruction processor, the domain-specific language provides common data types and coarse-grained operators in cryptographic algorithms. This eliminates the need for tree overwriting and operator merging when traversing the abstract syntax tree, thereby reducing the design difficulty of the mapping tool and improving the performance of the generated program.

[0160] In a specific embodiment of the present invention, the program mapping module 33 includes:

[0161] The word stream acquisition submodule is used to use a lexical analyzer to scan the target domain-specific language algorithm program to obtain the target word stream;

[0162] The syntax tree building submodule is used to build an abstract syntax tree for the target word stream according to the domain-specific language syntax rules using a syntax analyzer to obtain a target abstract syntax tree;

[0163] The operand bit width acquisition submodule is used to traverse the target abstract syntax tree to obtain the source operand bit width and the destination operand bit width;

[0164] An operator bit width determination submodule is used to determine the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width;

[0165] The instruction acquisition submodule is used to convert each operator into a corresponding number of cryptographic special instructions according to the bit width corresponding to each operator;

[0166] The cryptographic instruction assembler obtaining submodule is used to schedule each cryptographic instruction in combination with the architecture of the cryptographic instruction processor and to perform register allocation on the operands in each cryptographic instruction to obtain the cryptographic instruction assembler.

[0167] In a specific embodiment of the present invention, the device may further include:

[0168] The grammar rule checking module is used to traverse the target abstract syntax tree to perform grammar rule checking.

[0169] In a specific embodiment of the present invention, the grammar rule checking module is specifically a module that traverses the target abstract syntax tree to check whether there are any repeatedly defined variable names.

[0170] In a specific embodiment of the present invention, the device may further include:

[0171] a judgment module, configured to judge whether the source operand bit width and the destination operand bit width are correct after traversing the target abstract syntax tree to obtain the source operand bit width and the destination operand bit width, and before determining the bit widths corresponding to the respective operators in the target abstract syntax tree according to the source operand bit width and the destination operand bit width;

[0172] The operator bit width determination submodule specifically determines the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width when the source operand bit width and the destination operand bit width are determined to be correct;

[0173] The program modification module is used to output a prompt message for modifying the algorithm program when it is determined that the source operand bit width and the destination operand bit width are incorrect. When it is detected that the modification of the target domain-specific language algorithm program is completed, the step of using a lexical analyzer to scan the target domain-specific language algorithm program to obtain a target word stream is repeatedly executed.

[0174] Corresponding to the above method embodiment, see Figure 4 , Figure 4 This is a schematic diagram of a data encryption device using a cryptographic instruction processor provided by the present invention. The device may include:

[0175] Memory 332, for storing computer programs;

[0176] The processor 322 is configured to implement the steps of the data encryption method using a cryptographic instruction processor in the above method embodiment when executing a computer program.

[0177] For details, please refer to Figure 5 , Figure 5This embodiment provides a schematic diagram of the specific structure of a data encryption device utilizing a cryptographic instruction processor. This data encryption device utilizing a cryptographic instruction processor may vary significantly due to different configurations or performance. It may include a processor (central processing unit, CPU) 322 (e.g., one or more processors) and a memory 332. The memory 332 stores one or more computer applications 342 or data 344. The memory 332 may be either a temporary storage or a permanent storage. The program stored in the memory 332 may include one or more modules (not shown), each of which may include a series of instruction operations in the data processing device. Furthermore, the processor 322 may be configured to communicate with the memory 332, and the series of instruction operations in the memory 332 may be executed on the data encryption device 301 utilizing the cryptographic instruction processor.

[0178] The data encryption device 301 using a cryptographic instruction processor may further include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and / or one or more operating systems 341 .

[0179] The steps in the data encryption method using a cryptographic instruction processor described above can be implemented by the structure of a data encryption device using a cryptographic instruction processor.

[0180] Corresponding to the above method embodiment, the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the following steps can be implemented:

[0181] The received data encryption request is parsed to obtain the data to be encrypted and the target encryption algorithm; the target domain-specific language algorithm program corresponding to the target encryption algorithm is searched from the algorithm program set; wherein the algorithm program set contains the correspondence between each encryption algorithm and each domain-specific language algorithm program; the target domain-specific language algorithm program is mapped into a cryptographic-specific instruction assembly program using a preset mapping tool; the cryptographic-specific instruction set assembler is used to translate the cryptographic-specific instruction assembly program into a binary program file; and the cryptographic-specific instruction processor is used to perform encryption operations on the data to be encrypted based on the binary program file.

[0182] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program codes.

[0183] For an introduction to the computer-readable storage medium provided by the present invention, please refer to the above method embodiment, and the present invention will not elaborate on it here.

[0184] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. References to the same or similar parts between the various embodiments are sufficient. The devices, apparatuses, and computer-readable storage media disclosed in the embodiments are described briefly because they correspond to the methods disclosed in the embodiments. For relevant details, refer to the description of the methods.

[0185] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only intended to help understand the technical solutions and core concepts of the present invention. It should be noted that those skilled in the art can make various improvements and modifications to the present invention without departing from the principles of the present invention, and such improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A data encryption method using a cryptographic instruction processor, characterized in that: include: Parse the received data encryption request to obtain the data to be encrypted and the target encryption algorithm; Searching for a target domain-specific language algorithm program corresponding to the target encryption algorithm from an algorithm program set; wherein the algorithm program set contains a correspondence between each encryption algorithm and each domain-specific language algorithm program; Scanning the target domain-specific language algorithm program using a lexical analyzer to obtain a target word stream; Using a syntax analyzer to build an abstract syntax tree for the target word stream according to the grammatical rules of the domain-specific language to obtain a target abstract syntax tree; Traversing the target abstract syntax tree to obtain a source operand bit width and a destination operand bit width; Determine the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width; Converting each of the operators into a corresponding number of cryptographic-specific instructions according to the bit width corresponding to each of the operators; Scheduling each of the cryptographic-specific instructions in combination with the architecture of the cryptographic-specific instruction processor, and allocating registers for operands in each of the cryptographic-specific instructions, to obtain a cryptographic-specific instruction assembler; translating the cryptographic-specific instruction set assembler into a binary program file; The cryptographic instruction processor is used to perform an encryption operation on the data to be encrypted based on the binary program file.

2. The data encryption method using a cryptographic instruction processor according to claim 1, wherein: Also includes: The target abstract syntax tree is traversed to perform syntax rule checking.

3. The data encryption method using a cryptographic instruction processor according to claim 2, wherein: Traversing the target abstract syntax tree to perform syntax rule checking includes: The target abstract syntax tree is traversed to check whether there is a duplicately defined variable name.

4. The data encryption method using a cryptographic instruction processor according to any one of claims 1 to 3, characterized in that: After traversing the target abstract syntax tree to obtain a source operand bit width and a destination operand bit width, and before determining the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width, the method further includes: Determine whether the source operand bit width and the destination operand bit width are correct; If yes, then executing the step of determining the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width; If not, a prompt message for modifying the algorithm program is outputted. When it is detected that the modification of the target domain-specific language algorithm program is completed, the step of scanning the target domain-specific language algorithm program with a lexical analyzer to obtain a target word stream is repeated.

5. A data encryption device using a cryptographic instruction processor, characterized in that: include: The request parsing module is used to parse the received data encryption request to obtain the data to be encrypted and the target encryption algorithm; A program search module, configured to search an algorithm program set for a target domain-specific language algorithm program corresponding to the target encryption algorithm; wherein the algorithm program set contains a correspondence between each encryption algorithm and each domain-specific language algorithm program; A program mapping module, the program mapping module comprising: A word stream acquisition submodule is used to use a lexical analyzer to scan the target domain-specific language algorithm program to obtain a target word stream; A syntax tree building submodule is used to build an abstract syntax tree for the target word stream according to the domain-specific language syntax rules using a syntax analyzer to obtain a target abstract syntax tree; An operand bit width obtaining submodule, configured to traverse the target abstract syntax tree to obtain a source operand bit width and a destination operand bit width; An operator bit width determination submodule, configured to determine the bit width corresponding to each operator in the target abstract syntax tree according to the source operand bit width and the destination operand bit width; An instruction acquisition submodule, configured to convert each of the operators into a corresponding number of cryptographic-specific instructions according to the bit width corresponding to each of the operators; a cryptographic instruction assembler obtaining submodule, configured to schedule each cryptographic instruction in accordance with the architecture of the cryptographic instruction processor and to allocate registers to operands in each cryptographic instruction to obtain a cryptographic instruction assembler; A program translation module, configured to translate the cryptographic instruction assembly program into a binary program file using a cryptographic instruction set assembler; The data encryption module is used to perform encryption operation on the data to be encrypted based on the binary program file by using a cryptographic instruction processor.

6. The data encryption device using a cryptographic instruction processor according to claim 5, characterized in that: Also includes: The grammar rule checking module is used to traverse the target abstract syntax tree to perform grammar rule checking.

7. A data encryption device using a cryptographic instruction processor, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the data encryption method using a cryptographic instruction processor as claimed in any one of claims 1 to 4 when executing the computer program.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the data encryption method using a cryptographic instruction processor as claimed in any one of claims 1 to 4.

Images