A data encryption and decryption system, a data encryption method, and a data decryption method

Abstract

The application discloses a data encryption and decryption system, a data encryption method and a data decryption method. The system comprises a control module, an encryption module and a decryption module. The control module is used for obtaining data to be encrypted and data to be decrypted, and sending the data to be encrypted to the encryption module and the data to be decrypted to the decryption module. The encryption module is used for determining an encryption round, obtaining a first extraction key corresponding to the encryption round, and encrypting the received data to be encrypted according to the first extraction key to generate final encrypted data. The decryption module is used for determining a decryption round, obtaining a second extraction key corresponding to the decryption round, and decrypting the received data to be decrypted according to the second extraction key to generate final decrypted data. The encryption module receives the data to be encrypted sent by the control module, separately processes the tail round and the normal encryption round according to the encryption round, and the decryption module receives the data to be decrypted, separately processes the first round and the normal decryption round according to the decryption round, thereby saving the processing period and improving the processing efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data encryption and decryption, and particularly relates to a data encryption and decryption system, a data encryption method and a data decryption method. BACKGROUND

[0002] Data encryption is a reliable method for protecting data security of data nodes of an Internet of Things. Data is converted into ciphertext by an encryption algorithm and an encryption key, thereby playing a role in protecting data security. An Advanced Encryption Standard (AES) algorithm is a new generation of block symmetric cipher algorithm formulated by the National Institute of Standards and Technology of the United States in 2001.

[0003] In the prior art, the encryption and decryption process of AES adopts the same processing for each round, resulting in long consumption period and low processing efficiency. SUMMARY

[0004] The present application provides a data encryption and decryption system, a data encryption method and a data decryption method to reduce the time consumption of the encryption and decryption process of the AES algorithm.

[0005] According to an aspect of the present application, a data encryption and decryption system is provided, which comprises a control module, an encryption module, a decryption module and a key expansion module connected with the control module, and a storage module connected with the control module and the key expansion module.

[0006] The control module is configured to acquire encrypted data, decrypted data and a key, and send the encrypted data to the encryption module, the decrypted data to the decryption module and the key to the key expansion module.

[0007] The encryption module is configured to determine an encryption round and acquire a first extraction key corresponding to the encryption round, and encrypt the received encrypted data according to the first extraction key to generate final encrypted data, wherein the period of the last round in the encryption round is less than the period of a normal encryption round.

[0008] The decryption module is configured to determine a decryption round and acquire a second extraction key corresponding to the decryption round, and decrypt the received decrypted data according to the second extraction key to generate final decrypted data, wherein the period of the first round in the decryption round is less than the period of a normal decryption round.

[0009] The key expansion module is configured to expand the received key to generate a round key and determine an index value corresponding to the round key, and send the round key and the index value to the storage module.

[0010] The storage module is configured to receive and store the round key and the index value.

[0011] Optionally, the encryption module is further configured to send the encryption round to the control module; the control module is configured to generate a first extraction instruction according to the received encryption round, and send the first extraction instruction to the storage module; the storage module is configured to determine an index value matched with the received first extraction instruction, take a round key corresponding to the index value as a first extraction key, and send the first extraction key to the control module; the control module is configured to send the received first extraction key to the encryption module; and the encryption module is configured to encrypt the to-be-encrypted data according to the received first extraction key to generate final encrypted data.

[0012] Optionally, the decryption module is further configured to send the decryption round to the control module; the control module is configured to generate a second extraction instruction according to the received decryption round, and send the second extraction instruction to the storage module; the storage module is configured to determine an index value matched with the received second extraction instruction, take a round key corresponding to the index value as a second extraction key, and send the second extraction key to the control module; the control module is configured to send the received second extraction key to the decryption module; and the decryption module is configured to decrypt the to-be-decrypted data according to the received second extraction key to generate final decrypted data.

[0013] Optionally, the encryption module is configured to send the final encrypted data to the storage module; the decryption module is configured to send the final decrypted data to the storage module; and the storage module is configured to store the received final encrypted data and final decrypted data.

[0014] Optionally, the encryption module comprises a normal encryption processing unit and a tail processing unit; the normal encryption processing unit is configured to perform byte substitution, row shift, column mixing and round key addition on the to-be-encrypted data in a normal encryption round to generate initial encrypted data, and send the initial encrypted data to the tail processing unit, wherein the normal encryption round is a round other than a tail round in the encryption round; and the tail processing unit is configured to perform byte substitution, row shift and round key addition on the received initial encrypted data in the tail round to generate final encrypted data.

[0015] Optionally, the decryption module comprises a normal decryption processing unit and a head processing unit; the head processing unit is configured to perform inverse byte substitution, inverse row shift and round key addition on the to-be-decrypted data in a first round to generate initial decrypted data, and send the initial decrypted data to the normal decryption processing unit; and the normal decryption processing unit is configured to perform inverse byte substitution, inverse row shift, inverse column mixing and round key addition on the received initial decrypted data in a normal decryption round to generate final decrypted data, wherein the normal decryption round is a round other than the first round in the decryption round.

[0016] According to another aspect of the present application, a data encryption method is provided, which comprises:

[0017] The control module obtains the data to be encrypted and the key, and sends the data to be encrypted to the encryption module and the key to the key expansion module;

[0018] The key expansion module expands the received key to generate a round key, determines an index value corresponding to the round key, and sends the round key and the index value to the storage module;

[0019] The storage module receives and stores the round key and the index value;

[0020] The encryption module determines an encryption round, obtains a first extraction key corresponding to the encryption round, and encrypts the received data to be encrypted according to the first extraction key to generate final encrypted data, wherein a tail round period in the encryption round is less than a normal encryption round period.

[0021] Optionally, obtaining the first extraction key corresponding to the encryption round comprises: sending the encryption round to the control module by the encryption module; generating a first extraction instruction according to the received encryption round by the control module, and sending the first extraction instruction to the storage module; determining an index value matched with the received first extraction instruction by the storage module, taking a round key corresponding to the index value as the first extraction key, and sending the first extraction key to the control module; and sending the received first extraction key to the encryption module by the control module.

[0022] According to another aspect of the present application, a data decryption method is provided, which comprises:

[0023] The control module obtains the key, and sends the key to the key expansion module;

[0024] The key expansion module expands the received key to generate a round key, determines an index value corresponding to the round key, and sends the round key and the index value to the storage module;

[0025] The storage module receives and stores the round key and the index value;

[0026] The control module obtains the data to be decrypted, and sends the data to be decrypted to the decryption module;

[0027] The decryption module determines a decryption round, obtains a second extraction key corresponding to the decryption round, and decrypts the received data to be decrypted according to the second extraction key to generate final decrypted data, wherein a first round period in the decryption round is less than a normal decryption round period.

[0028] Optionally, the second extraction key corresponding to the decryption round is obtained, comprising: sending the decryption round to the control module by the decryption module; generating the second extraction instruction according to the received decryption round by the control module, and sending the second extraction instruction to the storage module; determining the index value matched with the received second extraction instruction by the storage module, taking the round key corresponding to the index value as the second extraction key, and sending the second extraction key to the control module; and sending the received second extraction key to the decryption module by the control module.

[0029] The technical scheme of the embodiment of the application receives the to-be-encrypted data sent by the control module through the encryption module, separately processes the tail round and the ordinary encryption round according to the encryption round, receives the to-be-decrypted data through the decryption module, and separately processes the first round and the ordinary decryption round according to the decryption round, thereby saving the processing period and improving the processing efficiency.

[0030] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the application, nor is it used to limit the scope of the application. Other features of the application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0032] Figure 1 is a structural schematic diagram of a data encryption and decryption system according to an embodiment of the application;

[0033] Figure 2 is a structural schematic diagram of another data encryption and decryption system according to an embodiment of the application;

[0034] Figure 3 is a schematic diagram of the connection relationship between module circuits in a data encryption and decryption system according to an embodiment of the application;

[0035] Figure 4 is a schematic diagram of an ordinary AES algorithm implementation process according to an embodiment of the application;

[0036] Figure 5 is a schematic diagram of a data encryption implementation process according to an embodiment of the application;

[0037] Figure 6 is a schematic diagram of a data decryption implementation process according to an embodiment of the application;

[0038] Figure 7 is a flow chart of a data encryption method according to the second embodiment of the present application;

[0039] Figure 8 is a flow chart of a data decryption method according to the third embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the technical personnel of the present application better understand the present application, the following will be combined with the drawings in the embodiments of the present application, the technical solutions in the embodiments of the present application are described clearly and completely, obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0041] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0042] Embodiment one

[0043] Figure 1 The structure diagram of a data encryption and decryption system according to the first embodiment of the present application is provided, the system comprises: a control module 110, an encryption module 120 and a decryption module 130 connected with the control module 110; a key expansion module 140 connected with the control module 110, and a storage module 150 connected with the control module 110 and the key expansion module 140.

[0044] The control module 110 is a module for controlling execution of an Advanced Encryption Standard (AES) encryption and decryption algorithm. The control module 110 is responsible for interacting with a bus to exchange data, controlling an encryption and decryption process, and controlling a key expansion process. The encryption module 120 is responsible for encrypting to-be-encrypted data. The decryption module 130 is responsible for decrypting to-be-decrypted data. The AES is a block cipher system, with a block length of 128 bits and a key length of 128, 192, or 256 bits. The processing unit of the AES encryption algorithm is a byte. A 128-bit block of data is divided into 16 bytes. In the AES algorithm, the concept of a matrix is introduced. The 16 bytes of the block are sequentially copied to a 4*4 matrix, which is referred to as a state. All transformations in the AES are state-based transformations. The AES transformation is implemented through multiple rounds of iteration of a round function. The number of iterations of the round function is different for different key lengths. For the three key lengths mentioned above, the number of iterations is 10, 12, and 14 rounds, respectively. In this embodiment, the case of a key length of 128 bits is described.

[0045] Optionally, the control module 110 is configured to obtain to-be-encrypted data, to-be-decrypted data, and a key, and send the to-be-encrypted data to the encryption module 120, send the to-be-decrypted data to the decryption module 130, and send the key to the key expansion module 140. The encryption module 120 is configured to determine an encryption round and obtain a first extracted key corresponding to the encryption round, and encrypt the received to-be-encrypted data according to the first extracted key to generate final encrypted data. The tail round period in the encryption round is less than the normal encryption round period. The decryption module 130 is configured to determine a decryption round and obtain a second extracted key corresponding to the decryption round, and decrypt the received to-be-decrypted data according to the second extracted key to generate final decrypted data. The first round period in the decryption round is less than the normal decryption round period. The key expansion module 140 is configured to expand the received key to generate a round key, determine an index value corresponding to the round key, and send the round key and the index value to the storage module 150. The storage module 150 is configured to receive and store the round key and the index value.

[0046] Specifically, the control module 110 refers to a controller, which can acquire the to-be-encrypted data and the to-be-decrypted data stored in the internal configuration register of the bus, and send the to-be-encrypted data to the encryption module 120 and the to-be-decrypted data to the decryption module 130. The encryption module 120 can determine the current encryption round when performing each round of encryption, acquire the first extraction key corresponding to the encryption round, and encrypt the received to-be-encrypted data according to the first extraction key to generate the final encrypted data. The purpose of determining the encryption round is that the tail round period is less than the ordinary encryption round period, so the encryption module 120 performs different encryption processing on the tail round and the ordinary encryption round to generate the final encrypted data, so as to save the period. Similarly, the decryption module 130 can also determine the current decryption round when performing each round of decryption, acquire the second extraction key corresponding to the decryption round, and encrypt the received to-be-decrypted data according to the second extraction key to generate the final decrypted data. The first round period in the decryption round is less than the ordinary decryption round period, so the decryption module 130 performs different decryption processing on the first round and the ordinary decryption round to generate the final decrypted data.

[0047] Specifically, the control module 110 can also acquire the key stored in the internal configuration register of the bus and send the key to the key expansion module 140; the key expansion module 140 can expand the received key to generate a round key, and also determine the index value corresponding to the round key, which is used to indicate the encryption round or the decryption round corresponding to the round key. For example, A1 can represent the round key corresponding to the first encryption round, and B1 can represent the round key corresponding to the first decryption round.

[0048] Specifically, when the key expansion module 140 performs key expansion, the round key is continuously transmitted to the storage module 150 for storage, and the index value corresponding to the round key is attached. It needs to be explained that, taking AES128 as an example, when the key expansion module 140 generates the round key for the encryption module 120, the order of the generated round key index values is A1, A2, …, A10, and when the key expansion module 140 generates the round key for the decryption module 130, the order of the generated round key index values is B10, B9, …, B1. The first round of the decryption module 130 needs to use the round key generated last time by the key expansion module 140.

[0049] Optionally, the encryption module 120 is further configured to send the encryption round to the control module 110; the control module 110 is configured to generate a first extraction instruction according to the received encryption round, and send the first extraction instruction to the storage module 150; the storage module 150 is configured to determine an index value matched with the received first extraction instruction, take a round key corresponding to the index value as a first extraction key, and send the first extraction key to the control module 110; the control module 110 is configured to send the received first extraction key to the encryption module 120; and the encryption module 120 is configured to encrypt the to-be-encrypted data according to the received first extraction key to generate final encrypted data.

[0050] Specifically, in the process of encryption, the encryption module 120 first determines the current encryption round, then sends the encryption round to the control module 110, the control module 110 can generate a first extraction instruction according to the received encryption round, and extract the corresponding round key as a first extraction key from the storage module 150 through the first extraction instruction, finally, the control module 110 sends the first extraction key to the encryption module 120, so that the encryption module 120 encrypts the to-be-encrypted data according to the first extraction key to generate final encrypted data. For example, when the encryption module 120 determines that the encryption round is the second round, A2 is contained in the first extraction instruction, that is, the round key corresponding to the index value A2 is extracted as the first extraction key.

[0051] Figure 2 A structural diagram of a data encryption and decryption system is provided for the first embodiment of the present application, Figure 2 In the first embodiment of the present application, the encryption module 120 includes a normal encryption processing unit 121 and a tail processing unit 122, and the decryption module 130 includes a normal decryption processing unit 132 and a head processing unit 131.

[0052] Optionally, the encryption module 120 includes a normal encryption processing unit 121 and a tail processing unit 122; the normal encryption processing unit 121 is configured to perform byte substitution, row shift, column mixing and round key addition on the to-be-encrypted data in a normal encryption round to generate initial encrypted data, and send the initial encrypted data to the tail processing unit 122, wherein the normal encryption round is a round other than the tail round in the encryption round; and the tail processing unit 122 is configured to perform byte substitution, row shift and round key addition on the received initial encrypted data in the tail round to generate final encrypted data.

[0053] Specifically, the encryption module 120 includes a normal encryption processing unit 121 and a tail processing unit 122. The normal encryption processing unit 121 performs byte substitution, row shift, column mixing and round key addition on the data to be encrypted. The tail processing unit 122 does not include the step of column mixing and is used to process the last round of the encryption process. The byte substitution refers to a process of replacing a specified byte in the data to be encrypted by a predefined replacement table. The row shift is a linear transformation that aims to make the data to be encrypted sufficiently chaotic and improve the nonlinearity. The row shift is performed between each row of the state, specifically, each row is cyclically shifted by a number of bytes, the lowest byte is moved to the high bit, and the high byte is moved to the low bit, that is, cyclically right shifted. The number of bytes to be moved is determined according to the number of rows. The first row is cyclically right shifted by one byte, the second row is cyclically right shifted by two bytes, and so on. The column mixing is a linear transformation of the columns of the state. Each column of the state has four bytes. The column transformation is to take a column from the state, express it in polynomial form, multiply it by a fixed polynomial a(x), and then perform a modulo operation on the result, with the modulus being x 4 +l. The round key addition refers to the exclusive OR operation of each byte of the round key and each byte in the state, which realizes the mixing of the password and the key.

[0054] Optionally, the decryption module 130 is further configured to send the decryption round to the control module 110; the control module 110 is configured to generate a second extraction instruction according to the received decryption round, and send the second extraction instruction to the storage module 150; the storage module 150 is configured to determine an index value matched with the received second extraction instruction, take the round key corresponding to the index value as a second extraction key, and send the second extraction key to the control module 110; the control module 110 is configured to send the received second extraction key to the decryption module 130; and the decryption module 130 is configured to decrypt the data to be decrypted according to the received second extraction key to generate final decryption data.

[0055] Specifically, in the process of decryption, the decryption module 130 first determines the current decryption round, then sends the decryption round to the control module 110, the control module 110 can generate a second extraction instruction according to the received decryption round, and extract the corresponding round key as a second extraction key from the storage module 150 through the second extraction instruction, finally, the control module 110 sends the second extraction key to the decryption module 130, so that the decryption module 130 decrypts the data to be decrypted according to the second extraction key to generate final decryption data. For example, when the decryption module 130 determines the decryption round to be the second round, the second extraction instruction includes B2, that is, the round key corresponding to the index value B2 is extracted as the second extraction key.

[0056] Optionally, the decryption module 130 comprises a general decryption processing unit 132 and a head processing unit 131; the head processing unit 131 is configured to generate initial decryption data by performing inverse byte substitution, inverse row shift and round key addition on the data to be decrypted in the first round, and send the initial decryption data to the general decryption processing unit 132; the general decryption processing unit 132 is configured to generate final decryption data by performing inverse byte substitution, inverse row shift, inverse column mixing and round key addition on the received initial decryption data in the general decryption round, wherein the general decryption round is a round other than the first round in the decryption rounds.

[0057] Specifically, the decryption module 130 comprises a general decryption processing unit 132 and a head processing unit 131; the general decryption processing unit 132 performs inverse byte substitution, inverse row shift, inverse column mixing and round key addition on the data to be decrypted; the head processing unit 131 does not include the step of inverse column mixing, and is configured to process the decryption process in the first round; wherein the inverse byte substitution, inverse row shift and inverse column mixing are inverse transformations corresponding to byte substitution, row shift and column mixing.

[0058] Figure 3 A schematic diagram of the connection relationship between the module circuits in the data encryption and decryption system is provided for the embodiment, Figure 3 The connection relationship between the control module, the key expansion module, the storage module, the general encryption processing unit, the tail processing unit, the head processing unit and the general decryption processing unit is shown in the figure, and the direction of the arrow indicates the direction of data transmission.

[0059] Further, in the process of performing encryption, the key expansion and the encryption process are parallel, which can save the round key generation time in the encryption process. For example, AES128 can save 10 clock cycles, Figure 4 A schematic diagram of the general AES algorithm implementation process is provided for the embodiment, Figure 4 In the figure, after the input of the data to be encrypted or the data to be decrypted, key expansion is performed first, which consumes 11 cycles from the first round key expansion to the last round key expansion, and then the encryption and decryption of the data is performed, which consumes 18 cycles from the first round encryption and decryption cycle to the last round encryption and decryption cycle, and a total of 29 cycles are consumed. Figure 5 A schematic diagram of the data encryption implementation process is provided for the embodiment, Figure 5 In the figure, step 1 represents the byte substitution and row shift performed by the general encryption processing unit 121, and step 2 represents the column mixing and round key addition performed by the general encryption processing unit 121; each step consumes 1 cycle, and the tail processing unit 122 consumes 1 cycle; the processing of the data to be encrypted M1 consumes a total of 19 cycles; the key expansion and the encryption process are parallel, and only one cycle needs to be added to achieve the processing of the data to be encrypted M2.

[0060] It should be noted that since decryption needs to use round keys in reverse, instead of using round keys in forward as in encryption, the decryption process needs to wait until all round keys are generated before decryption, Figure 6 A schematic diagram of a data decryption implementation process is provided for the embodiment, Figure 6 In the embodiment, the key expansion consumes a total of 10 cycles, the head processing unit 131 consumes 1 cycle, step 1 represents the inverse byte substitution and inverse row shift performed by the normal decryption processing unit 132, and step 2 represents the inverse column mixing and round key addition performed by the normal decryption processing unit 132, each step consumes 1 cycle, and the processing of the to-be-decrypted data N1 consumes a total of 28 cycles, and if the to-be-decrypted data N2 needs to be processed at the same time, 30 cycles are needed. Whether it is an encryption process or a decryption process, it saves cycles and improves processing efficiency compared with the implementation process of the normal AES algorithm.

[0061] Optionally, the encryption module 120 is configured to send the final encrypted data to the storage module 150, the decryption module 130 is configured to send the final decrypted data to the storage module 150, and the storage module 150 is configured to store the received final encrypted data and final decrypted data.

[0062] Specifically, the encryption module 120 also sends the final encrypted data to the storage module 150, the decryption module 130 also sends the final decrypted data to the storage module 150, and the storage module 150 can store the received final encrypted data and final decrypted data, and the storage mode can be storage by a storage device arranged in the storage module 150, and the storage device can be a computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0063] The technical scheme of the embodiment of the application receives the to-be-encrypted data sent by the control module through the encryption module, separately processes the tail round and the normal encryption round according to the encryption round, receives the to-be-decrypted data through the decryption module, and separately processes the head round and the normal decryption round according to the decryption round, thereby saving processing cycles and improving processing efficiency.

[0064] Embodiment two

[0065] Figure 7 A flowchart of a data encryption method is provided for the second embodiment of the application, and the embodiment can be applied to an AES encryption scenario. As shown in the figure, Figure 7 the method comprises the following steps:

[0066] S210, acquire the to-be-encrypted data and the key by the control module, and send the to-be-encrypted data to the encryption module and the key to the key expansion module.

[0067] Specifically, the controller can acquire the to-be-encrypted data stored in the internal configuration register by the bus and send the to-be-encrypted data to the encryption module.

[0068] S220, expand the received key to generate a round key by the key expansion module, determine an index value corresponding to the round key, and send the round key and the index value to the storage module.

[0069] Specifically, the control module can also acquire the key stored in the internal configuration register by the bus and send the key to the key expansion module; the key expansion module can expand the received key to generate a round key and also determine an index value corresponding to the round key. When the key expansion module expands the key, the round key is continuously transmitted to the storage module for storage, and the index value corresponding to the round key is attached.

[0070] S230, receive and store the round key and the index value by the storage module.

[0071] S240, determine an encryption round by the encryption module, acquire a first extraction key corresponding to the encryption round, and encrypt the received to-be-encrypted data according to the first extraction key to generate final encrypted data.

[0072] Specifically, the encryption module can determine the encryption round currently in when performing each round of encryption, acquire a first extraction key corresponding to the encryption round, and encrypt the received to-be-encrypted data according to the first extraction key to generate final encrypted data. The purpose of determining the encryption round is that the tail round period is less than the ordinary encryption round period, so the encryption module performs different encryption processing on the tail round and the ordinary encryption round to generate final encrypted data, thereby saving the period.

[0073] Optionally, acquiring the first extraction key corresponding to the encryption round includes: sending the encryption round to the control module by the encryption module; generating a first extraction instruction according to the received encryption round by the control module and sending the first extraction instruction to the storage module; determining an index value matching the received first extraction instruction by the storage module, taking the round key corresponding to the index value as the first extraction key, and sending the first extraction key to the control module; and sending the received first extraction key to the encryption module by the control module.

[0074] Specifically, the encryption module determines the current encryption round in the encryption process, and then sends the encryption round to the control module. The control module can generate a first extraction instruction according to the received encryption round, and extract the corresponding round key as the first extraction key from the storage module through the first extraction instruction. Finally, the control module sends the first extraction key to the encryption module, so that the encryption module encrypts the to-be-encrypted data according to the first extraction key to generate the final encrypted data. For example, when the encryption module determines the encryption round to be the second round, A2 is contained in the first extraction instruction, that is, the round key corresponding to the extraction index value A2 is extracted as the first extraction key.

[0075] The technical scheme of the embodiment of the application receives the to-be-encrypted data sent by the control module through the encryption module, separately processes the tail round and the general encryption round according to the encryption round, and adopts the parallel processing mode of the key expansion module and the encryption module, thereby saving the processing period and improving the processing efficiency.

[0076] Embodiment three

[0077] Figure 8 A flowchart of a data decryption method provided by the second embodiment of the application, which can be applied to an AES decryption scene. As shown in the figure, the method comprises the following steps. Figure 8

[0078] S310, acquire the key through the control module, and send the key to the key expansion module.

[0079] S320, expand the received key through the key expansion module to generate a round key, determine the index value corresponding to the round key, and send the round key and the index value to the storage module.

[0080] Specifically, when the key expansion module expands the key, the round key is continuously transmitted to the storage module for storage, and the index value corresponding to the round key is attached. It should be noted that, taking AES128 as an example, when the key expansion module generates the round key for the encryption module, the order of the generated round key index values is A1, A2, …, A10, and when the key expansion module generates the round key for the decryption module, the order of the generated round key index values is B10, B9, …, B1. The first round of the decryption module needs to use the round key generated last time by the key expansion module.

[0081] S330, receive and store the round key and the index value through the storage module.

[0082] S340, acquire the to-be-decrypted data through the control module, and send the to-be-decrypted data to the decryption module.

[0083] ​Specifically, the controller can obtain the to-be-decrypted data stored in the internal configuration register by the bus, and send the to-be-decrypted data to the decryption module. The decryption module can also determine the current decryption round when performing each round of decryption, and obtain the second extraction key corresponding to the decryption round, and generate the final decryption data by decrypting the received to-be-decrypted data according to the second extraction key. The first round period in the decryption round is less than the ordinary decryption round period, so the decryption module will perform different decryption processing on the first round and the ordinary decryption round to generate the final decryption data.

[0084] S350, determine the decryption round by the decryption module, and obtain the second extraction key corresponding to the decryption round, and generate the final decryption data by decrypting the received to-be-decrypted data according to the second extraction key. Wherein, the first round period in the decryption round is less than the ordinary decryption round period.

[0085] Optionally, obtaining the second extraction key corresponding to the decryption round comprises: sending the decryption round to the control module by the decryption module; generating a second extraction instruction according to the received decryption round by the control module, and sending the second extraction instruction to the storage module; determining the index value matched with the received second extraction instruction by the storage module, taking the round key corresponding to the index value as the second extraction key, and sending the second extraction key to the control module; and sending the received second extraction key to the decryption module by the control module.

[0086] Specifically, the decryption module will first determine the current decryption round during the decryption process, and then send the decryption round to the control module. The control module can generate a second extraction instruction according to the received decryption round, and extract the corresponding round key as the second extraction key from the storage module through the second extraction instruction. Finally, the control module will send the second extraction key to the decryption module, so that the decryption module can decrypt the to-be-decrypted data according to the second extraction key to generate the final decryption data. For example, when the decryption module determines the decryption round to be the second round, the second extraction instruction contains B2, that is, the round key corresponding to the index value B2 is extracted as the second extraction key.

[0087] The technical scheme of the embodiment of the application receives the to-be-decrypted data sent by the control module through the decryption module, separately processes the first round and the ordinary decryption round according to the decryption round, saves the processing period, and improves the processing efficiency.

[0088] It should be understood that various forms of flow shown above can be used to reorder, add or delete steps. For example, each step described in the present application can be executed in parallel, sequentially or in different order, as long as the desired results of the technical scheme of the present application can be achieved, which is not limited herein.

[0089] The above detailed description does not limit the scope of the application. Various modifications, combinations, sub-combinations and alternatives can be made to the detailed description. Any modification, equivalent replacement and improvement etc. made within the spirit and principle of the application shall be included in the scope of the application.

Claims

1. A data encryption and decryption system, characterized by, The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device.

2. The system of claim 1, wherein, The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device.

3. The system of claim 1, wherein, The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device.

4. The system of claim 2 or 3, wherein, The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption and decryption method and device. The application relates to a data encryption The storage module is configured to store the received final encrypted data and the final decrypted data.

5. The system of claim 2, wherein, The encryption module comprises a general encryption processing unit and a tail processing unit; The general encryption processing unit is configured to perform byte substitution, row shift, column mixing and round key addition on the to-be-encrypted data in a general encryption round to generate initial encrypted data, and send the initial encrypted data to the tail processing unit, wherein the general encryption round is a round other than a tail round in the encryption rounds. The tail processing unit is configured to perform byte substitution, row shift and round key addition on the received initial encrypted data in a tail round to generate the final encrypted data.

6. The system of claim 3, wherein, The decryption module comprises a general decryption processing unit and a head processing unit; The head processing unit is configured to perform inverse byte substitution, inverse row shift and round key addition on the to-be-decrypted data in a head round to generate initial decrypted data, and send the initial decrypted data to the general decryption processing unit. The general decryption processing unit is configured to perform inverse byte substitution, inverse row shift, inverse column mixing and round key addition on the received initial decrypted data in a general decryption round to generate the final decrypted data, wherein the general decryption round is a round other than a head round in the decryption rounds.

7. A data encryption method characterized by, The application is applied to the encryption and decryption system as claimed in any one of claims 1-6, and comprises: The control module is configured to obtain to-be-encrypted data and a key, send the to-be-encrypted data to the encryption module, and send the key to the key expansion module; The key expansion module is configured to expand the received key to generate a round key, determine an index value corresponding to the round key, and send the round key and the index value to the storage module; The storage module is configured to receive and store the round key and the index value; The encryption module is configured to determine an encryption round, obtain a first extraction key corresponding to the encryption round, and encrypt the received to-be-encrypted data according to the first extraction key to generate final encrypted data, wherein a tail round period in the encryption round is less than a general encryption round period.

8. The method of claim 7, wherein, The encryption module is configured to send the encryption round to the control module; The control module is configured to generate a first extraction instruction according to the received encryption round, and send the first extraction instruction to the storage module; The storage module is configured to determine the index value matching the received first extraction instruction, take the round key corresponding to the index value as a first extraction key, and send the first extraction key to the control module; The control module is configured to send the received first extraction key to the encryption module. The application is applied to the encryption and decryption system as claimed in any one of claims 1-6, and comprises:

9. A data decryption method characterized by, The control module is configured to obtain a key, and send the key to the key expansion module; The key expansion module is configured to expand the received key to generate a round key, determine an index value corresponding to the round key, and send the round key and the index value to the storage module; ​ The storage module receives the round key and the index value and stores them; The control module obtains the data to be decrypted and sends the data to the decryption module; The decryption module determines the decryption round and obtains the second extraction key corresponding to the decryption round, and decrypts the received data to be decrypted according to the second extraction key to generate final decryption data, wherein the first round period in the decryption round is less than the normal decryption round period.

10. The method of claim 9, wherein, The second extraction key corresponding to the decryption round is obtained, including: The decryption module sends the decryption round to the control module; The control module generates a second extraction instruction according to the received decryption round and sends the second extraction instruction to the storage module; The storage module determines the index value matched with the received second extraction instruction, takes the round key corresponding to the index value as the second extraction key, and sends the second extraction key to the control module; The control module sends the received second extraction key to the decryption module.

Images