Hardware AES-GCM method and system based on FPGA

Abstract

The invention relates to the technical field of hardware data encryption, and provides a hardware AES-GCM method and system based on an FPGA. A hardware AES-GCM system based on an FPGA is characterized in that a plurality of AES-GCM modules are deployed on an FPGA hardware chip, operations of the AES-GCM modules are mutually independent, and data transmission is not carried out; each AES-GCM module comprises a GCTR module and a GHASH module, at least two AES modules are integrated in the GCTR module, and the GCM module is realized by the GHASH module; and the GCTR module performs XOR operation on the generated ciphertext and the Hashkey and then inputs the ciphertext and the Hashkey into the GHASH module for authentication processing to generate a TAG label for checking whether the data can only be tampered or not in the encryption process. According to the invention, the security of data transmission is improved, and the data processing speed and transmission efficiency are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of hardware data encryption, and in particular to a hardware AES-GCM method and system based on FPGA. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] A Field-Programmable Gate Array (FPGA) is a programmable semiconductor device that allows designers to configure and reconfigure hardware logic after manufacturing. FPGA technology is very popular in electronic design and digital system design because it provides flexibility and customizability, allowing engineers to quickly develop and modify hardware designs as needed.

[0004] FPGAs can be reprogrammed by loading different configuration files (often called bitstreams), which allows them to be used in a variety of applications without having to design and manufacture new hardware each time. It is also possible to perform multiple operations simultaneously, which makes them ideal for applications that require high-speed parallel processing, such as digital signal processing, image processing, and communication systems. Due to the hardware parallelism of FPGAs, they can achieve very low data processing latency, which is critical for real-time systems and high-speed communications. FPGAs can be configured to perform specific tasks as needed, which makes them very useful in applications that need to quickly adapt to new technologies or changes in standards. At the same time, its design can be easily expanded to adapt to more complex system requirements.

[0005] FPGA design process: 1. Conceptual design: define the system requirements and specifications; 2. Hardware Description Language (HDL) Coding: Use hardware description languages ​​such as Verilog or VHDL to write the logic of the FPGA; 3. Simulation: Simulating the design on a computer to verify its function and performance; 4. Synthesis: Convert the HDL code into a logic netlist that the FPGA can understand; 5. Placement and routing: Map the logic netlist to the physical resources of the FPGA; 6. Programming: Download the generated bitstream file to the FPGA and configure its logic; 7. Testing: Test the FPGA on actual hardware to ensure it works as expected.

[0006] FPGAs are widely used in a variety of fields, including but not limited to: Communications: used for high-speed data transmission and signal processing. Military and aviation: used in radar systems, navigation systems, and communication equipment. Consumer electronics: used in video game consoles, digital televisions, and audio equipment. Industrial control: used in automated control systems and robotics. Automotive: used in advanced driver assistance systems (ADAS) and vehicle networks.

[0007] Advanced Encryption Standard (AES) is a symmetric key encryption algorithm used to protect the security of electronic data. AES is widely used in various occasions, including wireless networks, online transactions, data storage, and cloud computing. It is often used to protect sensitive information and ensure the security and integrity of data during transmission and storage.

[0008] Galois Counter Mode (GCM) is a block cipher mode of operation that 128 The binary Galois field of GF(2 128 ). In recent years, GCM has been incorporated into several standards, such as IETF RFC 4106 for secure encapsulation of security payloads and IEEE P1619.1 for authenticated encryption of storage devices.

[0009] AES-GCM encryption technology, which is a combination of AES and GCM, is an encryption method that uses 128, 192, and 256-bit key lengths and processes data with a block size of 128 bits. This encryption mode not only ensures the confidentiality of the data, but also provides authentication of data integrity and authenticity through the GCM mode. Due to its efficiency, security, and protection of data integrity, the AES-GCM encryption mode has been widely used in communications and data storage fields that require a high level of security, such as the security layer of the TLS / SSL protocol, virtual private networks (VPNs), data encryption for mobile devices, and various secure communication protocols. During the data transmission process of hardware, a common solution is to use an encryption method such as AES or GCM to encrypt data. This encryption method is limited by the limitations of the algorithm itself, and the data transmission security is not high. In addition, when the amount of data is large, it takes a long time to encrypt the data, and the transmission efficiency is low. Summary of the invention

[0010] In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides a hardware AES-GCM method and system based on FPGA. The present invention realizes real-time online encryption of data streams through an AES-GCM module. The module includes an AES core with the characteristics of a master core and a slave core, an AES-GCM parallel processing array, and a two-level pipeline structure of AES and GCM. To meet the network throughput requirement of 10Gbps. Test results show that the module can reach a processing speed of 12Gbps.

[0011] In order to achieve the above object, the present invention adopts the following technical solution: A first aspect of the present invention provides a hardware AES-GCM system based on FPGA.

[0012] A hardware AES-GCM system based on FPGA, deploying several AES-GCM modules on the FPGA hardware chip, each AES-GCM module operates independently of each other, and does not transmit data; Among them, each AES-GCM module includes a GCTR module and a GHASH module, at least two AES modules are integrated inside the GCTR module, and the GCM module is implemented by a GHASH module; the GCTR module performs an XOR operation on the ciphertext and Hash_key it generates and inputs them into the GHASH module for authentication processing, and generates a TAG tag to verify whether the data has been tampered with during the encryption process.

[0013] Furthermore, the operations of the AES module and the GCM module are independent of each other, and the structures adopt an array design structure.

[0014] Furthermore, the array design structure is as follows: when the AES module transmits the output result to the GCM module for processing, the AES module continues to process the next batch of data.

[0015] Furthermore, each of the AES modules is responsible for the encryption or decryption task of a portion of the data.

[0016] Furthermore, each AES module is expanded from a single channel to four channels.

[0017] Furthermore, the AES modules work in parallel, sharing the same key, initialization vector and counter.

[0018] Furthermore, each of the GCM modules includes a plurality of GF multipliers.

[0019] Furthermore, each of the AES modules is used to perform byte replacement, row shift, column mixing and round key addition operations.

[0020] Furthermore, each of the AES-GCM modules has independent encryption and decryption functions.

[0021] A second aspect of the present invention provides a method of an FPGA-based hardware AES-GCM system as described in the first aspect.

[0022] A set of input data is divided into blocks, and different data blocks enter different AES-GCM modules of the array for processing; In an AES-GCM module, the two four-channel AES cores contained in the GCTR function are used to process the AES encryption of data, and the GHASH function is used to encrypt and authenticate the AES-encrypted data; at the same time, the GCTR and GHASH functions form a two-level pipeline to process the data entering the AES-GCM module.

[0023] Compared with the prior art, the present invention has the following beneficial effects: Based on Xilinx Kintex UltraScale series FPGA, the present invention designs an efficient AES-GCM encryption module to realize real-time online encryption of data streams. The module includes an AES core with the characteristics of a master core and a slave core, an AES-GCM parallel processing array, and a two-level pipeline structure of AES and GCM. To meet the network throughput requirement of 10Gbps. Test results show that the module can achieve a processing speed of 12Gbps.

[0024] The present invention designs a multi-AES core structure with the characteristics of a master core and a slave core, which can not only efficiently perform AES encryption tasks, but also achieve higher data processing capabilities and security through the collaborative work between the master and slave cores. The design of this multi-core structure allows each core to work independently while cooperating with each other, thereby performing well in processing large amounts of data.

[0025] The present invention designs an AES-GCM parallel processing array, which is composed of multiple independent AES-GCM modules. These modules can perform data encryption and authentication at the same time, greatly improving the processing speed. Each module can independently complete the AES encryption and GCM authentication tasks, thereby achieving true parallel processing. This design not only improves the overall performance of the system, but also can effectively cope with high-concurrency scenarios and ensure the security and integrity of data.

[0026] The present invention designs a two-level pipeline structure of AES and GCM, which separates the AES encryption process from the GCM authentication process. After AES processes the first batch of data, while GCM calculates the authentication result, AES continues to process the next batch of data. This pipeline design allows the two processes to be carried out in parallel, greatly improving the overall processing efficiency. In this way, the system can achieve higher data throughput while ensuring data security, meeting the needs of high-performance application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0028] Figure 1 It is the main flow chart of AES encryption and decryption shown in the present invention; Figure 2 It is a matrix conversion flow chart shown in the present invention; Figure 3 It is a schematic diagram of key expansion shown in the present invention; Figure 4 It is a key expansion flow chart shown in the present invention; Figure 5 is a byte substitution flow chart shown in the present invention; Figure 6 is a schematic diagram of row shifting shown in the present invention; Figure 7 is a schematic diagram of retrograde displacement shown in the present invention; Figure 8 is a schematic diagram of a GCTR module shown in the present invention; Fig. 9 It is a flow chart of the GCM encryption process shown in the present invention; Fig.10 It is a flow chart of the GCM decryption process shown in the present invention; Fig.11 Schematic diagram of AES-GCM extension shown in the present invention; Fig.12 is a schematic diagram showing the relationship between U1 and U2 of the present invention; Fig.13 is a schematic diagram of an AES-GCM processing array shown in the present invention; Fig.14 It is a schematic diagram of the parallel structure of GCTR and GHASH calculation shown in the present invention; Fig.15 It is a schematic diagram of the two-level pipeline structure of GCTR and GHASH shown in the present invention. DETAILED DESCRIPTION

[0029] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0030] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0031] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0032] Embodiment 1 like Figure 1 As shown, this embodiment provides a hardware AES-GCM system based on FPGA.

[0033] A hardware AES-GCM system based on FPGA, deploying several AES-GCM modules on the FPGA hardware chip, each AES-GCM module operates independently of each other, and does not transmit data; Among them, each AES-GCM module includes a GCTR module and a GHASH module, at least two AES modules are integrated inside the GCTR module, and the GCM module is implemented by a GHASH module; the GCTR module performs an XOR operation on the ciphertext and Hash_key it generates and inputs them into the GHASH module for authentication processing, and generates a TAG tag to verify whether the data has been tampered with during the encryption process.

[0034] In some embodiments, the operations of the AES module and the GCM module are independent of each other and the structure adopts an array design structure.

[0035] In some embodiments, the array design structure is: when the AES module transmits the output result to the GCM module for processing, the AES module continues to process the next batch of data.

[0036] In some embodiments, each of the AES modules is responsible for encryption or decryption of a portion of data.

[0037] In some embodiments, each AES module is expanded from a single channel to four channels.

[0038] In some embodiments, the AES modules operate in parallel, sharing the same key, initialization vector, and counter.

[0039] In some embodiments, each of the GCM modules includes a plurality of GF multipliers.

[0040] In some embodiments, each of the AES modules is configured to perform byte substitution, row shift, column mix, and round key addition operations.

[0041] In some embodiments, each of the AES-GCM modules has independent encryption and decryption functions. Specifically, the AES algorithm, the GCM algorithm, and the parallel AES-GCM structure are described in detail below: 1. AES algorithm AES is an algorithm that uses block encryption technology. It divides plaintext data into fixed-length data blocks, and then encrypts each data block in turn until the entire plaintext is completely encrypted. AES supports three key lengths: 128 bits, 192 bits, or 256 bits. Different encryption rounds are recommended for different key lengths. Generally speaking, the more encryption rounds, the stronger the security provided, but it also increases the time required for encryption processing. Table 1 shows the corresponding relationship between key lengths and the corresponding recommended encryption rounds.

[0042] Table 1 Correspondence between key, block and round number

[0043] The AES encryption algorithm mainly consists of four operations: byte replacement, row shift, column mixing and round key addition. In addition, the original key needs to be expanded. Take the 10-round encryption process as an example: first, the plaintext performs a round of round key addition operation; then, nine rounds of byte replacement, row shift, column mixing and round key addition are performed in a cycle; finally, the column mixing step is omitted in the tenth round. The main process of AES encryption and decryption is as follows: Figure 3 As shown in the figure. W[0,3] refers to the 128-bit key composed of W[0], W[1], W[2] and W[3] in series. The round functions of the first to ninth rounds of encryption are the same, including four operations: byte substitution, row shift, column mixing and round key addition. The last round of iteration does not perform column mixing. In addition, before the first round of iteration, the plaintext and the original key are first XORed.

[0044] at the same time, Figure 1 The AES decryption process is also shown. The decryption process still consists of 10 rounds, and each round is the inverse of the encryption operation. Since the four rounds of AES are reversible, a round of decryption operation is to sequentially perform reverse shift, reverse byte substitution, round key addition, and reverse column mixing. Similar to the encryption operation, the last round does not perform reverse column mixing, and a key addition operation must be performed before the first round of decryption.

[0045] The 128-bit input plaintext block P is divided into 16 bytes, represented as P = P0, P1 ... P15. Usually, the plaintext block is described by a square matrix with bytes as units. This matrix is ​​called the state matrix. In each iteration of the algorithm, the content of the state matrix is ​​continuously updated, and the final result is the ciphertext output. In this matrix, the bytes are arranged in a top-to-bottom, left-to-right order, as shown in the following figure. Figure 2 shown.

[0046] Assuming that a 128-bit key is used, the input key K is also divided into 16 bytes, represented by K = K0, K1... K15, and is also described by a key matrix in bytes. The key matrix is ​​expanded into a sequence of 44 words W[0], W[1], ..., W

[43] through the key scheduling function. The first 4 elements of the sequence W[0], W[1], W[2], W[3] are the original keys, which are used for the initial key addition in the encryption operation. The following 40 words are divided into 10 groups, each with 4 words (128 bits) used for the round key addition in 10 rounds of encryption operations, such as Figure 3 shown.

[0047] The specific process of key expansion is to first convert the 16-byte initial key into 4 32-bit words by column, namely W[0], W[1], W[2], W[3], and then calculate 10 groups of extended keys, W[i], i=4...43, through W[0], W[1], W[2], W[3]. Figure 4 The specific expansion rules are as follows: 1) If i is not a multiple of 4, then the i column is determined by the following equation: w[i] = w[i-4]⊕ w[i-1]; 2) If i is a multiple of 4, then the i-th column is determined by the following equation: w[i] = w[i-4] ⊕ T(w[i-1]).

[0048] Algorithm T consists of three parts: word loop, byte substitution, and round constant XOR. Word loop means cyclically shifting the 4 bytes in a word by 1 byte. Byte substitution uses an S-box to perform byte substitution on the result of word loop, and round constant XOR is to XOR the results of the first two steps with the round constant Rcon[j], where j represents the round number, where Rcon is a fixed one-dimensional array with a value of Rcon = {00, 01, 02, 04, 08, 10, 20, 40, 80, 1B, 36}.

[0049] In the AES encryption algorithm, the byte substitution process is actually a lookup table operation. The algorithm specifies an S-box (substitution box) and its inverse counterpart, the inverse S-box. Each element in the state matrix is ​​mapped to a new byte by using the upper 4 bits of the byte as the row index and the lower 4 bits as the column index, and then selecting the corresponding element from the S-box or the inverse S-box as the output result.

[0050] For example, when encrypting, the output byte is 0x2, then the 0x02 row and 0x06 column of the S box are checked to get the value 0x3f, and then the original 0x26 is replaced with 0x3f. Figure 5 shown.

[0051] like Figure 6 As shown, the shift is a left circular shift operation. When the key length is 128 bits, the 0th row of the state matrix is ​​shifted left by 0 bytes, the 1st row is shifted left by 1 byte, the 2nd row is shifted left by 2 bytes, and the 3rd row is shifted left by 3 bytes.

[0052] like Figure 7 As shown, the transformation of the reverse shift is to perform the opposite shift operation on each row in the state matrix, the 0th row of the state matrix is ​​shifted right by 0 bytes, the 1st row is shifted right by 1 byte, the 2nd row is shifted right by 2 bytes, and the 3rd row is shifted right by 3 bytes.

[0053] The column mixing transformation is achieved by matrix multiplication. The state matrix after row shifting is multiplied with the fixed matrix to obtain the confused state matrix, which is defined as follows:

[0054] The inverse column-mixing transform can be defined by the following matrix multiplication:

[0055] Where 0 ≤ c ≤ Nb, Nb is the packet data length. It can be verified that the product of the inverse transformation matrix and the forward transformation matrix is ​​exactly the unit matrix; the column mixing input is a 4x4 state matrix. - , where each element is a byte. This matrix is ​​actually another way of representing a word (128 bits). - Represents the state matrix after transformation.

[0056] 2. GCM algorithm Let n and u denote a unique pair of positive integers such that the total number of bits in the plaintext is (n−1)*128+u, where 1 ≤ u≤ 128. The plaintext consists of a sequence of n bit strings, where the bit length of the last bit string is u and the bit lengths of the other bit strings are 128. The sequence is denoted as P1, P2, ..., Pn-1, Pn. Similarly, the ciphertext is denoted as C1, C2, ..., Cn-1. The additional Au in the authentication data A is denoted as A1, A2, ..., Am-1, A, where the last bit string A can be a partial block of length v, and m and v denote a unique pair of positive integers such that the total number of bits in A is (m - 1)128 + v and 1 ≤v ≤ 128. The authenticated encryption operation is defined as follows:

[0057] This part is divided into the encryption part and the data integrity verification. The two main functions used in GCM are block cipher encryption and the GF(2 128 ). The block cipher encryption of value X with key K is recorded as E(K, X). Two elements X, Y∈GF(2 128 ) is denoted as X·Y, and the addition of X and Y is denoted as X⊕Y. Addition in this field is equivalent to a bitwise XOR operation. The function len() returns a 64-bit string containing a non-negative integer describing the median of its argument, with the least significant bit on the right. Expression 0 t Represents a string consisting of t 0 bits, and A||B represents the concatenation of two bit strings A and B. Function MSB t (S) returns a bit string containing only the leftmost t bits of S. The symbol {} indicates a bit string of length zero. Use the incr() function to generate consecutive counter values. This function treats the rightmost 32 bits of its argument as a nonnegative integer with the least significant bit on the right and appends that value to the 2 32 Modulo increase. More formally, the value of incr(F||I) is F||(i + 1 mod 2 32 ). The authentication tag T has a length between 0 and 128. The length of the tag is t.

[0058] The AES-GCM module relies on the GCTR encryption module and the GHASH implementation module. The GCTR encryption module is a high-performance encryption module that implements the GCTR mode based on the AES algorithm and can handle the encryption of 8 data blocks at the same time. The module includes control signal processing, data input and output, internal state machine, AES core instantiation, and input and output multiplexing logic. It supports the input of initialization vector (IV), key and its length, as well as the processing of special hash keys and Y0 values. It controls the data flow and encryption process through a finite state machine.

[0059] The GHASH function receives eight 128-bit ciphertext blocks and the corresponding Y values, combines them with the hash key through an XOR operation, then calls the GF multiplier module to perform finite field multiplication, and finally outputs eight 128-bit Y values ​​and a valid signal for the authentication step in the GCM encryption algorithm.

[0060] The encryption part is the GCTR encryption module. The data integrity verification part is the GHASH module, such as Figure 8 shown.

[0061] The data encryption module mainly implements the encryption operation of the input plaintext data through the AES symmetric encryption algorithm, and is responsible for encrypting the plaintext data into ciphertext to ensure the security of the data. The GHASH module converts the ciphertext encrypted by the GCTR encryption algorithm into GF(2 128 ) is multiplied by the Hash Key. Finally, a tag TAG is generated to verify whether the data has been tampered with during the encryption process. The process is as follows: Fig. 9 As shown, P-1 and P-2 are plaintext, and C-1 and C-2 are ciphertext.

[0062] The authenticated decryption operation is similar to the encryption operation, but the order of the hashing step and the encryption step is reversed. The definition is as follows:

[0063] like Fig.10 As shown, the tag T' calculated by the decryption operation is compared with the tag T associated with the ciphertext C. If the two tags match (length and value), the ciphertext is returned. In the figure, P-1 and P-2 are plaintexts, and C-1 and C-2 are ciphertexts.

[0064] In this specific context, each element is defined as a vector of 128 bits. To describe this concept in more detail, each element can be represented as a sequence of 128 binary bits. Specifically, an element X can be described as a sequence of 128 bits, i.e., X0, X1, X2, ..., X 126 , X 127 Here, X0 represents the leftmost bit, and X 127 Represents the rightmost bit.

[0065] Next, the special element R used in the multiplication operation is explained in detail. This element is defined as a string consisting of 16 characters, specifically "11100001||0120". The "||" symbol here indicates that this is an element composed of two parts, where "11100001" is the first 8 bits and "0120" is the last 8 bits. Therefore, the entire element R can be understood as a binary sequence consisting of 16 characters.

[0066] In addition, the function rightshift() needs to be described in detail. This function shifts the bits of its argument one position to the right. Specifically, if there is a parameter V and the function rightshift(V) is called, the result W will be a new 128-bit vector. In this new vector, each bit W i (where 1 ≤ i ≤ 127) will be equal to bit V in the original vector V i−1 In other words, each bit is shifted right by one bit. The rightmost bit W0 will be set to 0 to fill the vacancy created by the right shift operation. In this way, the function rightshift() implements the function of shifting each bit of a 128-bit vector right by one bit, GF(2 128 ) is as follows: (1) Initialize Z to 0 and V to be a copy of X.

[0067] (2) For each i from 0 to 127 (128 iterations in total): a. Check whether the current lowest bit (i.e., bit i) of Y is 1.

[0068] b. If the i-th bit of Y is 1, perform an XOR operation (XOR) on Z and V to update the value of Z. c. Check whether the highest bit of V (i.e. the 128th bit) is 0.

[0069] d. If the highest bit of V is 0, shift V right by one bit (equivalent to dividing by 2).

[0070] e. If the highest bit of V is not 0, shift V right by one bit and perform an XOR operation with a predefined "R" value to update the value of V.

[0071] (3) After the loop ends, the value of Z is returned, which is the value of X and Y in GF(2 128 ) domain.

[0072] 3. Parallel AES-GCM structure Because a single AES core has a performance bottleneck on the Kintex UltraScale series FPGA devices, especially when performing GF(2 128) module, it takes 128 clock cycles to complete. This is particularly true when dealing with high-speed infinite bandwidth networks, as these networks typically need to support a high throughput of 10Gbps. To meet this demand, parallelization technology is used in AES encryption and GHASH hash functions. Through parallel processing, multiple computing tasks can be performed simultaneously, significantly improving overall performance. Specifically, multiple AES cores can be deployed on the FPGA, with each core responsible for the encryption or decryption of a portion of the data. In this way, GF(2 128 ) module calculations can be distributed to multiple cores for parallel execution, and 128 clock cycles can process multiple parts of data at the same time, greatly shortening the total processing time. In addition, by parallelizing the GHASH function, higher efficiency can also be achieved when processing data integrity verification.

[0073] The AES core is expanded to 4 channels, so that it can process four 128-bit data blocks simultaneously. With this expansion, Fig.11 As shown in the figure, the entire AES-GCM module has been upgraded from the original single-channel single AES core to an efficient structure with 8 channels and 2 AES cores. This improvement has significantly increased the theoretical processing speed from the original 0.2Gbps to 1.6Gbps. In addition, in order to further improve the processing capability, a GCTR module integrates 2 AES cores, thus ensuring higher data processing efficiency and stronger encryption performance.

[0074] In addition, the two AES cores U1 and U2 work in parallel logically. They share the key, initialization vector (IV) and counter, but process different data blocks separately. This design enables the system to encrypt or decrypt multiple data blocks at the same time, thus significantly improving the processing efficiency. Fig.12 As shown. Specifically, AES cores U1 and U2 work together when performing encryption or decryption tasks, but each processes the data blocks assigned to them independently. Since they share the same key, IV, and counter, they can maintain data consistency and security. This parallel processing mechanism enables the system to process more data at the same time, thereby greatly improving the overall processing speed and efficiency. In this way, the system can better cope with the encryption or decryption needs of large amounts of data and ensure the efficiency and real-time nature of data processing.

[0075] The top-level module receives the key_len signal from the outside world and passes the key length key_len to the U2 instance. In AES encryption, the key length determines the behavior of the key scheduling algorithm. The key_ready signal is passed from the U1 instance to the U2 instance to indicate whether the key is ready. The keymem_sboxw signal passes the result of the S-box (Substitution-Box) write operation to the U2 instance. In the AES key scheduling process, the S-box is used to perform nonlinear transformations on the key bytes, which are calculated during the key expansion process and used to generate round keys. The round_key signal passes the generated round key round_key to the U2 instance. This signal indicates whether the key scheduling has been completed and the AES core is ready for encryption or decryption operations.

[0076] Among them, the value of keymem_sboxw comes from the output of the key expansion module. The key expansion is responsible for generating round keys based on the input key and key length and the initialization signal, and outputting these round keys and related S-box values. Specifically, keymem_sboxw is a 32-bit wide signal output by the key expansion module, which represents one of the S-box values ​​used in the AES algorithm. These S-box values ​​are used for subsequent byte substitution operations and are one of the key steps in the AES algorithm. round_key is a 128-bit wide signal output by the key expansion module, which represents the current round key and is used for round key addition operations in the AES algorithm.

[0077] In order to further improve the weak scalability, the present invention designs an efficient AES-GCM processing array. This array consists of 8 independent AES-GCM modules, each of which can process data independently. Through this design, the speed and efficiency of data processing can be significantly improved. Specifically, each AES-GCM module can perform AES encryption and GCM authentication operations, thereby achieving high-speed data processing. The theoretical processing speed of the entire array can reach about 12.5-12.8Gbps. This means that in practical applications, the present invention can process a large amount of data without bottlenecks. This design not only improves the speed of data processing, but also has good scalability. Since each module is independent, the present invention can further improve the processing speed by adding more modules. This weak scalability enables our system to flexibly respond to different application scenarios and requirements.

[0078] The present invention uses the AES-GCM module to specifically demonstrate Fig.13The encryption array in the embodiment of the present invention includes eight independent AES-GCM encryption and decryption modules, which have two independent encryption and decryption functions. In the figure, the present invention indicates whether the next switch or node should decrypt or re-encrypt the data through a control signal Enc or Dec. In the program, this control signal is represented by a 4-bit control signal Ctrl, in which the third bit is used to indicate decryption (1) or encryption (0). In addition, the first bit of Ctrl is used to control whether the AES-GCM module is enabled.

[0079] Given that the GHASH function of GCM uses a 128-bit finite field multiplier, and after in-depth research on finite field multipliers, it is known that the unit with the largest resource consumption in the GCM system is the finite field multiplier, and its performance has become one of the limiting factors of the overall system performance. In view of the progress of elliptic curve cryptography and the demand for various cryptographic algorithms, finite field multipliers have always been the focus and challenge in the field of cryptographic hardware research. In order to adapt to resource-constrained environments, it is particularly necessary to solve the problem of excessive resource consumption of finite field multipliers.

[0080] Previously, the prior art has attempted to 128 ) module. For example, the multiplication and modular reduction steps of finite field multiplication are combined through matrix methods, and the reduction matrix formula in the new PB form is derived. Based on this, a finite field multiplier scheme with low complexity bit parallel architecture based on PB is proposed. Although this scheme can complete two 128-bit input finite field multiplications in a single cycle, it consumes 7261 lookup tables (LUTs). For another example, a GF(2 128 ) multiplier, and proposed a single-cycle parallelization and four-cycle serialization multiplier scheme to reduce hardware overhead. After Vivado synthesis, the multiplier of this structure still consumes 8319 lookup tables (LUTs).

[0081] Although the above scheme can significantly reduce GF(2 128 ) multiplier calculation cycle, but its resource consumption is large, and it is difficult to meet the requirements of lightweight AES-GCM encryption module for on-chip area. Therefore, the present invention decides to make the operations of AES and GCM independent of each other, and still adopts array design in structure. Fig.14 As shown, the ciphertext C generated by GCTR is XORed with Hash_key and then input into the GHASH function. The calculated intermediate value ghash_result is output again and XORed with the next batch of ciphertexts until all data are processed.

[0082] like Fig.15As shown in the figure, a two-level pipeline is used in the process to realize parallel data processing of AES and GCM, thereby reducing the overall time cost as much as possible. The GCTR module passes the encrypted ciphertext to the GHASH function. While the GHASH function calculates and generates TAG, the GCTR module continues to process subsequent data; and after all data are processed, the GHASH function returns a TAG for the receiver to check whether the data is correct.

[0083] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A hardware AES-GCM system based on FPGA, characterized in that: Several AES-GCM modules are deployed on the FPGA hardware chip. The operation of each AES-GCM module is independent of each other and no data transmission is performed. Among them, each AES-GCM module includes a GCTR module and a GHASH module, at least two AES modules are integrated inside the GCTR module, and the GCM module is implemented by a GHASH module; the GCTR module performs an XOR operation on the ciphertext and Hash_key it generates and inputs them into the GHASH module for authentication processing, and generates a TAG tag to verify whether the data has been tampered with during the encryption process.

2. The FPGA-based hardware AES-GCM system according to claim 1, characterized in that: The operations of the AES module and the GCM module are independent of each other, and the structure adopts an array design structure.

3. The FPGA-based hardware AES-GCM system according to claim 2, characterized in that: The array design structure is as follows: when the AES module transmits the output result to the GCM module for processing, the AES module continues to process the next batch of data.

4. The FPGA-based hardware AES-GCM system according to claim 1, characterized in that: Each of the AES modules is responsible for the encryption or decryption of a portion of data.

5. The FPGA-based hardware AES-GCM system according to claim 1, characterized in that: Expand each AES module from single channel to four channels.

6. The FPGA-based hardware AES-GCM system according to claim 1, characterized in that: The AES modules work in parallel, sharing the same key, initialization vector and counter.

7. The FPGA-based hardware AES-GCM system according to claim 1, characterized in that: Each of the GCM modules includes a plurality of GF multipliers.

8. The FPGA-based hardware AES-GCM system according to claim 1, characterized in that: Each of the AES modules is used to perform byte substitution, row shift, column mixing and round key addition operations.

9. The FPGA-based hardware AES-GCM system according to claim 1, characterized in that: Each of the AES-GCM modules has independent encryption and decryption functions.

10. A method of a hardware AES-GCM system based on FPGA as claimed in any one of claims 1 to 9, characterized in that: include: A set of input data is divided into blocks, and different data blocks enter different AES-GCM modules of the array for processing; In an AES-GCM module, the two four-channel AES cores contained in the GCTR function are used to process the AES encryption of data, and the GHASH function is used to encrypt and authenticate the AES-encrypted data; at the same time, the GCTR and GHASH functions form a two-level pipeline to process the data entering the AES-GCM module.

Images