Encryption circuit, decryption circuit, chip, and electronic device

Abstract

The invention discloses an encryption circuit, a decryption circuit, a chip and electronic equipment, and belongs to the technical field of security. Taking the encryption circuit as an example, the encryption circuit comprises an encryption operation module and an error detection module; the encryption operation module is used for executing at least two times of encryption operation on the input first data to obtain at least two pieces of encrypted second data; and the error detection module is used for comparing whether the at least two pieces of second data are consistent or not, and determining that error injection exists in the encryption operation process under the condition that the at least two pieces of second data are inconsistent. According to the encryption circuit, whether error injection exists in the encryption operation process or not is detected by executing encryption operation for multiple times and comparing whether encryption results executed for multiple times are consistent or not, so that the encryption circuit has the capability of detecting error injection, and the encryption safety is improved.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to an encryption circuit, a decryption circuit, a chip and an electronic device. Background Art

[0002] The data is encrypted and transmitted through the encryption circuit, so that the recipient with the key can correctly decrypt the data through the decryption circuit, which can ensure the security of data transmission. Among them, the data before encryption is plain text, and the data after encryption is cipher text. However, in the process of the encryption circuit performing the encryption operation, or in the process of the decryption circuit performing the decryption operation, there may be malicious errors injected from the outside world. By analyzing the cipher text after the injection of the error, some information of the plain text or the key can be inferred, which poses a security risk.

[0003] Therefore, how to enable an encryption circuit or a decryption circuit to have the ability to detect external error injection is an urgent problem to be solved. Summary of the invention

[0004] The present application provides an encryption circuit, a decryption circuit, a chip and an electronic device, which have the ability to detect external error injection. The technical solution is as follows:

[0005] On the one hand, an encryption circuit is provided, which includes: an encryption operation module and an error detection module; the encryption operation module is used to perform at least two encryption operations on input first data to obtain at least two encrypted second data; the error detection module is used to compare whether the at least two second data are consistent, and when the at least two second data are inconsistent, determine that error injection exists in the encryption operation process.

[0006] In a possible implementation, the encryption operation includes a first-half-round encryption operation and a second-half-round encryption operation, the encryption operation module includes a first encryption submodule and a second encryption submodule, and the error detection module includes a first comparator and a second comparator; the first encryption submodule is used to perform the first-half-round encryption operation on the first data at least twice to obtain at least two first-half-round encryption results; the first comparator is used to compare whether the at least two first-half-round encryption results are consistent; the second encryption submodule is used to perform the second-half-round encryption operation on the at least two first-half-round encryption results respectively to obtain at least two second-half-round encryption results; the second comparator is used to compare whether the at least two second-half-round encryption results are consistent.

[0007] In one possible implementation, the encryption operation includes multiple rounds of encryption sub-operations, and the encryption operation module is used to perform each round of encryption sub-operations in the multiple rounds of encryption sub-operations on the first data at least twice to obtain at least two encryption sub-results of each round of encryption sub-operations; the error detection module is used to compare whether the at least two encryption sub-results of each round of encryption sub-operations are consistent, and when the at least two encryption sub-results of any round of encryption sub-operations are inconsistent, determine that error injection exists in the encryption operation process.

[0008] In a possible implementation, each round of encryption sub-operation includes a first half-round encryption operation and a second half-round encryption operation, the encryption operation module includes a first encryption sub-module and a second encryption sub-module, and the error detection module includes a first comparator and a second comparator; the first encryption sub-module is used to execute the first half-round encryption operation in each round of encryption sub-operation at least twice to obtain at least two first half-round encryption sub-results of each round of encryption sub-operation; the first comparator is used to compare whether the at least two first half-round encryption sub-results of each round of encryption sub-operation are consistent; the second encryption sub-module is used to execute the second half-round encryption operation in each round of encryption sub-operation at least twice to obtain at least two second half-round encryption sub-results of each round of encryption sub-operation; the second comparator is used to compare whether the at least two second half-round encryption sub-results of each round of encryption sub-operation are consistent.

[0009] In a possible implementation manner, the error detection module further includes at least one of a first demultiplexer and a second demultiplexer, and further includes a third register when the first demultiplexer is included, and further includes a fourth register when the second demultiplexer is included;

[0010] The first demultiplexer is used to assign the first half round encryption sub-result of the first execution to the third register when the first encryption submodule executes the first half round encryption operation for the first time; and to send the first half round encryption sub-result of the second execution to the first comparator when the first encryption submodule executes the first half round operation for the second time; the first comparator is used to compare whether the first half round encryption sub-result of the second execution is consistent with the value of the third register;

[0011] The second multiplexer is used to assign the second-half-round encryption sub-result executed for the first time to the fourth register when the second encryption sub-module executes the second-half-round encryption operation for the first time; and to send the second-half-round encryption sub-result executed for the second time to the second comparator when the second encryption sub-module executes the second-half-round encryption operation for the second time; and the second comparator is used to compare whether the second-half-round encryption sub-result executed for the second time is consistent with the value of the fourth register.

[0012] In a possible implementation manner, the error detection module is further configured to issue a fault warning message when it is determined that error injection exists during the encryption operation.

[0013] In a possible implementation manner, the encryption operation is an encryption operation based on AES (Advanced Encryption Standard).

[0014] On the other hand, a decryption circuit is provided, which includes: a decryption operation module and an error detection module; the decryption operation module is used to perform at least two decryption operations on the input second data to obtain at least two first data after decryption; the error detection module is used to compare whether the at least two first data are consistent, and when the at least two first data are inconsistent, determine that error injection exists during the decryption operation.

[0015] In one possible implementation, the decryption operation includes a first-half-round decryption operation and a second-half-round decryption operation, the decryption operation module includes a first decryption submodule and a second decryption submodule, and the error detection module includes a first comparator and a second comparator; the first decryption submodule is used to perform the first-half-round decryption operation on the second data at least twice to obtain at least two first-half-round decryption results; the first comparator is used to compare whether the at least two first-half-round decryption results are consistent; the second decryption submodule is used to perform the second-half-round decryption operation on the at least two first-half-round decryption results respectively to obtain at least two second-half-round decryption results; the second comparator is used to compare whether the at least two second-half-round decryption results are consistent.

[0016] In a possible implementation, the decryption operation includes multiple rounds of decryption sub-operations, and the decryption operation module is used to perform each round of decryption sub-operations in the multiple rounds of decryption sub-operations on the second data at least twice to obtain at least two decryption sub-results of each round of decryption sub-operations; the error detection module is used to compare whether the at least two decryption sub-results of each round of decryption sub-operations are consistent, and when the at least two decryption sub-results of any round of decryption sub-operations are inconsistent, determine that error injection exists in the decryption operation process.

[0017] In a possible implementation, each round of decryption sub-operation includes a first-half-round decryption operation and a second-half-round decryption operation, the decryption operation module includes a first decryption sub-module and a second decryption sub-module, and the error detection module includes a first comparator and a second comparator; the first decryption sub-module is used to execute the first-half-round decryption operation in each round of decryption sub-operation at least twice to obtain at least two first-half-round decryption sub-results of each round of decryption sub-operation; the first comparator is used to compare whether the at least two first-half-round decryption sub-results of each round of decryption sub-operation are consistent; the second decryption sub-module is used to execute the second-half-round decryption operation in each round of decryption sub-operation at least twice to obtain at least two second-half-round decryption sub-results of each round of decryption sub-operation; the second comparator is used to compare whether the at least two second-half-round decryption sub-results of each round of decryption sub-operation are consistent.

[0018] In a possible implementation manner, the error detection module further includes at least one of a first demultiplexer and a second demultiplexer, and further includes a third register when the first demultiplexer is included, and further includes a fourth register when the second demultiplexer is included;

[0019] The first demultiplexer is used to assign the first half-round decryption sub-result of the first execution to the third register when the first decryption submodule executes the first half-round decryption operation for the first time; and to send the first half-round decryption sub-result of the second execution to the first comparator when the first decryption submodule executes the first half-round decryption operation for the second time; and the first comparator is used to compare whether the first half-round decryption sub-result of the second execution is consistent with the value of the third register;

[0020] The second multiplexer is used to assign the second-half-round decryption sub-result of the first execution to the fourth register when the second decryption sub-module executes the second-half-round decryption operation for the first time; and to send the second-half-round decryption sub-result of the second execution to the second comparator when the second decryption sub-module executes the second-half-round decryption operation for the second time; and the second comparator is used to compare whether the second-half-round decryption sub-result of the second execution is consistent with the value of the fourth register.

[0021] In a possible implementation manner, the error detection module is further configured to issue a fault warning message when it is determined that error injection exists during the decryption operation.

[0022] In a possible implementation, the decryption operation is an AES-based decryption operation.

[0023] On the other hand, a chip is provided, comprising at least one of the encryption circuit as described in the above one aspect or the decryption circuit as described in the above another aspect.

[0024] On the other hand, an electronic device is provided, comprising the chip as described in the above-mentioned on the other hand.

[0025] In summary, the technical solution provided by this application can at least bring the following beneficial effects:

[0026] The encryption circuit detects whether there is error injection during the encryption operation by performing encryption operations multiple times and comparing whether the encryption results of the multiple executions are consistent, so that the encryption circuit has the ability to detect error injection and improves encryption security. The decryption circuit detects whether there is error injection during the decryption operation by performing decryption operations multiple times and comparing whether the decryption results of the multiple executions are consistent, so that the decryption circuit has the ability to detect error injection and improves decryption security. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 It is a structural schematic diagram of an encryption circuit provided in an embodiment of the present application;

[0029] Figure 2 is a schematic diagram of the structure of another encryption circuit provided in an embodiment of the present application;

[0030] Figure 3 is a schematic diagram of the structure of another encryption circuit provided in an embodiment of the present application;

[0031] Figure 4 It is a structural schematic diagram of an AES wheel operation module provided in an embodiment of the present application;

[0032] Figure 5 is a schematic diagram of an encryption timing provided by an embodiment of the present application;

[0033] Figure 6 It is a structural schematic diagram of a decryption circuit provided in an embodiment of the present application;

[0034] Figure 7 is a structural schematic diagram of another decryption circuit provided in an embodiment of the present application;

[0035] Figure 8 is a structural schematic diagram of another decryption circuit provided in an embodiment of the present application;

[0036] Fig. 9It is a structural diagram of an AES module provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0038] In view of the problem that an encryption circuit or a decryption circuit may cause data leakage due to error injection, an embodiment of the present application provides an encryption circuit capable of detecting error injection during an encryption operation, and also provides a decryption circuit capable of detecting error injection during a decryption operation.

[0039] See also Figure 1 , Figure 1 This is a schematic diagram of the structure of an encryption circuit provided in an embodiment of the present application. Figure 1 As shown, the encryption circuit 00 includes an encryption operation module 01 and an error detection module 02. The encryption operation module 01 is used to perform at least two encryption operations on the input first data to obtain at least two encrypted second data; the error detection module 02 is used to compare whether the at least two second data are consistent. If the at least two second data are inconsistent, it is determined that there is an error injection during the encryption operation. If the at least two second data are consistent, it is determined that there is no error injection during the encryption operation.

[0040] Optionally, the encryption operation module 01 is connected to the error detection module 02, and each time the encryption operation module 01 performs an encryption operation, it sends an encryption result, i.e., the second data, to the error detection module 02. Thus, the encryption circuit 00 performs the encryption operation multiple times and compares whether the encryption results of the multiple executions are consistent to detect whether there is error injection during the encryption operation, so that the encryption circuit has the ability to detect error injection, thereby improving encryption security.

[0041] In the embodiment of the present application, the error detection module 02 is also used to issue a fault warning message when it is determined that there is an error injection during the encryption operation. The method of issuing the fault warning message is not limited in the embodiment of the present application, for example, a fault light is turned on for warning, or a fault audio is emitted for warning. This enables timely processing of the error injection to avoid data leakage.

[0042] In a possible implementation, the encryption operation may include a first half round of encryption operation and a second half round of encryption operation. The embodiment of the present application does not limit the way of dividing the first half round of encryption operation and the second half round of encryption operation, and the multiple operation steps included in the encryption operation may be arbitrarily cut into two parts, the part in the first execution order is the first half round of encryption operation, and the part in the second execution order is the second half round of encryption operation.

[0043] In this case, see Figure 2 , Figure 2 This is a schematic diagram of another encryption circuit provided in an embodiment of the present application. Figure 2 As shown, the encryption operation module 01 includes a first encryption submodule 011 and a second encryption submodule 012 , and the error detection module 02 includes a first comparator 021 and a second comparator 022 .

[0044] The first encryption submodule 011 is used to perform at least two first half round encryption operations on the first data to obtain at least two first half round encryption results; the first comparator 021 is used to compare whether the at least two first half round encryption results are consistent; the second encryption submodule 012 is used to perform the second half round encryption operation on the at least two first half round encryption results respectively to obtain at least two second half round encryption results; the second comparator 022 is used to compare whether the at least two second half round encryption results are consistent. When the first comparator 021 detects that the at least two first half round encryption results are inconsistent, and / or the second comparator 022 detects that the at least two first half round encryption results are inconsistent, it is determined that there is error injection in the encryption operation process.

[0045] Optionally, the first encryption submodule 011 is connected to the first comparator 021, and the first encryption submodule 011 sends the first half round encryption result to the first comparator 021 every time it performs the first half round encryption operation. The second encryption submodule 012 is connected to the second comparator 022, and the second encryption submodule 012 sends the second half round encryption result to the second comparator 022 every time it performs the second half round encryption operation.

[0046] Therefore, a comparison test is performed once in each half-round encryption operation, which improves the detection accuracy. In addition, during the pipeline execution process, the encryption results of the first half round can be compared when the second half-round encryption operation is executed, thereby ensuring work efficiency.

[0047] In another possible implementation, the encryption operation may include multiple rounds of encryption sub-operations. For example, a first round of encryption sub-operation is performed on the first data to obtain a first round of encryption sub-result, a second round of encryption sub-operation is performed on the first round of encryption sub-result to obtain a second round of encryption sub-result, and so on, until all rounds of encryption sub-operations are performed, and the obtained round encryption sub-result is the second data.

[0048] In this case, the encryption operation module 01 is used to perform each round of encryption sub-operations in multiple rounds of encryption sub-operations on the first data at least twice to obtain at least two encryption sub-results of each round of encryption sub-operations; the error detection module 02 is used to compare whether the at least two encryption sub-results of each round of encryption sub-operations are consistent, and when the at least two encryption sub-results of any round of encryption sub-operations are inconsistent, it is determined that error injection exists in the encryption operation process.

[0049] Optionally, the encryption operation module 01 performs each round of encryption sub-operation in sequence according to the round order, which may be to complete all rounds of encryption sub-operation once, and then perform all rounds of encryption sub-operation again from the beginning, or to directly repeat the current round of encryption sub-operation once after completing the current round of encryption sub-operation, and then start to perform the next round of encryption sub-operation after completing at least two executions of the current round of encryption sub-operation. Each time the encryption operation module 01 performs a round of encryption sub-operation, it sends the encryption sub-result of the round of encryption sub-operation to the error detection module 02.

[0050] Therefore, for the encryption algorithm with multiple rounds of encryption operations, the encryption sub-results of each round of encryption operations can be compared and detected, which improves the detection accuracy. In the pipeline execution process, the encryption sub-results of the previous round of encryption sub-operations can be compared when the current round of encryption sub-operations are executed, thereby ensuring work efficiency.

[0051] In another possible implementation, the encryption operation includes multiple rounds of encryption sub-operations, and each round of encryption sub-operations includes a first half round of encryption operations and a second half round of encryption operations. In this case, Figure 2 In the encryption circuit shown, the first encryption submodule 011 is used to execute the first half of the encryption operation in each round of encryption suboperation at least twice, and obtain at least two first half of the encryption subresults of each round of encryption suboperation; the first comparator 021 is used to compare whether the at least two first half of the encryption subresults of each round of encryption suboperation are consistent; the second encryption submodule 012 is used to execute the second half of the encryption operation in each round of encryption suboperation at least twice, and obtain at least two second half of the encryption subresults of each round of encryption suboperation; the second comparator 022 is used to compare whether the at least two second half of the encryption subresults of each round of encryption suboperation are consistent.

[0052] In a possible implementation, the error detection module 02 further includes at least one of a first demultiplexer and a second demultiplexer. When the error detection module 02 includes the first demultiplexer, the error detection module 02 further includes a third register; when the error detection module 02 includes the second demultiplexer, the error detection module 02 further includes a fourth register.

[0053] Among them, the first multiplexer is used to assign the first half round encryption sub-result of the first execution to the third register when the first encryption sub-module 011 executes the first half round encryption operation for the first time; when the first encryption sub-module 011 executes the first half round operation for the second time, send the first half round encryption sub-result of the second execution to the first comparator 021; the first comparator 021 is used to compare whether the first half round encryption sub-result of the second execution is consistent with the value of the third register 027.

[0054] The second multiplexer is used to assign the second half-round encryption sub-result of the first execution to the fourth register when the second encryption sub-module 012 executes the second half-round encryption operation for the first time; when the second encryption sub-module 012 executes the second half-round encryption operation for the second time, send the second half-round encryption sub-result of the second execution to the second comparator 022; the second comparator 022 is used to compare whether the second half-round encryption sub-result of the second execution is consistent with the value of the fourth register.

[0055] In the examples of this application, see Figure 3 , Figure 3 This is a schematic diagram of another encryption circuit provided in an embodiment of the present application. Figure 3 As shown, taking execution twice as an example, the error detection module 02 also includes a first register 023 and a second register 024; the first register 023 is used to store the first half round encryption sub-result of each execution of the first half round encryption operation; the second register 024 is used to store the second half round encryption sub-result of each execution of the second half round encryption operation.

[0056] Optionally, continue as Figure 3 As shown, the error detection module 02 further includes a first demultiplexer 025, a second demultiplexer 026, a third register 027 and a fourth register 028. The first demultiplexer 025 is used to assign the value of the first register 023 to the third register 027 when the first encryption submodule 011 performs the first half round of encryption operation for the first time; and to assign the value of the first register 023 to the first comparator 021 when the first encryption submodule 011 performs the first half round of operation for the second time. The first comparator 021 is used to compare whether the value of the first register 023 is consistent with the value of the third register 027.

[0057] Then, in the clock cycle of the first execution of the first half-round encryption operation, the value of the first register 023 and the value of the third register 027 are both the first half-round encryption sub-result of the first execution; in the clock cycle of the second execution of the first half-round encryption operation, the value of the first register 023 becomes the first half-round encryption sub-result of the second execution, and the value of the third register 027 is still the first half-round encryption sub-result of the first execution. The first comparator 021 operates in the clock cycle of the second execution of the first half-round encryption operation, and compares the value of the first register 023 with the value of the third register 027, that is, compares the results of the two executions.

[0058] Similarly, the second multiplexer 026 is used to assign the value of the second register 024 to the fourth register 028 when the second encryption submodule 012 executes the second half of the encryption operation for the first time; and output the value of the second register 024 to the second comparator 022 when the second encryption submodule 012 executes the second half of the encryption operation for the second time; the second comparator 022 is used to compare whether the value of the second register 024 is consistent with the value of the fourth register 028.

[0059] Thus, the intermediate encryption sub-results can be recorded in real time through the register, which facilitates the comparison of the encryption sub-results and ensures that the comparison process does not affect the normal execution of the encryption operation.

[0060] The following is an example of an encryption operation based on AES. AES is a symmetric encryption algorithm, which means that the same key is used for encryption and decryption. AES is a block cipher, which means that the plaintext is divided into groups, each group is of equal length, and a group of data is encrypted each time until the entire plaintext is encrypted. The encryption formula of AES is C=E(K,P), where K is the key, P is the plaintext data, the encryption function E is a round function, and C is the ciphertext.

[0061] The number of round function executions varies with the key length. For example, if the key length is 128 bits, the encryption operation needs to execute the round function 10 times, that is, 10 rounds of encryption sub-operations. In AES, the operations of the round functions from the first to the ninth rounds of encryption are the same. For example, the first nine rounds of encryption sub-operations can include the following four steps: byte substitution, row shift, column mixing, and round key addition. The operation of the round function in the last round is different from the first nine rounds, and the column mixing step is not performed. In addition, before executing the first round of encryption sub-operations, the plaintext and the original key are first subjected to an XOR encryption operation.

[0062] Correspondingly, the decryption process is the inverse process of the encryption process, that is, the decryption process includes 10 rounds of decryption sub-operations. The operations of the round functions from the first to the ninth rounds of decryption are the same. For example, the first nine rounds of decryption sub-operations may include four steps: reverse shift, reverse byte substitution, round key addition, and reverse column mixing. Similar to the encryption operation, the reverse column mixing operation is not performed in the last round of decryption sub-operation. Before executing the first round of decryption sub-operation, the ciphertext and the original key are first subjected to an XOR decryption operation.

[0063] For example, see Figure 4 The schematic diagram of the round operation module of AES shown in the figure corresponds to the encryption circuit 00 in the embodiment of the present application, and multiple executions of the round operation correspond to multiple rounds of encryption sub-operations. The embodiment of the present application adds time redundancy technology to the round operation module of AES to detect transient single faults and multiple faults occurring in the encryption process, such as detecting error injection.

[0064] The encryption sub-operation of each round of AES is divided into two parts, the first half round operation of AES (R1, i) and the second half round operation of AES (R2, i), R1 represents the first half round, R2 represents the second half round, and i represents the round number. For example, the first half round operation of AES may include two steps of byte substitution and row shift, and the second half round operation of AES may include two steps of column mixing and round key. Alternatively, the first half round operation of AES may include three steps of byte substitution, row shift and column mixing, and the second half round operation of AES may include one step of round key.

[0065] A pipeline register (i.e., the first register) is inserted between the AES first half round operation (R1, i) and the AES second half round operation (R2, i), and an output register (i.e., the second register) is added after the AES second half round operation (R2, i). The AES first half round operation (R1, i) and the AES second half round operation (R2, i) are both performed twice, and the results of the two operations are compared for detection. Among them, the added pipeline register can increase the maximum operating frequency so that the throughput can be guaranteed. As a result, the AES round operation is divided into two parts, rather than simply repeating the same round operation twice, so that when executing the second half round operation, it is possible to check whether the first half round operation is wrong.

[0066] against Figure 4 In the structure shown, the plaintext (first data) and the original key are subjected to an XOR operation, and the XOR result is input into the multiplexer (MUX). For the first round of encryption sub-operation, the MUX selects to input the XOR result into the first half round of AES operation, and i=1 at this time. The pipeline register stores the calculated intermediate value, i.e., the first half round encryption sub-result. The first demultiplexer (DEMUX 1) selects to send the first half round encryption sub-result of the first execution to the comparison register 1, and DEMUX 1 selects to send the first half round encryption sub-result of the second repeated execution to the comparator 1. The comparator 1 is used to compare the value of the comparison register 1 with the value of the pipeline register, i.e., to compare the first half round encryption sub-results of the two executions, and output the comparison result 1.

[0067] DEMUX 1 also selects to send the first half round encryption sub-result of each execution to the second half round operation of AES, and the output register stores the calculated output value, i.e., the second half round encryption sub-result. The second demultiplexer (DEMUX 2) selects to send the second half round encryption sub-result of the first execution to comparison register 2, and DEMUX 2 selects to send the second half round encryption sub-result of the second repeated execution to comparator 2. Comparator 2 is used to compare the value of comparison register 2 with the value of the output line register, i.e., to compare the second half round encryption sub-results of the two executions, and output comparison result 2.

[0068] DEMUX 2 also chooses to output the second half round of encryption sub-results executed each time. For non-last round of encryption sub-operations, DEMUX 2 chooses to return the second half round of encryption sub-results executed this time to MUX. For non-first round of encryption sub-operations, MUX chooses to input the second half round of encryption sub-results into the first half round of AES operation, and i is greater than 1 at this time. The above process is executed repeatedly until all rounds of encryption sub-operations are completed.

[0069] Exemplarily, in each clock cycle (cycle, clk), the operation sequence of the round operation module can be as shown in Table 1. The first clock cycle performs plaintext ⊕ key, that is, the XOR operation of plaintext and original key; in even-numbered clock cycles such as 2, 4, 6, the comparison register 1 is loaded to store the first half round encryption sub-result, and the comparator 2 works to detect errors in (R2, i); in odd-numbered clock cycles such as 3, 5, 7, the comparison register 2 is loaded to store the second half round encryption sub-result, and the comparator 2 works to detect errors in (R2, i). The pipeline register and the output register work in all clock cycles to store the calculation results in real time. The AES first half round operation (R1, i) and the AES second half round operation (R2, i) work in all clock cycles to improve encryption efficiency.

[0070] Table 1

[0071]

[0072] It can also be found from Table 1 that the first comparison of comparator 1 will be performed in the third clock cycle, which is to compare the first half round encryption sub-result of normal encryption with the first half round encryption sub-result of re-encryption, that is, although the encryption process is executed in the second clock cycle, the encryption result is not used until the second clock cycle.

[0073] In the embodiment of the present application, the encrypted timing diagram of the wheel operation module can be as follows: Figure 5 As shown in the figure, the first half of the AES operation and the second half of the AES operation switch between normal encryption and re-encryption every other clock cycle. That is, the re-encryption of the second half of the AES operation and the normal encryption of the first half of the AES operation are performed in the same clock cycle. For the case where the key is 128 bits, Figure 4 The round operation module shown executes the round function approximately 11 times to process the input 128-bit plaintext, and thus takes 22 clock cycles to execute all 11 rounds of encryption sub-operations and comparison checks.

[0074] Therefore, the embodiment of the present application provides a round operation module with an error injection detection function, and by dividing the AES round operation into two partial operations and pipelines, so that the second half of the round operation can check whether the first half of the round operation is wrong, the area overhead is saved while ensuring the working speed.

[0075] The above is the encryption circuit provided in the embodiment of the present application. Corresponding to the encryption circuit, the embodiment of the present application also provides a decryption circuit. Compared with the encryption circuit, the decryption circuit replaces the encryption operation with the decryption operation, and the decryption operation can be the inverse operation of the encryption operation. Figure 6 The decryption circuit 10 includes a decryption operation module 11 and an error detection module 12. The decryption operation module 11 is used to perform at least two decryption operations on the input second data to obtain at least two decrypted first data; the error detection module 12 is used to compare whether the at least two first data are consistent, and when the at least two first data are inconsistent, determine that there is an error injection in the decryption operation process.

[0076] In the case where the decryption operation includes a first half round of decryption operation and a second half round of decryption operation, see Figure 7 The decryption operation module 11 includes a first decryption submodule 111 and a second decryption submodule 112, and the error detection module 12 includes a first comparator 121 and a second comparator 122. The first decryption submodule 111 is used to perform at least two first-half-round decryption operations on the second data to obtain at least two first-half-round decryption results; the first comparator 121 is used to compare whether the at least two first-half-round decryption results are consistent; the second decryption submodule 112 is used to perform the second-half-round decryption operation on the at least two first-half-round decryption results respectively to obtain at least two second-half-round decryption results; the second comparator 122 is used to compare whether the at least two second-half-round decryption results are consistent.

[0077] In the case where the decryption operation includes multiple rounds of decryption sub-operations, Figure 6 The decryption operation module 11 is used to perform each round of decryption sub-operation in multiple rounds of decryption sub-operation on the second data at least twice to obtain at least two decryption sub-results of each round of decryption sub-operation; the error detection module 12 is used to compare whether the at least two decryption sub-results of each round of decryption sub-operation are consistent, and when the at least two decryption sub-results of any round of decryption sub-operation are inconsistent, it is determined that error injection exists in the decryption operation process.

[0078] In the case where the decryption operation includes multiple rounds of decryption sub-operations, and each round of decryption sub-operation includes a first half round of decryption operation and a second half round of decryption operation, Figure 7The decryption operation module 11 in the embodiment includes a first decryption submodule 111 and a second decryption submodule 112, and the error detection module 12 includes a first comparator 121 and a second comparator 122; the first decryption submodule 111 is used to perform the first half round of decryption operation in each round of decryption suboperation at least twice to obtain at least two first half round of decryption subresults of each round of decryption suboperation; the first comparator 121 is used to compare whether the at least two first half round of decryption subresults of each round of decryption suboperation are consistent; the second decryption submodule 112 is used to perform the second half round of decryption operation in each round of decryption suboperation at least twice to obtain at least two second half round of decryption subresults of each round of decryption suboperation; the second comparator 122 is used to compare whether the at least two second half round of decryption subresults of each round of decryption suboperation are consistent.

[0079] In a possible implementation, the error detection module 12 further includes at least one of a first demultiplexer and a second demultiplexer. When the error detection module 12 includes the first demultiplexer, the error detection module 12 further includes a third register; when the error detection module 12 includes the second demultiplexer, the error detection module 12 further includes a fourth register.

[0080] Among them, the first multiplexer is used to assign the first half round decryption sub-result of the first execution to the third register when the first decryption sub-module 111 executes the first half round decryption operation for the first time; when the first decryption sub-module 111 executes the first half round decryption operation for the second time, send the first half round decryption sub-result of the second execution to the first comparator 121; the first comparator 121 is used to compare whether the first half round decryption sub-result of the second execution is consistent with the value of the third register 127.

[0081] The second multiplexer is used to assign the second-half-round decryption sub-result of the first execution to the fourth register 128 when the second decryption sub-module 112 executes the second-half-round decryption operation for the first time; and to send the second-half-round decryption sub-result of the second execution to the second comparator 122 when the second decryption sub-module 112 executes the second-half-round decryption operation for the second time; and the second comparator 122 is used to compare whether the second-half-round decryption sub-result of the second execution is consistent with the value of the fourth register 128.

[0082] In one possible implementation, see Figure 8 The error detection module 12 also includes a first register 123 and a second register 124; the first register 123 is used to store the first half round decryption sub-result of each execution of the first half round decryption operation; the second register 124 is used to store the second half round decryption sub-result of each execution of the second half round decryption operation.

[0083] Optionally, continue to see Figure 8The error detection module 12 further includes a first demultiplexer 125, a second demultiplexer 126, a third register 127 and a fourth register 128. The first demultiplexer 125 is used to assign the value of the first register 123 to the third register 127 when the first decryption submodule 111 performs the first half round of decryption operation for the first time; assign the value of the first register 123 to the first comparator 121 when the first decryption submodule 111 performs the first half round of decryption operation for the second time; the first comparator 121 is used to compare whether the value of the first register 123 is consistent with the value of the third register 127; the second demultiplexer 126 is used to assign the value of the second register 124 to the fourth register 128 when the second decryption submodule 112 performs the second half round of decryption operation for the first time; and output the value of the second register 124 to the second comparator 122 when the second decryption submodule 112 performs the second half round of decryption operation for the second time; and the second comparator 122 is used to compare whether the value of the second register 124 is consistent with the value of the fourth register 128.

[0084] In a possible implementation, the error detection module 12 is further configured to issue a fault warning message when it is determined that an error injection occurs during the decryption operation. The decryption operation in the embodiment of the present application may be an AES-based decryption operation.

[0085] For other implementations and beneficial effects of the decryption circuit 10, reference may be made to the relevant introduction of the encryption circuit 00 mentioned above, which will not be described in detail here.

[0086] A chip provided in an embodiment of the present application includes at least one of the above-mentioned encryption circuit 00 or decryption circuit 10. Thus, the chip can detect error injection in time through the encryption circuit 00 or decryption circuit 10, thereby improving the security of the AES encryption and decryption circuit. Optionally, the chip can be any chip that uses an encryption algorithm to encrypt or decrypt data.

[0087] Exemplarily, the chip may be an AES module, and the structural diagram of the AES module may be as follows: Fig. 9 The AES module includes: an input interface, a state control module, an AES encryption round operation module, an AES decryption round operation module, a key expansion module, an IV (initialization vector) management module, an AES function library and an output interface.

[0088] The input interface is used to load the input signal and store the input block waiting for encryption / decryption. The input block is a block in the input signal. For example, the length of the input block is 128 bits. When the input block is plain text, it is waiting for encryption. When the input block is cipher text, it is waiting for decryption. Since the input block, key and initialization vector are 32 bits in length, but the output block is 128 / 192 / 256 bits in length, the input interface can include a data buffer, an IV buffer and a key buffer for buffering during the loading process. The state control module is used to generate control signals for other modules.

[0089] The AES encryption round operation module is used to encrypt the input block, corresponding to the above-mentioned encryption circuit, and the AES decryption round operation module is used to decrypt the input block, corresponding to the above-mentioned decryption circuit. The key expansion module is used to calculate a set of internal keys based on a single external key. The IV management module is used to manage the initialization vector in different modes of AES. The AES function library defines different AES functions, such as byte substitution, row shift, column mixing or round key addition. The output interface is used to receive plaintext / ciphertext of 128 / 192 / 256 bits in length and convert it into 4 / 6 / 8 32-bit signals. Similar to the input interface, the output interface includes a data buffer for buffering the output signal.

[0090] The embodiment of the present application also provides an electronic device, which includes the above chip. Since the electronic device includes the above chip, when the electronic device encrypts or decrypts data through the chip, error injection can be detected in time, thereby improving the security of data transmission.

[0091] It should be understood that the terms used in the embodiments of the present disclosure are only used to explain the embodiments of the present disclosure, and are not intended to limit the present disclosure. Unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be the common meanings understood by people with ordinary skills in the field to which the present disclosure belongs.

[0092] For example, the words "first", "second" or "third" and similar words used in the patent application specification and claims of this disclosure do not indicate any order, quantity or importance, but are merely used to distinguish different components.

[0093] Likewise, the words “a” or “an” and the like do not denote a limitation of quantity, but rather denote the presence of at least one.

[0094] Words such as “include” or “comprising” and the like mean that the elements or objects preceding “include” or “comprising” include the elements or objects listed after “include” or “comprising” and their equivalents, and do not exclude other elements or objects.

[0095] "Up", "down", "left" or "right" etc. are only used to indicate relative position relationship. When the absolute position of the described object changes, the relative position relationship may also change accordingly. "Connected" or "coupled" refers to electrical connection.

[0096] "And / or" indicates that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship.

[0097] Technicians in the relevant field can clearly understand that for the convenience and simplicity of description, the specific working processes of the gate drive circuit, shift register unit, each circuit and each sub-circuit described above can refer to the corresponding processes in the method embodiment and will not be repeated here.

[0098] The above description is only an optional embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. An encryption circuit, characterized in that: The encryption circuit comprises: an encryption operation module and an error detection module; The encryption operation module is used to perform at least two encryption operations on the input first data to obtain at least two encrypted second data; The error detection module is used to compare whether the at least two second data are consistent, and when the at least two second data are inconsistent, determine that error injection exists in the encryption operation process.

2. The encryption circuit according to claim 1, characterized in that: The encryption operation includes a first half round encryption operation and a second half round encryption operation, the encryption operation module includes a first encryption submodule and a second encryption submodule, and the error detection module includes a first comparator and a second comparator; The first encryption submodule is used to perform the first half-round encryption operation on the first data at least twice to obtain at least two first half-round encryption results; The first comparator is used to compare whether the at least two first half round encryption results are consistent; The second encryption submodule is used to perform the second-half-round encryption operation on the at least two first-half-round encryption results respectively to obtain at least two second-half-round encryption results; The second comparator is used to compare whether the at least two second-half-round encryption results are consistent.

3. The encryption circuit according to claim 1, characterized in that: The encryption operation includes multiple rounds of encryption sub-operations, and the encryption operation module is used to perform each round of encryption sub-operations in the multiple rounds of encryption sub-operations on the first data at least twice to obtain at least two encryption sub-results of each round of encryption sub-operations; The error detection module is used to compare whether the at least two encryption sub-results of each round of encryption sub-operation are consistent, and when the at least two encryption sub-results of any round of encryption sub-operation are inconsistent, determine that error injection exists in the encryption operation process.

4. The encryption circuit according to claim 3, characterized in that: Each round of encryption sub-operation includes a first half round of encryption operation and a second half round of encryption operation, the encryption operation module includes a first encryption sub-module and a second encryption sub-module, and the error detection module includes a first comparator and a second comparator; The first encryption submodule is used to perform the first half round encryption operation in each round of encryption suboperation at least twice to obtain at least two first half round encryption subresults of each round of encryption suboperation; The first comparator is used to compare whether the at least two first half round encryption sub-results of each round of encryption sub-operation are consistent; The second encryption submodule is used to perform the second half round encryption operation in each round of encryption suboperation at least twice to obtain at least two second half round encryption subresults of each round of encryption suboperation; The second comparator is used to compare whether the at least two second-half-round encryption sub-results of each round of encryption sub-operation are consistent.

5. The encryption circuit according to claim 4, characterized in that: The error detection module further comprises at least one of a first demultiplexer and a second demultiplexer, and further comprises a third register in the case of comprising the first demultiplexer, and further comprises a fourth register in the case of comprising the second demultiplexer; The first demultiplexer is used to assign the first half round encryption sub-result of the first execution to the third register when the first encryption submodule executes the first half round encryption operation for the first time; and to send the first half round encryption sub-result of the second execution to the first comparator when the first encryption submodule executes the first half round operation for the second time; The first comparator is used to compare whether the result of the first half round of encryption executed for the second time is consistent with the value of the third register; The second demultiplexer is used to assign the second half-round encryption sub-result executed for the first time to the fourth register when the second encryption submodule executes the second half-round encryption operation for the first time; and to send the second half-round encryption sub-result executed for the second time to the second comparator when the second encryption submodule executes the second half-round encryption operation for the second time; The second comparator is used to compare whether the second half round encryption result of the second execution is consistent with the value of the fourth register.

6. The encryption circuit according to any one of claims 1 to 5, characterized in that: The error detection module is further used to issue a fault warning message when it is determined that an error injection exists during the encryption operation.

7. A decryption circuit, characterized in that: The decryption circuit comprises: a decryption operation module and an error detection module; The decryption operation module is used to perform at least two decryption operations on the input second data to obtain at least two decrypted first data; The error detection module is used to compare whether the at least two first data are consistent, and when the at least two first data are inconsistent, determine that error injection exists during the decryption operation.

8. The decryption circuit according to claim 7, characterized in that: The decryption operation includes a first half round of decryption operation and a second half round of decryption operation, the decryption operation module includes a first decryption submodule and a second decryption submodule, and the error detection module includes a first comparator and a second comparator; The first decryption submodule is used to perform the first half round decryption operation on the second data at least twice to obtain at least two first half round decryption results; The first comparator is used to compare whether the at least two first half round decryption results are consistent; The second decryption submodule is used to perform the second-half-round decryption operation on the at least two first-half-round decryption results respectively to obtain at least two second-half-round decryption results; The second comparator is used to compare whether the at least two second-half-round decryption results are consistent.

9. The decryption circuit according to claim 8, characterized in that: The decryption operation includes multiple rounds of decryption sub-operations, and the decryption operation module is used to perform each round of decryption sub-operations in the multiple rounds of decryption sub-operations on the second data at least twice to obtain at least two decryption sub-results of each round of decryption sub-operations; The error detection module is used to compare whether the at least two decryption sub-results of each round of decryption sub-operation are consistent, and determine that error injection exists in the decryption operation process when the at least two decryption sub-results of any round of decryption sub-operation are inconsistent.

10. The decryption circuit according to claim 9, characterized in that: Each round of decryption sub-operation includes a first half round of decryption operation and a second half round of decryption operation, the decryption operation module includes a first decryption sub-module and a second decryption sub-module, and the error detection module includes a first comparator and a second comparator; The first decryption submodule is used to perform the first half round of decryption operation in each round of decryption sub-operation at least twice to obtain at least two first half round of decryption sub-results of each round of decryption sub-operation; The first comparator is used to compare whether the at least two first half round decryption sub-results of each round of decryption sub-operation are consistent; The second decryption submodule is used to perform the second half round of decryption operation in each round of decryption sub-operation at least twice to obtain at least two second half round of decryption sub-results of each round of decryption sub-operation; The second comparator is used to compare whether the at least two second-half-round decryption sub-results of each round of decryption sub-operation are consistent.

11. The decryption circuit according to claim 10, characterized in that: The error detection module further comprises at least one of a first demultiplexer and a second demultiplexer, and further comprises a third register in the case of comprising the first demultiplexer, and further comprises a fourth register in the case of comprising the second demultiplexer; The first demultiplexer is configured to assign the first half-round decryption sub-result of the first execution to the third register when the first decryption submodule executes the first half-round decryption operation for the first time; and to send the first half-round decryption sub-result of the second execution to the first comparator when the first decryption submodule executes the first half-round decryption operation for the second time; The first comparator is used to compare whether the first half round decryption sub-result of the second execution is consistent with the value of the third register; The second demultiplexer is used to assign the second half decryption sub-result of the first execution to the fourth register when the second decryption submodule executes the second half decryption operation for the first time; When the second decryption submodule performs the second half round of decryption operation for the second time, sending the second half round of decryption sub-result of the second execution to the second comparator; The second comparator is used to compare whether the second half-round decryption result of the second execution is consistent with the value of the fourth register.

12. The decryption circuit according to any one of claims 7 to 11, characterized in that: The error detection module is further configured to issue a fault warning message when it is determined that an error injection exists during the decryption operation.

13. A chip, comprising at least one of the encryption circuit according to any one of claims 1 to 6 or the decryption circuit according to any one of claims 7 to 12.

14. An electronic device comprising the chip according to claim 13.

Images