A symmetric encryption / decryption combinational circuit based on obfuscation mechanism to defend against fault attacks

Abstract

The present invention relates to the technical field of cryptographic circuit implementation, and in particular to a symmetric encryption / decryption combination circuit based on an obfuscation mechanism that can defend against fault attacks, including an encryption circuit unit, a decryption circuit unit, an obfuscation mechanism unit, a deobfuscation mechanism unit, and a key expansion unit; the encryption circuit unit and the decryption circuit unit are both fully expanded structures, including Nr round transformation units. The present invention uses a random number generator unit, a memory unit, and an obfuscation mechanism unit to make the padding data not fixed, and at the same time, it plays a random role in inducing (or injecting) faults. Compared with traditional single diffusion, the present invention processes the same set of data with dynamic power consumption, and at the same time, randomly diffuses the possible fault information in the encryption path, destroying the dependency between the induced fault and the fault ciphertext, thereby effectively defending against fault attacks and improving the security of the encryption circuit.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic circuit implementation, and in particular to a symmetric encryption / decryption combination circuit capable of defending against fault attacks based on an obfuscation mechanism. Background Art

[0002] Symmetric block cipher is an encryption algorithm widely used in the field of information security. The development of its structure is crucial to protecting the confidentiality of data. With the rapid development of information technology, especially the popularization of the Internet and the rapid development of mobile communications, people have higher and higher requirements for data security. However, various attack methods have emerged, such as differential attacks, linear attacks, and algebraic attacks, which have posed a serious threat to traditional symmetric block ciphers.

[0003] Early symmetric block ciphers mainly used the Feistel structure, which divides the plaintext into two parts of equal length and encrypts them through multiple rounds of iterations. However, with the advancement of computer technology, the Feistel structure gradually exposed some security issues, such as key dependence and symmetry. Therefore, researchers began to try to design new symmetric block cipher structures.

[0004] At present, many new symmetric block cipher structures have emerged, such as SPN structure, round function structure and permutation-permutation network structure. These new structures have made significant progress in improving the security and performance of cryptography. For example, the SPN structure increases the complexity and anti-attack ability of the cipher by dividing the plaintext into multiple small blocks and using nonlinear S-box and permutation operations. The round function structure uses nonlinear Boolean functions as the basic operation of the cipher, further enhancing the security of the cipher. The permutation-permutation network structure increases the obfuscation of the cipher by performing multiple permutations and inverse permutations on the plaintext.

[0005] Although these new symmetric block cipher structures have high security and performance in theory, there are still some problems and challenges in practical applications. For example, how to choose the appropriate S-box and Boolean function, how to determine the appropriate key length and number of rounds, how to resist different types of attacks, etc. Therefore, further research on the development of symmetric block cipher structures and the exploration of more secure and efficient cryptographic algorithms are of great significance for protecting data confidentiality and resisting various attacks.

[0006] Fault attack is a type of bypass attack on cryptographic systems. Attackers use electromagnetic, laser and other means to inject faults into cryptographic hardware circuits, causing cryptographic devices to generate error messages, thereby preventing the decryption party from obtaining correct information authentication and refusing service. Furthermore, attackers can obtain system keys through differential fault analysis. In addition, some extreme application environments, such as high-altitude environments and deep-sea environments, require higher reliability for equipment.

[0007] In response to fault attacks and the requirements for high reliability of equipment in some extreme application environments, traditional solutions mainly use structural redundant error detection mechanisms, that is, using multiple circuits with the same functions to process the same set of data at the same time and compare the resulting data. Summary of the invention

[0008] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a symmetric encryption / decryption combination circuit based on an obfuscation mechanism that can defend against fault attacks, which can solve the problem that the existing symmetric group encryption / decryption circuit cannot defend against fault attacks.

[0009] In order to achieve the above object, the present invention adopts the following technical solutions:

[0010] A symmetric encryption / decryption combination circuit based on an obfuscation mechanism capable of defending against fault attacks, comprising an encryption circuit unit, a decryption circuit unit, an obfuscation mechanism unit, a deobfuscation mechanism unit and a key expansion unit;

[0011] The encryption circuit unit is a fully expanded structure, and the encryption circuit unit includes Nr(N r The first operation of the obfuscation mechanism unit occurs at the output of the third round of the encryption algorithm, that is, the output of the third round is firstly filled with data and replaced, and then stored in the memory as a redundant obfuscated ciphertext result; the second operation of the obfuscation mechanism unit occurs at the output of the encryption algorithm, the ciphertext is filled with data and replaced, and then stored in the memory as an obfuscated ciphertext result;

[0012] The decryption circuit unit is a fully expanded structure, and the decryption circuit unit includes Nr(N r The first operation of the deobfuscation mechanism unit is to operate on the redundant obfuscated ciphertext, use the last round key of the key expansion, and then use it as the input of the third round decryption circuit; the second operation of the deobfuscation mechanism unit is to operate on the redundant ciphertext, and then use it as the input of the decryption circuit;

[0013] The obfuscation mechanism unit rearranges the data, first determines whether padding is required, and after processing, transforms the data according to the key instruction, using the obfuscation function ψ to obtain obfuscated data;

[0014] The deobfuscation mechanism unit recovers the data, performs an inverse transformation on the data according to the key instruction, and uses the inverse obfuscation function ψ -1 , get the original data;

[0015] The key expansion unit implements a conventional symmetric group key diffusion algorithm, and its output is the round key required for each round transformation encryption process.

[0016] Preferably, the symmetric block encryption of the encryption circuit unit uses a round transformation unit with the same structure; the output of the third round transformation unit and the last round output of the key expansion are the input of the obfuscation mechanism unit to generate redundant obfuscated ciphertext; r The output of the round and the final round output of the key expansion are the outputs of the obfuscation mechanism unit, which are used to generate obfuscated ciphertexts; that is, the redundant obfuscated ciphertexts and the obfuscated ciphertexts are the outputs of the encryption circuit.

[0017] Preferably, the symmetric group decryption of the decryption circuit unit uses a round transformation unit with the same structure; the redundant obfuscated ciphertext first passes through the deobfuscation mechanism unit and then serves as the input of the third round of decryption. The decryption result is the redundant plaintext, and the decryption output result is the AND (&) operation of the plaintext and the redundant plaintext. If there is a fault, the output result is random. If there is no fault, the output result is the correct plaintext.

[0018] Preferably, the obfuscation mechanism unit comprises a random number generator unit, a memory unit, a data filling unit and a permutation mechanism unit connected in sequence;

[0019] The random number generator unit generates random numbers and puts them into the memory unit for use, fills them using the ISO23120 standard, takes out data of the required length from the memory unit and puts them into the encrypted data; the substitution mechanism unit substitutes the filled data, ψ is a function containing 12 defined operation instructions, enters the ψ function, uses the last round key of the symmetric block cipher as the instruction of ψ, and confuses the ciphertext, so that the attacker cannot obtain the relationship between the key and the fault ciphertext.

[0020] The input of the obfuscation mechanism unit is the result of the third round of encryption and the Nr(N rThe result of a round of encryption (the number of round transformation operations specified by the encryption algorithm standard) and the round key of the last round of key expansion; first, the redundant ciphertext and ciphertext of the two-way input data are filled with data, and then the result data is diffused through the permutation function ψ, and the possible fault data (if there is non-zero data, it means that there is a fault in the original circuit) is rearranged to its different positions, and finally the obtained data is used as the output of the encryption circuit.

[0021] Preferably, the deobfuscation mechanism unit includes a recovery mechanism unit and a data defilling unit;

[0022] The recovery mechanism unit analyzes the received redundant obfuscated ciphertext, ψ -1 For a function containing 12 defined operation instructions, enter ψ -1 function, using the last round key of the symmetric block cipher as ψ -1 The redundant obfuscated ciphertext is restored according to the instruction; the data de-filling unit removes the filled data according to the ISO23120 standard to obtain the decrypted redundant ciphertext.

[0023] Preferably, the input of the replacement mechanism unit is the encrypted data after data padding; the data passed through the replacement mechanism unit can reduce the correlation with the direct encryption result; and the instructions in the key are invalid, so that the attacker cannot crack the key used in the replacement algorithm; whether inducing a fault in the encrypted data or inducing a fault in the key, the diffusion value of the fault has no direct connection with the information of the key.

[0024] Preferably, the input of the recovery mechanism unit is redundant obfuscated ciphertext and obfuscated ciphertext; the data passing through the recovery mechanism unit can be used as input data of a decryption circuit to restore the encrypted data.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] The present invention uses a random number generator unit, a memory unit and an obfuscation mechanism unit to make the filling data not fixed, and at the same time, randomize the induced (or injected) faults. Compared with the traditional single diffusion, the present invention processes the same set of data with dynamic power consumption, and at the same time, randomly diffuses the possible fault information in the encryption path, destroying the dependency between the induced fault and the fault ciphertext, thereby effectively defending against fault attacks and improving the security of the encryption circuit. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 (a) is a schematic diagram of the symmetric block encryption structure of the present invention, and (b) is a schematic diagram of the symmetric block decryption structure of the present invention;

[0028] Figure 2It is a schematic diagram of the data arrangement method of the present invention;

[0029] Figure 3 It is a schematic diagram of the Rubik's Cube replacement method of the present invention;

[0030] Figure 4 (a) is a schematic diagram of the transformation of the confusion function (ψ) of the present invention, and (b) is a schematic diagram of the transformation of the confusion function (ψ) of the present invention. -1 ) Transformation diagram;

[0031] Figure 5 It is a schematic diagram of the fully expanded structure of the symmetric block encryption circuit of the present invention;

[0032] Figure 6 The figure is a flow chart of the encryption / decryption operation performed by the encryption / decryption circuit of the present invention. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings, so that those skilled in the art can better understand the advantages and features of the present invention, thereby making a clearer definition of the protection scope of the present invention. The embodiments described in the present invention are only a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present invention.

[0034] A symmetric encryption / decryption combination circuit based on an obfuscation mechanism capable of defending against fault attacks, comprising an encryption circuit unit, a decryption circuit unit, an obfuscation mechanism unit, a deobfuscation mechanism unit and a key expansion unit;

[0035] The encryption circuit unit is a fully expanded structure, and the encryption circuit unit includes Nr(N r The first operation of the obfuscation mechanism unit occurs at the output of the third round of the encryption algorithm, that is, the output of the third round is firstly filled with data and replaced, and then stored in the memory as a redundant obfuscated ciphertext result; the second operation of the obfuscation mechanism unit occurs at the output of the encryption algorithm, the ciphertext is filled with data and replaced, and then stored in the memory as an obfuscated ciphertext result;

[0036] The decryption circuit unit is a fully expanded structure, including Nr(N r The first operation of the deobfuscation mechanism unit is to operate on the redundant obfuscated ciphertext, use the last round key of the key expansion, and then use it as the input of the third round decryption circuit; the second operation of the deobfuscation mechanism unit is to operate on the redundant ciphertext, and then use it as the input of the decryption circuit;

[0037] The obfuscation mechanism unit rearranges the data, first determines whether padding is required, and after processing, transforms the data according to the key instruction, using the obfuscation function ψ to obtain obfuscated data;

[0038] The deobfuscation mechanism unit recovers the data, performs an inverse transformation on the data according to the key instruction, and uses the inverse obfuscation function ψ -1 , get the original data;

[0039] The key expansion unit implements a conventional symmetric group key diffusion algorithm, and its output is the round key required for each round transformation encryption process.

[0040] Specifically, the symmetric block encryption of the encryption circuit unit uses a round transformation unit with the same structure; the output of the third round transformation unit and the last round output of the key expansion are input to the obfuscation mechanism unit to generate redundant obfuscated ciphertext; r The output of the round and the final round output of the key expansion are the outputs of the obfuscation mechanism unit, which are used to generate obfuscated ciphertexts; that is, the redundant obfuscated ciphertexts and the obfuscated ciphertexts are the outputs of the encryption circuit.

[0041] Specifically, the symmetric group decryption of the decryption circuit unit uses a round transformation unit with the same structure; the redundant obfuscated ciphertext first passes through the deobfuscation mechanism unit and then serves as the input of the third round of decryption. The decryption result is the redundant plaintext, and the decryption output result is the AND (&) operation of the plaintext and the redundant plaintext. If there is a fault, the output result is random. If there is no fault, the output result is the correct plaintext.

[0042] Specifically, the obfuscation mechanism unit includes a random number generator unit, a memory unit, a data filling unit and a substitution mechanism unit connected in sequence;

[0043] The random number generator unit generates random numbers and puts them into the memory unit for use, fills them using the ISO23120 standard, takes out data of the required length from the memory unit and puts them into the encrypted data; the substitution mechanism unit substitutes the filled data, ψ is a function containing 12 defined operation instructions, enters the ψ function, uses the last round key of the symmetric block cipher as the instruction of ψ, and confuses the ciphertext, so that the attacker cannot obtain the relationship between the key and the fault ciphertext.

[0044] The input of the obfuscation mechanism unit is the result of the third round of encryption and the Nr(N rThe result of a round of encryption (the number of round transformation operations specified by the encryption algorithm standard) and the round key of the last round of key expansion; first, the redundant ciphertext and ciphertext of the two-way input data are filled with data, and then the result data is diffused through the permutation function ψ, and the possible fault data (if there is non-zero data, it means that there is a fault in the original circuit) is rearranged to its different positions, and finally the obtained data is used as the output of the encryption circuit.

[0045] Specifically, the deobfuscation mechanism unit includes a recovery mechanism unit and a data defilling unit;

[0046] The recovery mechanism unit analyzes the received redundant obfuscated ciphertext, ψ -1 For a function containing 12 defined operation instructions, enter ψ -1 function, using the last round key of the symmetric block cipher as ψ -1 The redundant obfuscated ciphertext is restored according to the instruction; the data de-filling unit removes the filled data according to the ISO23120 standard to obtain the decrypted redundant ciphertext.

[0047] Specifically, the input of the replacement mechanism unit is the encrypted data after data padding; the data passed through the replacement mechanism unit can reduce the correlation with the direct encryption result; and the instructions in the key are invalid, so that the attacker cannot crack the key used in the replacement algorithm; whether inducing a fault in the encrypted data or inducing a fault in the key, the diffusion value of the fault has no direct connection with the information of the key.

[0048] Specifically, the input of the recovery mechanism unit is the redundant obfuscated ciphertext and the obfuscated ciphertext; the data passed through the recovery mechanism unit can be used as the input data of the decryption circuit, thereby restoring the encrypted data.

[0049] See also Figure 1 (a) An encryption circuit based on an obfuscation mechanism and capable of defending against fault attacks, comprising: an obfuscation mechanism unit, an encryption circuit unit and a key expansion unit.

[0050] See also Figure 1 (b) A decryption circuit based on an obfuscation mechanism and capable of defending against fault attacks, comprising: an anti-obfuscation mechanism unit, a decryption circuit unit and a key expansion unit.

[0051] Figure 1 The encryption circuit unit and decryption circuit unit described in (a) and (b) are fully expanded structures, including N R A round conversion unit.

[0052] Figure 1(a) is an encryption circuit based on an obfuscation mechanism that can defend against power failure attacks. The input plaintext and the output ciphertext are both data packets. The key is the key bit number specified by the corresponding password. The initial key is input into the key expansion unit for key expansion. At the same time, the initial key is XORed with the input plaintext. The first obfuscation operation of the obfuscation mechanism unit occurs after the three round transformation units (i.e., round transformation 3) of the encryption, that is, the output data is obfuscated to obtain the obfuscated redundant ciphertext C RM ; Secondly, confuse the encrypted output to obtain the obfuscated ciphertext C M .

[0053] Figure 1 (b) A decryption circuit based on an obfuscation mechanism that can defend against a fault attack, wherein the reverse obfuscation mechanism occurs before the first round of decryption in the decryption circuit, and the obfuscated redundant ciphertext C RM And the obfuscated ciphertext C M Perform the inverse transformation to obtain the ciphertext C that can be decrypted normally R and C; C R As the Nth R-2 The input of the round decryption is decrypted to obtain the redundant plaintext P R , C is used as the input for normal decryption, S decrypts the plaintext P, and the output is P F (P R &P).

[0054] See also Figure 3 , a transformation unit based on Rubik's Cube permutation, including: an operation set unit and a key distribution unit.

[0055] Figure 3 The operation set unit described in the specification defines 12 different operations, that is, the data processing methods are divided into 12 types, and the definitions and explanations are as follows:

[0056] A: The data on the first side is rotated 90° counterclockwise, the data on the third side remains unchanged, and then the data in the first column is swapped according to 2→5→4→6→2.

[0057] A': The data on the first side is rotated 90° clockwise, the data on the third side remains unchanged, and then the data in the first column is exchanged according to 2→6→4→5→2.

[0058] B: The data on the 1st and 3rd sides remain unchanged, and then the data in the second column are swapped according to 2→5→4→6→2.

[0059] B': The data on the 1st and 3rd sides remain unchanged, and then the data in the second column are swapped according to 2→6→4→5→2.

[0060] C: The data on the third side is rotated 90° counterclockwise, the data on the first side remains unchanged, and then the data in the first column is exchanged according to 2→5→4→6→2.

[0061] C': The data on the third side is rotated 90° clockwise, the data on the first side remains unchanged, and then the data in the first column is exchanged according to 2→6→4→5→2.

[0062] D: The data on the 5th side is rotated 90° counterclockwise, the data on the 6th side remains unchanged, and then the data on the first row is exchanged according to 1→2→3→4→1.

[0063] D': The data on the 5th surface is rotated 90° clockwise, the data on the 6th surface remains unchanged, and then the data on the first row is exchanged according to 1→4→3→2→1.

[0064] E: The data on the 5th and 6th sides remain unchanged, and then the data on the second row is swapped according to 1→2→3→4→1.

[0065] E': The data on the 5th and 6th sides remain unchanged, and then the data on the second row is swapped according to 1→4→3→2→1.

[0066] F: The data on the 6th side is rotated 90° counterclockwise, the data on the 5th side remains unchanged, and then the data on the third row is exchanged according to 1→4→3→2→1.

[0067] F': The data on the 6th side is rotated 90° clockwise, the data on the 5th side remains unchanged, and then the data on the third row is exchanged according to 1→4→3→2→1.

[0068] Mathematically, the 12 operations above are divided into the rotation of surface data and the exchange of row / column data of different surfaces. Assume that the original data before the operation is D, and the data after one operation is a and b represent operations on a row and a column of the surface data respectively.

[0069] Representation 1: The rotation of the surface data is divided into counterclockwise and clockwise rotation of 90°. The kth surface is rotated 90° counterclockwise, and we have:

[0070]

[0071] Similarly, rotating the kth face 90° clockwise gives:

[0072]

[0073] For (1) and (2), k=1, 3, corresponding to the first and third columns; k=5, 6, corresponding to the first and third rows.

[0074] Representation 2: Row-column exchange between face data. There are two cases for row-column exchange of faces k1, k2, k3 and k4: operation on a row (a) or a column (b). Data exchange on row a can be expressed by formula (3):

[0075]

[0076] The data exchange for column b can be expressed by formula (4):

[0077]

[0078] It is defined that an operation is performed every 4 bits, and the number of bits occupied by the three parameters is as follows, where Nf needs to occupy 2 bits, while CR and Rm only need to occupy 1 bit each, as shown in formula (5). It can be seen that this method will have a special case, that is, Nf = 00. In order not to waste the key information, it is stipulated that when Nf = 00, it means the first row or the first column.

[0079]

[0080] See also Figure 4 (a) An obfuscation mechanism unit, comprising: an obfuscation function unit and a key distribution unit.

[0081] Figure 4 The obfuscation mechanism described in (a) first processes the key and divides it into groups of 4 bits. The 12 specified operations are used to select the corresponding operation according to the value of the group, that is, a permutation operation is performed using the 4-bit key.

[0082] See also Figure 4 (b) A de-obfuscation mechanism unit, comprising: a de-obfuscation function unit and a key distribution unit.

[0083] Figure 4 The reverse obfuscation mechanism described in (b) first processes the key and divides it into groups of 4 bits, then sorts them in reverse order, inverts the last bit of each group of keys (for example, 1001, the last bit is inverted to 1000), and forms the key K'. Then, the 12 operations are used to select the corresponding operation according to the value of the group, that is, a reverse permutation operation is performed using the 4-bit key.

[0084] See also Figure 6 , Figure 6 To conduct N r The flow chart of the round encryption / decryption circuit for encryption / decryption operation. The input plaintext and initial key are both data packets, which are first encrypted through a round key addition operation, and then enter the round transformation unit for a total of N r After round-by-round transformation operations, the circuit outputs the final data packet ciphertext; during decryption, the key usage rules are opposite to the encryption order, and after the round key addition operation, the plaintext is finally output.

[0085] In the present invention, the proposed protection circuit is used to realize the obfuscation of part of the data and the encryption result generated by the block cipher during the encryption process, and the decryption end uses fault detection to identify the faulty data and output the correct plaintext; the obfuscation mechanism first performs data padding, and fills the ciphertext according to the algorithm of the symmetric cipher. If the ciphertext is an integer multiple of 54, no padding is required; if it is not an integer multiple of 54, the data is filled to the adjacent integer multiple of 54 (the filling value is generated by a random number generator), and the filling method uses the ISO23120 standard, thereby obfuscating the ciphertext and disturbing the ciphertext value; the round key of the last round (or multiple rounds) of the encryption algorithm is used for operation, and 12 different permutation instructions are designed. After the ciphertext is operated, the corresponding relationship between the induced fault and the faulty ciphertext is destroyed; in addition, the output of the third round of the encryption process is selected as the redundant ciphertext, and the same operation is performed to obtain a set of data, which is sent to the decryption end at the same time as the data of the encryption result. After receiving the data, the decryption end decrypts the two in turn. It should be noted that the redundant ciphertext needs to be decrypted from the third to last round, and the results of the two are ANDed as the final output.

[0086] In summary, the present invention makes the filling data not fixed through the random number generator unit, the memory unit and the obfuscation mechanism unit, and at the same time plays a random role in induced (or injected) faults. Compared with the traditional single diffusion, the power consumption of the present invention in processing the same set of data presents dynamic changes, and at the same time, the fault information that may exist in the encryption path is randomly diffused, which destroys the dependency between the induced fault and the fault ciphertext, thereby effectively defending against fault attacks and improving the security of the encryption circuit.

[0087] The description and practice disclosed in the present invention are easy to think and understand for ordinary technicians in the technical field, and several improvements and modifications can be made without departing from the principles of the present invention. Therefore, modifications or improvements made without departing from the spirit of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A symmetric encryption / decryption combination circuit based on an obfuscation mechanism that can defend against fault attacks, characterized in that: It includes an encryption circuit unit, a decryption circuit unit, an obfuscation mechanism unit, a deobfuscation mechanism unit and a key expansion unit; The encryption circuit unit is a fully expanded structure, and the encryption circuit unit includes Nr The first operation of the obfuscation mechanism unit occurs at the output of the third round of the encryption algorithm, which is then stored in the memory as a redundant ciphertext, that is, the third round output is firstly filled with data and replaced, and then stored in the memory as a redundant obfuscated ciphertext result; the second operation of the obfuscation mechanism unit occurs at the output of the encryption algorithm, the ciphertext is filled with data and replaced, and then stored in the memory as an obfuscated ciphertext result; The decryption circuit unit is a fully expanded structure, and the decryption circuit unit includes Nr A round conversion unit; The first operation of the deobfuscation mechanism unit is to operate on the redundant obfuscated ciphertext, using the last round key of the key expansion, and then using it as the input of the third round decryption circuit; the second operation of the deobfuscation mechanism unit is to operate on the redundant ciphertext, and then use it as the input of the decryption circuit; The obfuscation mechanism unit rearranges the data, first determines whether padding is required, and then transforms the data according to the key instruction, using the obfuscation function ψ , get obfuscated data; The deobfuscation mechanism unit recovers the data, performs an inverse transformation on the data according to the key instruction, and uses an inverse obfuscation function ψ −1 , get the original data; The key expansion unit implements a symmetric group key diffusion algorithm, and its output is the round key required for each round transformation encryption process; The symmetric block encryption of the encryption circuit unit uses a round transformation unit with the same structure; the output of the third round transformation unit and the last round output of the key expansion are the input of the obfuscation mechanism unit, which is used to generate redundant obfuscated ciphertext; N r The output of the round and the last round output of the key expansion are the input of the obfuscation mechanism unit to generate obfuscated ciphertext; that is, the redundant obfuscated ciphertext and the obfuscated ciphertext are the output of the encryption circuit.

2. A symmetric encryption / decryption combination circuit based on an obfuscation mechanism capable of defending against fault attacks according to claim 1, characterized in that: The symmetric group decryption of the decryption circuit unit uses a round transformation unit with the same structure; the redundant obfuscated ciphertext first passes through the deobfuscation mechanism unit and then serves as the input of the third round of decryption. The decryption result is the redundant plaintext, and the decryption output result is the AND (&) operation of the plaintext and the redundant plaintext. If there is a fault, the output result is random. If there is no fault, the output result is the correct plaintext.

3. A symmetric encryption / decryption combination circuit based on an obfuscation mechanism capable of defending against fault attacks according to claim 1, characterized in that: The obfuscation mechanism unit includes a random number generator unit, a memory unit, a data filling unit and a substitution mechanism unit connected in sequence; The random number generator unit generates random numbers and puts them into the memory unit for use, fills them using the ISO23120 standard, takes out data of the required length from the memory unit and puts them into the encrypted data; the substitution mechanism unit replaces the filled data. ψ For a function that contains 12 defined operation instructions, enter ψ function, using the last round key of the symmetric block cipher as ψ The attacker can confuse the ciphertext by using the command of the key, so that the attacker cannot obtain the relationship between the key and the fault ciphertext.

4. A symmetric encryption / decryption combination circuit based on an obfuscation mechanism capable of defending against fault attacks according to claim 1, characterized in that: The deobfuscation mechanism unit includes a recovery mechanism unit and a data defilling unit; The recovery mechanism unit analyzes the received redundant obfuscated ciphertext. ψ −1 For a function that contains 12 defined operation instructions, enter ψ −1 function, using the last round key of the symmetric block cipher as ψ −1 Instructions are used to recover redundant obfuscated ciphertexts; The data de-filling unit removes the filled data according to the ISO23120 standard to obtain the decrypted redundant ciphertext.

5. A symmetric encryption / decryption combination circuit based on an obfuscation mechanism capable of defending against fault attacks according to claim 3, characterized in that: The input of the replacement mechanism unit is the encrypted data after data padding; the data passing through the replacement mechanism unit can reduce the correlation with the direct encryption result.

6. A symmetric encryption / decryption combination circuit based on an obfuscation mechanism capable of defending against fault attacks according to claim 4, characterized in that: The input of the recovery mechanism unit is the redundant obfuscated ciphertext and the obfuscated ciphertext; the data passed through the recovery mechanism unit can be used as the input data of the decryption circuit to restore the encrypted data.

Images