A lightweight key unit design method based on PCIe architecture

Abstract

The present invention relates to the technical field of file encryption, and specifically discloses a lightweight key unit design method based on PCIe architecture, including: data transmission architecture: realizing data transmission between PC end and FPGA end through PCIe interface; lightweight key storage unit design: using a multi-feedback ring oscillator as a key unit, and using the jitter formed by thermal noise in the oscillator circuit to generate a true random number sequence; encryption module design: using a control unit to retrieve a bin file and a key from an input FIFO module and a key input FIFO module respectively, encrypting the bin file through an algorithm unit, and outputting the encrypted bin file through a data output FIFO module. The hardware-based design of the present invention can better resist the influence of the external environment and ensure the stability of key generation and transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of file encryption, and in particular to a lightweight key unit design method based on PCIe architecture. Background Art

[0002] With the development of science and technology, FPGA is one of the control chips. The configuration file of FPGA chip is bin file, which contains the intellectual property and technical secrets of the designer. Therefore, encrypting bin file can prevent unauthorized persons or competitors from copying or tampering with the design on the one hand; on the other hand, it also increases the difficulty of reverse engineering, making it much more difficult to illegally obtain design details, thereby protecting the corresponding technical achievements inside the chip.

[0003] Existing algorithms for bin file encryption include AES and RSA, but the keys of these algorithms are generated by computers and usually have certain regularity, which can be easily predicted by attackers, resulting in the encrypted bin files being cracked. Summary of the invention

[0004] The purpose of the present invention is to provide a lightweight key unit design method based on PCIe architecture to solve the above technical problems.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] A lightweight key unit design method based on PCIe architecture includes the following steps:

[0007] Data transmission architecture: Data transmission between the PC and FPGA is realized through the PCIe interface. The PCIe link uses differential signal pairs for data transmission, and high-speed, full-duplex data exchange is achieved through Link.

[0008] Lightweight key storage unit design: A multi-feedback ring oscillator is used as a key unit, and the jitter formed by thermal noise in the oscillator circuit is used to generate a true random number sequence; the oscillator circuit is composed of an odd number of XOR gates connected in series. When one input end of the XOR gate is fixed to 0, the XOR gate is equivalent to a transmission gate, and the output is equal to the value of the other input end; when one input end of the XOR gate is fixed to 1, the XOR gate is equivalent to an inverter, and the output is equal to the inverse value of the other input end;

[0009] Encryption module design: The encryption module includes an input FIFO module, a key input FIFO module, a control unit, an algorithm unit and a data output FIFO module; the control unit retrieves the bin file and the key from the input FIFO module and the key input FIFO module respectively, encrypts the bin file through the algorithm unit, and outputs the encrypted bin file through the data output FIFO module.

[0010] As a further solution of the present invention: the PC terminal includes an XDMA driver and an XDMA library, wherein:

[0011] XDMA driver: used to initialize and manage PCIe devices, able to identify and configure FPGA devices connected to the system; handle interrupt signals from FPGA devices, map the registers and memory space of hardware devices to the host memory address space so that software can directly access and control the hardware;

[0012] XDMA library: used to provide a set of user-mode APIs so that applications can call DMA transfer functions.

[0013] As a further solution of the present invention: the specific steps of processing the interrupt signal from the FPGA device are as follows:

[0014] Interrupt configuration and initialization: When the XDMA driver is initialized, the XDMA driver registers an interrupt processing function with the system, and then configures the interrupt vector to ensure that the interrupt signal from the FPGA can be correctly transmitted to the host system;

[0015] Interrupt signal detection: When the FPGA device needs to report an event to the PC, a hardware interrupt signal is triggered, and the hardware interrupt signal is transmitted to the PC through the PCIe link; and when the system interrupt controller detects the hardware interrupt signal, the hardware interrupt signal is passed to the XDMA driver;

[0016] Interrupt processing function execution: the system calls the interrupt processing function registered by the XDMA driver and responds through the interrupt processing function;

[0017] Clear interrupt signal: After processing the interrupt event, clear the FPGA interrupt signal.

[0018] As a further solution of the present invention: in the data transmission architecture, the PCIe transmission architecture on the FPGA side uses the XDMA IP core as a bridge for communication between the PC and the FPGA, and uses the AXI interface to transmit the bin file. After the receiving engine receives the bin file, it puts the data into the FPGA on-chip memory BRAM;

[0019] And after the bin file is transmitted, the completion status is written into the status register in the control module using the AXI-Lite interface. The control module receives the completion signal and returns the status of receiving the file to the PC through the interrupt interface, thus forming a data interaction.

[0020] When the PC detects the signal that the bin file transfer is completed, it sends a start signal to the startup register in the control module through the AXI-Lite interface again, starts the key storage unit, and returns the encrypted bin file to the PC through the AXI interface through the encryption module.

[0021] As a further solution of the present invention: in the algorithm unit, the data length is obtained according to the encryption algorithm, the bin file retrieved from the input FIFO module is cut according to the data length, and encrypted in blocks.

[0022] As a further solution of the present invention: in the algorithm unit, the key length is obtained according to the encryption algorithm, and the keys retrieved from the key input FIFO module are combined according to the key length for encryption of the bin file after block division.

[0023] The beneficial effects of the present invention are as follows: the key comes from a real and uncertain physical source, which is extremely difficult to predict and restore, significantly improving the security of encrypted files. The hardware-based design is more resistant to the influence of the external environment and ensures the stability of key generation and transmission. Even if an attacker has mastered the algorithm and operation details, he cannot restore the key through reverse engineering, further enhancing the protection capability;

[0024] The PCIe architecture is used for key transmission, which greatly improves the speed compared to traditional communication methods. Even if only one lane is used, the transmission speed can reach 2.5GT / s, meeting the needs of efficient encryption and decryption. The PCIe architecture has good scalability, and the number of lanes can be increased according to needs to further improve the transmission speed;

[0025] The lightweight design allows for easy integration into various systems and adaptability to different application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The present invention will be further described below in conjunction with the accompanying drawings.

[0027] Figure 1 It is a schematic diagram of the overall structure of a lightweight key unit design method based on PCIe architecture of the present invention;

[0028] Figure 2 It is a schematic diagram of the PCIe transmission architecture based on FPGA of the present invention;

[0029] Figure 3It is a schematic diagram of the principle of the key unit of the present invention;

[0030] Figure 4 It is a schematic diagram of the principle of LUT6-2 of the present invention;

[0031] Figure 5 It is an implementation diagram of the CLB unit 1 in the key unit of the present invention;

[0032] Figure 6 It is an implementation diagram of the CLB unit 2 in the key unit of the present invention;

[0033] Figure 7 It is an implementation diagram of the CLB unit 3 in the key unit of the present invention;

[0034] Figure 8 It is an implementation diagram of the CLB unit 4 in the key unit of the present invention;

[0035] Fig. 9 It is the encryption module structure and signal flow chart of the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] See also Figure 1 As shown, the present invention is a lightweight key unit design method based on PCIe architecture, which is generally divided into three parts: the first part is the data transmission architecture based on PCIe; the second part is the key storage unit design; and the third part is the encryption module design.

[0038] 1. Data transmission architecture based on PCIe

[0039] (1) Data transmission between the PC and FPGA is connected through the PCIe (peripheral component interconnect express) interface. The PCIe link uses differential signal pairs for data transmission and realizes high-speed, full-duplex data exchange through the link. The XDMA driver and XDMA library are used on the PC to manage and control data transmission based on the PCIe interface. The XDMA driver is responsible for initializing and managing PCIe devices. It can identify and configure FPGA devices connected to the system; process interrupt signals from FPGA devices, and map the registers and memory space of hardware devices to the host memory address space so that the software can directly access and control the hardware. The XDMA library provides a set of user-mode APIs that allow applications to easily call DMA transfer functions. The API encapsulates the complexity of the underlying driver and provides a simple interface for data transmission operations. The storage unit is divided into two parts, one is the memory on the PC side; the other is the memory mapped by the FPGA device on the PC side. The memory on the PC side is mainly used to store bin files and control programs. The control unit is a graphical interface developed based on C++. By calling API functions, it can monitor the reading and writing of FPGA device memory and interrupts, thereby achieving high-performance, low-latency data transmission. Compared with transmission interfaces such as UART, USB and SPI, it can achieve high-speed data transmission.

[0040] (2) The PCIe transmission architecture on the FPGA side is as follows Figure 2 As shown, the present invention uses XDMA IP core as a bridge for communication between PC and FPGA, uses AXI interface to transmit bin files, and after receiving the bin file, the receiving engine puts the data into the FPGA on-chip memory BRAM. After the bin file is transmitted, the completion status is written to the status register in the control module using the AXI-Lite interface. The control module receives the completion signal and returns the status of the received file to the PC end through the interrupt interface, forming a data interaction. When the PC end detects the signal that the bin file transmission is completed, it sends a start signal to the start register in the control module through the AXI-Lite interface again to start the key storage unit. Finally, the encrypted bin file is returned to the PC end through the AXI interface through the encryption module.

[0041] Processing interrupt signals from FPGA devices is divided into the following four steps:

[0042] (1) Interrupt configuration and initialization: When the driver is initialized, the XDMA driver will register an interrupt processing function with the operating system and then configure the interrupt vector to ensure that the interrupt signal from the FPGA can be correctly transmitted to the host system;

[0043] (2) Interrupt signal detection: When the FPGA device needs to report an event to the PC, a hardware interrupt signal is triggered and transmitted to the PC through the PCIe link. At this time, the interrupt controller of the operating system detects the signal and passes it to the XDMA driver;

[0044] (3) Interrupt processing function execution: The operating system calls the interrupt processing function registered by the XDMA driver, which responds quickly to ensure the timeliness of interrupt processing;

[0045] (4) Clear interrupt signal: After processing the interrupt event, clear the FPGA interrupt signal to ensure that the system can continue to receive and process new interrupt signals.

[0046] 2. Design of lightweight key storage unit

[0047] (1) For encryption algorithms, the key is a vital component used to protect the confidentiality and security of encrypted files. The key is the original seed of the encryption algorithm, and its quality directly affects the security of the encryption system. Most of the existing key seeds are pseudo-random numbers generated by software. Since deterministic algorithms have a certain periodicity and predictability in the output sequence, attackers can easily deduce the key seed through known pseudo-random sequences. The key storage unit designed in the present invention is generated based on hardware and comes from an unpredictable physical source. The sequence it generates is a true random number. Attackers cannot deduce the key seed through algorithms and known sequences, thereby ensuring the security of the encryption system. The specific schematic diagram is shown as follows. Figure 3 As shown:

[0048] The key unit designed by the present invention is a configurable multi-feedback ring oscillator, which uses the jitter formed by thermal noise in the circuit to generate a true random number sequence. Its basic structure is composed of an odd number of XOR gates connected in series. When one input end of the XOR gate is fixed to 0, the XOR gate is equivalent to a transmission gate, and the output is equal to the value of the other input end; when one input end of the XOR gate is fixed to 1, the XOR gate is equivalent to an inverter, and the output is equal to the inverse value of the other input end. In this embodiment, the entire structure is divided into a forward channel X 2n,1 , X 2n-1,1 ...X 0,1 and feedback channel X 2n,2 , X 2n-1,2 ...X 0,2There are 4n+2 XOR gates in total. Assuming that the input of the forward channel is set to "1", all XOR gates in the forward channel are configured as inverters; the input of the XOR gate in the feedback channel is set to "0", and all are configured as transmission gates. In this configuration, oscillation analysis is performed: when the input is set to "1", assuming that the output out is "1" at that time, then through the action of the forward channel and the feedback channel, we can get X 0,2 The output of is "0", which is XORed with the input "1", and the output of X0 is "1". 1,2 The output of X1 is "1", and after XORing with the output of X0 "1", the output of X1 is "0". After several XOR gates, we can get X 2n-1 The output terminal is "0", because X 2n,2 Only one X 2n,1 The role of (inverter), we can get X 2n,2 The output is "0", so for X 2n For this XOR gate, the two input terminals are the same, and the final output is "0", which is opposite to the previously assumed output "1", forming an oscillation. Similarly, the output terminal at this time is "0", and after the action of the odd pair of forward channels and feedback channels, the next state of the output terminal can eventually be "1". This cycle goes on and on. Ideally, the output terminal out should be a square wave, but due to the presence of thermal noise in the circuit, any slight fluctuation will affect the output, making the output random. Compared with traditional ring oscillators, the multiple feedback structure in the present invention greatly increases the phase noise of the ring oscillator, expands the jitter range of the ring oscillator, and thus increases the probability of uncertain values. In addition, through the control unit on the PC side, the XOR gate in the feedback channel can be randomly configured as an inverter, and different circuits can be switched in a short time, which can increase the uncertainty of the entire circuit.

[0049] (2) In this embodiment, n is "2", that is, a 5-fold feedback ring oscillator. Then, the 4 groups of 5-fold feedback ring oscillators are sampled through a D flip-flop, and then XOR is performed. Finally, the XOR result is sampled through another D flip-flop and output to the encryption module. In the design in FPGA, a 6-input lookup table is used to implement the XOR gate. Figure 4The schematic diagram of LUT6-2 is shown. The LUT6 lookup table is essentially a 6-input Boolean function with a total of 64 storage cells inside. LUT6 searches for the value in the corresponding storage cell according to the combination of the current 6 input signals and outputs the value. When I5 is 1, LUT6-2 can be used as 2 LUT5s, that is, it can be configured as 2 two-input XOR gates. At this time, I0 and I1 serve as the input of the first XOR gate, and O5 serves as the output of the first XOR gate; I2 and I3 serve as the input of the second XOR gate, and O6 serves as the output of the second XOR gate. Therefore, for the key storage unit designed by the present invention, Figure 5-Figure 8 As shown, X 0,1 , X 0,2 , X 2n,1 , X 2n,2 The inputs are controlled by the PC terminal, and the same t terminals are connected to each other. As can be seen from the figure, the entire key unit only needs 31 LUT6s and 5 DFFs, which means consuming 4 CLBs (1 CLB contains 8 LUT6s and 16 DFFs). Compared with the ring oscillator formed by other methods, the hardware resource consumption is extremely low, and it is a lightweight key unit.

[0050] 3. Encryption module design

[0051] The encryption module in the present invention includes a data input FIFO module, a key input FIFO module, a control unit, an algorithm unit and a data output FIFO module. First, the data input FIFO and the key input FIFO are controlled by the control unit, and the two modules are respectively given control signals 1 and 2, and the data and key size desired by the encryption algorithm unit are read out. After the reading is completed, a read completion signal will be returned to the control unit, and the control unit will send a control signal 3 to the algorithm unit. The algorithm unit selects a suitable algorithm for encryption (the inverse operation of the encryption algorithm is selected in the decryption algorithm for decryption. The present invention focuses on the key unit design and is not repeated here), and the encrypted data is sent to the data output FIFO module. When the data output FIFO module receives the control signal 4, the completion signal and the encrypted bin file are output, and the data is finally sent to the PC end through the sending engine. When this product is released, only the encrypted bin file needs to be given to the other party, and the decryption process will be completed in the hardware, so that even if the attacker obtains the bin file through illegal means, there is no way to restore the original bin file through reverse engineering.

[0052] Figure 6The size of the input bin file is not fixed. Project A may generate an x-bit size, and project B may generate a y-bit size. However, through the data input FIFO, the x-bit or y-bit size can be cut into several N-bit data for block encryption.

[0053] Similarly, the input key is 1 bit in length, but it can be combined into the desired Mbit size through the key input FIFO.

[0054] The size of N and M depends on the selected encryption algorithm:

[0055] (1) If it is AES-128 encryption algorithm, the key length is 128 bits and the data is 128 bits;

[0056] (2) If it is the DES algorithm, the key length is 56 bits and the data is 64 bits.

[0057] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A lightweight key unit design method based on PCIe architecture, characterized in that: The following steps are involved: Data transmission architecture: Data transmission between the PC and FPGA is realized through the PCIe interface. The PCIe link uses differential signal pairs for data transmission, and high-speed, full-duplex data exchange is achieved through Link. Lightweight key storage unit design: A multi-feedback ring oscillator is used as a key unit, and the jitter formed by thermal noise in the oscillator circuit is used to generate a true random number sequence; the oscillator circuit is composed of an odd number of XOR gates connected in series. When one input end of the XOR gate is fixed to 0, the XOR gate is equivalent to a transmission gate, and the output is equal to the value of the other input end; when one input end of the XOR gate is fixed to 1, the XOR gate is equivalent to an inverter, and the output is equal to the inverse value of the other input end; Encryption module design: The encryption module includes an input FIFO module, a key input FIFO module, a control unit, an algorithm unit and a data output FIFO module; the control unit retrieves the bin file and the key from the input FIFO module and the key input FIFO module respectively, encrypts the bin file through the algorithm unit, and outputs the encrypted bin file through the data output FIFO module.

2. The method for designing a lightweight key unit based on PCIe architecture according to claim 1, characterized in that: The PC terminal includes an XDMA driver and an XDMA library, wherein: XDMA driver: used to initialize and manage PCIe devices, able to identify and configure FPGA devices connected to the system; handle interrupt signals from FPGA devices, map the registers and memory space of hardware devices to the host memory address space so that software can directly access and control the hardware; XDMA library: used to provide a set of user-mode APIs so that applications can call DMA transfer functions.

3. The method for designing a lightweight key unit based on PCIe architecture according to claim 2, characterized in that: The specific steps of processing the interrupt signal from the FPGA device are as follows: Interrupt configuration and initialization: When the XDMA driver is initialized, the XDMA driver registers an interrupt processing function with the system, and then configures the interrupt vector to ensure that the interrupt signal from the FPGA can be correctly transmitted to the host system; Interrupt signal detection: When the FPGA device needs to report an event to the PC, a hardware interrupt signal is triggered, and the hardware interrupt signal is transmitted to the PC through the PCIe link; and when the system interrupt controller detects the hardware interrupt signal, the hardware interrupt signal is passed to the XDMA driver; Interrupt processing function execution: the system calls the interrupt processing function registered by the XDMA driver and responds through the interrupt processing function; Clear interrupt signal: After processing the interrupt event, clear the FPGA interrupt signal.

4. The method for designing a lightweight key unit based on PCIe architecture according to claim 1, characterized in that: In the data transmission architecture, the PCIe transmission architecture on the FPGA side uses the XDMA IP core as a bridge for communication between the PC and the FPGA, and uses the AXI interface to transmit bin files. After the receiving engine receives the bin file, it puts the data into the FPGA on-chip memory BRAM; And after the bin file is transmitted, the completion status is written into the status register in the control module using the AXI-Lite interface. The control module receives the completion signal and returns the status of receiving the file to the PC through the interrupt interface, thus forming a data interaction. When the PC detects the signal that the bin file transfer is completed, it sends a start signal to the startup register in the control module through the AXI-Lite interface again, starts the key storage unit, and returns the encrypted bin file to the PC through the AXI interface through the encryption module.

5. The method for designing a lightweight key unit based on PCIe architecture according to claim 1, characterized in that: In the algorithm unit, the data length is obtained according to the encryption algorithm, and the bin file retrieved from the input FIFO module is cut according to the data length and encrypted in blocks.

6. The method for designing a lightweight key unit based on PCIe architecture according to claim 5, characterized in that: In the algorithm unit, the key length is obtained according to the encryption algorithm, and the keys retrieved from the key input FIFO module are combined according to the key length for encryption of the bin file after block division.

Images