Block cipher algorithm protection method and device, computer equipment and storage medium

Abstract

The invention relates to a block cipher algorithm protection method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring an initial deformation model corresponding to a linear operation part in a block cipher algorithm; generating a condition selection operation according to the input data in the linear operation part and a random number with a preset bit number; and according to the condition selection operation, deforming the initial deformation model to obtain a multi-channel protection circuit model corresponding to the linear operation part, and protecting the block cipher algorithm through the multi-channel protection circuit model. By adopting the method, the linear operation part can be effectively protected.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a block cipher algorithm protection method, device, computer equipment and storage medium. Background Art

[0002] The SM4 algorithm (block symmetric encryption algorithm) is a standard encryption algorithm with a wide range of applications. The side channel attack area used for the SM4 algorithm in the security encryption chip is mainly concentrated in the S-box (substitution box) table lookup part. This is because in the SM4 encryption and decryption process, the linear operation part consumes less power and has less leakage than the S-box table lookup.

[0003] However, with the development of side channel attack and defense technology, the theory and engineering application of S-box operation protection have become very mature, and the linear operation part has gradually entered the attacker's field of vision. In related technologies, although there are formula deformation solutions in the side channel protection measures for encryption algorithms, traditional formula deformation anti-attack means can only be applied to software-implemented cryptographic algorithms, and are difficult to apply to block symmetric cryptographic algorithms implemented in hardware circuits, resulting in the inability to effectively protect the linear operation part of block symmetric cryptographic algorithms. Summary of the invention

[0004] Based on this, it is necessary to provide a block cipher algorithm protection method, device, computer equipment and storage medium that can effectively protect the linear operation part of the block symmetric cipher algorithm in order to address the above technical problems.

[0005] In a first aspect, the present application provides a block cipher algorithm protection method, comprising:

[0006] Obtain an initial deformation model corresponding to the linear operation part of the block cipher algorithm;

[0007] Generate a conditional selection operation according to the input data in the linear operation part and a random number of preset bits;

[0008] According to the conditional selection operation, the initial deformation model is deformed to obtain a multi-path protection circuit model corresponding to the linear operation part, and the block cipher algorithm is protected by the multi-path protection circuit model.

[0009] In one embodiment, generating a conditional selection operation according to input data in the linear operation part and a random number of preset bits includes:

[0010] Generate a random number of preset bits corresponding to the input data in the linear operation part;

[0011] A conditional selection operation is generated according to input data, a random number of preset digits corresponding to the input data, and a conditional operator.

[0012] In one embodiment, generating a conditional selection operation according to input data, a random number of preset bits corresponding to the input data, and a conditional operator includes:

[0013] Determine the conditional operator based on the amount of input data;

[0014] A conditional selection operation is generated according to input data, a random number of preset digits corresponding to the input data, and a conditional operator.

[0015] In one embodiment, when the input data includes two sets of input data, the conditional selection operation is as follows:

[0016] X=rand_bit?A:rand_A

[0017] Y=rand_bit?B:rand_B

[0018] Z=rand_bit?rand_A:A

[0019] K=rand_bit?rand_B:B

[0020] Wherein, A and B represent the first group of input data and the second group of input data respectively; rand_A and rand_B represent the random numbers of preset bits corresponding to A and B respectively; rand_bit represents a single-bit random number; ?: represents a conditional operator; X represents the conditional selection operation corresponding to A, when rand_bit=1, X=A, when rand_bit=0, X=rand_A; Y represents the conditional selection operation corresponding to B; Z represents the conditional selection operation corresponding to rand_A, when rand_bit=1, Z=rand_A, when rand_bit=0, Z=A; K represents the conditional selection operation corresponding to rand_B.

[0021] In one embodiment, the initial deformation model is deformed according to the condition selection operation, and the multi-channel protection circuit model corresponding to the linear operation part is obtained, which includes:

[0022] The input data in the initial deformation model is replaced according to the conditional selection operation corresponding to the input data in the conditional selection operation to obtain a replaced model;

[0023] A multi-path protection circuit model corresponding to the linear operation part is generated according to the replaced model, the conditional selection operation, the circuit path corresponding to the linear operation part, and the conditional operator.

[0024] In one embodiment, when the input data includes two sets of input data, the initial deformation model is as follows:

[0025] Res1=A⊕B=A'(B'+C')'+(A+C)'B+(A'+C')'B'+(B+C)'A

[0026] Among them, A and B represent the first group of input data and the second group of input data respectively; ⊕ represents the exclusive OR operation; A' represents the logical negation value of A; B' represents the logical negation value of B; C represents a random number, C' represents the logical negation value of C; Res1 represents the exclusive OR result of A and B.

[0027] In one embodiment, when the linear operation part includes two groups of circuit paths, the multi-path protection circuit model corresponding to the linear operation part includes two groups of circuit paths; the multi-path protection circuit model corresponding to the linear operation part is as follows:

[0028] Res2=rand_bit?(X'(Y'+C')'+(X+C)'Y+(X'+C')'Y'+(Y+C)'X):Z⊕K

[0029] Wherein, X and Y represent the conditional selection operations corresponding to A and B respectively, Z and K represent the conditional selection operations corresponding to the random numbers of preset bits corresponding to A and B respectively; (X'(Y'+C')'+(X+C)'Y+(X'+C')'Y'+(Y+C)'X) and Z⊕K represent the first group of circuit paths and the second group of circuit paths corresponding to the multi-path protection circuit model respectively; rand_bit represents a single-bit random number; ?: represents a conditional operator; Res2 represents the operation result of the multi-path protection circuit model, when rand_bit=0, its value is the result of A and B participating in the operation of the second group of circuit paths, including the power consumption of rand_A and rand_B participating in the operation of the first group of circuit paths and the power consumption of A and B participating in the operation of the second group of circuit paths; when rand_bit=1, its value is the result of A and B participating in the operation of the first group of circuit paths, including the power consumption of rand_A and rand_B participating in the operation of the second group of circuit paths and the power consumption of A and B participating in the operation of the first group of circuit paths.

[0030] In a second aspect, the present application also provides a block cipher algorithm protection device, comprising:

[0031] An initial model acquisition module is used to obtain an initial deformation model corresponding to the linear operation part in the block cipher algorithm;

[0032] A condition generation module, used for generating a conditional selection operation according to input data in the linear operation part and a random number of preset bits;

[0033] A model deformation module, used for deforming the initial deformation model according to the condition selection operation, and obtaining a multi-channel protection circuit model corresponding to the linear operation part;

[0034] The cryptographic protection module is used to protect the block cipher algorithm through a multi-path protection circuit model.

[0035] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0036] Obtain an initial deformation model corresponding to the linear operation part in the block cipher algorithm;

[0037] Generate a conditional selection operation according to the input data in the linear operation part and a random number of preset bits;

[0038] According to the conditional selection operation, the initial deformation model is deformed to obtain a multi-path protection circuit model corresponding to the linear operation part, and the block cipher algorithm is protected by the multi-path protection circuit model.

[0039] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0040] Obtain an initial deformation model corresponding to the linear operation part in the block cipher algorithm;

[0041] Generate a conditional selection operation according to the input data in the linear operation part and a random number of preset bits;

[0042] According to the conditional selection operation, the initial deformation model is deformed to obtain a multi-path protection circuit model corresponding to the linear operation part, and the block cipher algorithm is protected by the multi-path protection circuit model.

[0043] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0044] Obtain an initial deformation model corresponding to the linear operation part in the block cipher algorithm;

[0045] Generate a conditional selection operation according to the input data in the linear operation part and a random number of preset bits;

[0046] According to the conditional selection operation, the initial deformation model is deformed to obtain a multi-path protection circuit model corresponding to the linear operation part, and the block cipher algorithm is protected by the multi-path protection circuit model.

[0047] The above-mentioned block cipher algorithm protection method, device, computer equipment, storage medium and computer program product generate conditional selection operations according to the input data in the linear operation part and the random number of preset bits, and according to the conditional selection operation, deform the initial deformation model corresponding to the linear operation part in the block cipher algorithm to obtain the multi-path protection circuit model corresponding to the linear operation part, so as to protect the block cipher algorithm implemented by the hardware circuit. Under different selection conditions, the conditional selection operation will return different data, input data or random numbers of preset bits, so that multiple circuit paths of the multi-path protection circuit model perform operations on different data under different selection conditions, thereby making the operating power consumption of different circuit paths different, so as to resist side channel attacks and effectively protect the block cipher algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 It is an application environment diagram of a block cipher algorithm protection method in one embodiment;

[0050] Figure 2 A schematic diagram of a flow chart of a block cipher algorithm protection method in one embodiment;

[0051] Figure 3 A schematic diagram of a circuit path of a conditional statement corresponding to an initial deformation model in an embodiment;

[0052] Figure 4 A schematic diagram of a flow chart of generating a conditional selection operation according to input data in a linear operation part and a random number of preset bits in one embodiment;

[0053] Figure 5 A schematic diagram of a flow chart of an embodiment of deforming an initial deformation model according to a conditional selection operation to obtain a multi-channel protection circuit model corresponding to a linear operation part;

[0054] Figure 6 A structural block diagram of a block cipher algorithm protection device in one embodiment;

[0055] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0057] The SM4 algorithm includes an S-box lookup part and a linear operation part. Through multiple rounds of encryption operations, data encryption and decryption are finally achieved. In traditional technologies, the side channel attack area used in security encryption chips for the SM4 algorithm is mainly concentrated in the S-box lookup part. This is because in the SM4 encryption and decryption process, the linear operation part consumes less power and has less leakage than the S-box lookup part. Therefore, for attackers, attacking the S-box lookup part is more cost-effective. However, with the development of side channel attack and defense technology, the theory and engineering application of the S-box operation part protection have become very mature, and the linear operation part has gradually entered the attacker's field of vision. However, there is little research on the protection methods of the linear operation part in traditional technologies, which makes it impossible to effectively protect the linear operation part.

[0058] In addition, there are formula deformation schemes in the side channel protection measures for public key encryption algorithms, but there is less research on block cipher algorithms, especially there is no relevant research on block cipher algorithms implemented in hardware circuits.

[0059] The effect of deforming the block cipher algorithm formula implemented by software is effective. However, unlike the software implementation, the linear operation part of the block cipher algorithm exists in the form of a combinational circuit in the chip. No matter how the formula is deformed, the circuits of all circuit paths in the hardware circuit are actually running, and the selector only selects the operation result of a certain circuit path. Therefore, the final actual power consumption is the same, and it cannot play the role of side channel protection.

[0060] Therefore, in response to the above problems, a block cipher algorithm protection method is proposed. By deforming the linear operation part in the block cipher algorithm and making the power consumption of the path after the deformation different, the side channel attack can be resisted and the block cipher algorithm implemented in the hardware circuit can be effectively protected.

[0061] The block cipher algorithm protection method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The terminal 102 sends a block cipher algorithm protection request to the server 104, and the server 104 obtains the initial deformation model corresponding to the linear operation part in the block cipher algorithm according to the block cipher algorithm protection request, and generates a conditional selection operation according to the input data in the linear operation part and the random number of the preset bit, so as to deform the initial deformation model according to the conditional selection operation, and obtain the multi-path protection circuit model corresponding to the linear operation part, and then protect the block cipher algorithm through the multi-path protection circuit model. Among them, the terminal 102 can be but not limited to various personal computers, laptops, smart phones and tablets. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0062] In an exemplary embodiment, Figure 2 As shown, a block cipher algorithm protection method is provided, which is applied to Figure 1 The server in the example is used to illustrate, including the following steps 202 to 206. Among them:

[0063] Step 202: Obtain an initial deformation model corresponding to the linear operation part in the block cipher algorithm.

[0064] The block cipher algorithm refers to the SM4 algorithm, and the initial deformation model refers to the initial deformation formula corresponding to the linear operation part.

[0065] Optionally, the SM4 algorithm includes an S-box table lookup part and a linear operation part. Assume that the input of the SM4 algorithm is (X i ,X i+1 ,X i+2 ,X i+3 ). The encryption transformation of SM4 algorithm can be expressed as X i+4 =F(X i ,X i+1 ,X i+2 ,X i+3 ,rk i )=X i ⊕T(X i+1 ⊕X i+2 ⊕X i+3 ⊕rk i ), where X i+4 represents the output data of this iterative operation; F represents the round function; rk i represents the round key; ⊕ represents the XOR operation; T represents synthetic permutation.

[0066] Furthermore, the synthetic permutation T is a reversible transformation, which is composed of a nonlinear transformation τ and a linear transformation L, that is, T(·)=L(τ(·)), wherein the nonlinear transformation τ is composed of 4 parallel S boxes. Assume that the input of the nonlinear transformation τ is X1 and the output is Y1, Y1=τ(X1)=SBOX(X1). The linear transformation L represents the linear operation part, and the output of the nonlinear transformation τ is the input of the linear transformation L, L(Y1)=Y1⊕(Y1<<2)⊕(Y1<<10)⊕(Y1<<18)⊕(Y1<<24), where << represents a left shift operation. It can be seen that the linear operation part in the SM4 algorithm includes an XOR operation and a shift operation. Therefore, in this embodiment, the formula is deformed for the XOR operation.

[0067] Specifically, an initial deformation model corresponding to the XOR operation in the linear operation part is obtained. The initial deformation model can be obtained by deformation of random numbers. Exemplarily, when the XOR operation in the linear operation part includes two sets of input data, the initial deformation model corresponding to the XOR operation can be as follows:

[0068] Res=A⊕B

[0069] =A'B+AB'

[0070] =(A'B+AB')(C+C') (1)

[0071] =A'BC+A'BC'+AB'C+AB'C' (2)

[0072] =A'(B'+C')'+(A+C)'B+(A'+C')'B'+(B+C)'A (3)

[0073] Among them, A and B represent two groups of input data, namely the first group of input data and the second group of input data; A' represents the logical negation value of A; B' represents the logical negation value of B; C represents a random number, and C' represents the logical negation value of C; Res represents the exclusive OR result of A and B; the multiplication sign represents an AND operation, and the + represents an OR operation.

[0074] The above formulas (1), (2) and (3) can all be regarded as deformations of the XOR operation, that is, the initial deformation model. It should be noted that, in this embodiment, when obtaining the initial deformation model, any initial deformation model can be obtained.

[0075] Since the operations of equations (1), (2) and (3) are inconsistent, the power consumption generated during their operation is also inconsistent. If the above initial deformation model is implemented by software, that is, by reading instructions through the CPU, and selecting the code segment to be executed through the conditional statement triggered by the random number rand_dbl_bit, three different power consumption curves can be generated, namely:

[0076] If(rand_dbl_bit==0)DO FOMULA(1)

[0077] else if(rand_dbl_bit==1)DO FOMULA(2)

[0078] else if(rand_dbl_bit==2)DO FOMULA(3)

[0079] If rand_dbl_bit is equal to 0, Formula 1 (FOMULA(1)) is executed; otherwise, if rand_dbl_bit is equal to 1, Formula 2 (FOMULA(2)) is executed; otherwise, if rand_dbl_bit is equal to 2, Formula 3 (FOMULA(3)) is executed.

[0080] It can be seen that for attackers, the workload of cracking this point under ideal conditions is twice as much as before. In actual use, the number of deformation formulas can be increased, and the formula deformation can be adopted at multiple important points, which greatly increases the difficulty of algorithm cracking and plays a role in resisting side channel attacks. However, in the security encryption chip, the block cipher algorithm exists in the form of hardware circuits. Specifically, the linear operation part exists in the form of combinational circuits. The conditional statement corresponding to the above initial deformation model can be expressed by a circuit path, such as Figure 3 As shown, path 1, path 2 and path 3 represent the circuit paths corresponding to the above formulas (1), (2) and (3) respectively. It can be seen that, unlike the CPU reading instruction, in the combinational circuit where the linear operation part is located, no matter what kind of formula deformation is adopted, all circuit paths actually participate in the operation, and the selector only selects the result of different circuit paths, which results in the actual power consumption generated by the block cipher algorithm being the same, so the input end needs to be processed accordingly.

[0081] Step 204: Generate a conditional selection operation according to the input data in the linear operation part and a random number of preset bits.

[0082] The input data in the linear operation part refers to the input data of the linear transformation L. For example, the input data may include at least two groups of input data.

[0083] Optionally, in order to achieve a difference in the power consumption of the path after the formula is deformed to resist side channel attacks, a random number of preset digits can be generated. Then, according to the random number of preset digits and the input data in the linear operation part, a conditional selection operation corresponding to the random number of preset digits and a conditional selection operation corresponding to the input data are generated. Among them, the conditional selection operation corresponding to the random number of preset digits refers to the condition that when the condition is true, that is, when the condition is 1, the conditional selection operation corresponding to the random number of preset digits is returned. It can be understood that the conditional selection operation corresponding to the random number of preset digits returns the input data when the condition is false, that is, when the condition is 0. The conditional selection operation corresponding to the input data refers to the conditional selection operation corresponding to the input data when the condition is true. It can be understood that when the conditional selection operation corresponding to the input data is false, that is, when the condition is 0, the random number of preset digits is returned. For example, the random number of preset digits is a 32-bit random number.

[0084] Step 206, according to the conditional selection operation, the initial deformation model is deformed to obtain a multi-path protection circuit model corresponding to the linear operation part, and the block cipher algorithm is protected by the multi-path protection circuit model.

[0085] Optionally, after generating the conditional selection operation, the initial deformation model is deformed according to the conditional selection operation to obtain a multi-path protection circuit model including selection conditions of multiple circuit paths. The operation methods corresponding to the multiple circuit paths may be different. For example, the multiple circuit paths are at least two groups of circuit paths.

[0086] The block cipher algorithm is protected by a multi-path protection circuit model. The multi-path protection circuit model will select different circuit paths under different selection conditions, but multiple circuit paths of the multi-path protection circuit model will actually participate in the operation. Since the multi-path protection circuit model is obtained by improving the initial deformation model according to the conditional selection operation, under different selection conditions, the conditional selection operation will return different data, input data or a random number of preset bits, so that multiple circuit paths perform operations on different data under different selection conditions, and the power consumption of the circuit paths after the formula deformation is different.

[0087] In the above block cipher algorithm protection method, a conditional selection operation is generated according to the input data in the linear operation part and the random number of preset bits, and according to the conditional selection operation, the initial deformation model corresponding to the linear operation part in the block cipher algorithm is deformed to obtain a multi-path protection circuit model corresponding to the linear operation part, so as to protect the block cipher algorithm implemented by the hardware circuit. Under different selection conditions, the conditional selection operation will return different data, input data or random numbers of preset bits, so that multiple circuit paths of the multi-path protection circuit model perform operations on different data under different selection conditions, thereby making the operating power consumption of different circuit paths different, so as to resist side channel attacks and effectively protect the block cipher algorithm.

[0088] In an exemplary embodiment, Figure 4 As shown, step 204 generates a conditional selection operation according to the input data in the linear operation part and the random number of the preset bit number, including steps 402 to 404. Among them:

[0089] Step 402: Generate a random number of preset bits corresponding to the input data in the linear operation part.

[0090] Step 404: Generate a conditional selection operation according to the input data, a random number of preset digits corresponding to the input data, and a conditional operator.

[0091] Specifically, the input data in the linear operation part includes at least two groups of input data, and a corresponding preset number of random numbers is generated for each group of input data. Afterwards, according to each group of input data in the linear operation part, the preset number of random numbers corresponding to each group of input data, and the conditional operator, a conditional selection operation corresponding to each group of input data and a conditional selection operation of the preset number of random numbers corresponding to each group of input data are generated. Among them, the conditional operator is used to determine the returned data, input data or the preset number of random numbers through conditional judgment. For example, when the input data in the linear operation part includes two groups of input data, four conditional selection operations will be generated.

[0092] In this embodiment, by generating a random number of preset digits corresponding to the input data in the linear operation part, a conditional selection operation is generated according to the input data, the random number of preset digits corresponding to the input data, and the conditional operator. Different data can be returned under different conditions to participate in the operation of the combinational circuit where the linear operation part is located.

[0093] In an optional manner of the above embodiment, generating a conditional selection operation based on input data, a random number of a preset number of bits corresponding to the input data, and a conditional operator includes: determining the conditional operator based on the amount of input data; generating a conditional selection operation based on the input data, a random number of a preset number of bits corresponding to the input data, and the conditional operator.

[0094] Optionally, the conditional operator used is different depending on the number of input data. When the input data is in two groups, the conditional operator ?: corresponding to the single-bit random number rand_bit can be used. When the input data is in more than two groups, ?: needs to be used as the conditional operator. By determining the corresponding conditional operator according to the number of input data to generate the conditional selection operation, an accurate conditional selection operation can be obtained.

[0095] In the above optional manner, when the input data includes two groups of input data, the conditional selection operation is as follows:

[0096] X=rand_bit?A:rand_A

[0097] Y=rand_bit?B:rand_B

[0098] Z=rand_bit?rand_A:A

[0099] K=rand_bit?rand_B:B

[0100] Wherein, A and B represent the first group of input data and the second group of input data respectively; rand_A and rand_B represent the random numbers of preset bits corresponding to A and B respectively; rand_bit represents a single-bit random number; ?: represents a conditional operator; X represents the conditional selection operation corresponding to A, when rand_bit=1, X=A, when rand_bit=0, X=rand_A; Y represents the conditional selection operation corresponding to B, when rand_bit=1, Y=B, when rand_bit=0, Y=rand_B; Z represents the conditional selection operation corresponding to rand_A, when rand_bit=1, Z=rand_A, when rand_bit=0, Z=A; K represents the conditional selection operation corresponding to rand_B, when rand_bit=1, K=rand_B, when rand_bit=0, K=B.

[0101] In an exemplary embodiment, Figure 5 As shown, step 206, according to the condition selection operation, the initial deformation model is deformed to obtain a multi-channel protection circuit model corresponding to the linear operation part, including:

[0102] Step 502: Replace the input data in the initial deformation model according to the conditional selection operation corresponding to the input data in the conditional selection operation to obtain a replaced model.

[0103] Step 504, generating a multi-path protection circuit model corresponding to the linear operation part according to the replaced model, the conditional selection operation, the circuit path corresponding to the linear operation part, and the conditional operator.

[0104] Optionally, the corresponding input data in the initial deformation model is replaced according to the conditional selection operation corresponding to the input data in the conditional selection operation to obtain a replaced model.

[0105] The circuit paths of the multi-path protection circuit model are determined according to the replaced model, the conditional selection operation corresponding to the random number at the preset position, and the number of circuit paths corresponding to the linear operation part. The multi-path protection circuit model including selection conditions of multiple circuit paths is generated according to the circuit paths of the multi-path protection circuit model and the conditional operator.

[0106] In an optional manner of the above embodiment, when the input data includes two groups of input data, the initial deformation model obtained by the XOR operation deformation can be as shown in the above formula (3), that is, Res1=A⊕B=A'(B'+C')'+(A+C)'B+(A'+C')'B'+(B+C)'A.

[0107] Taking the initial deformation model of the above formula (3) as an example, the multi-channel protection circuit model is explained. When the linear operation part includes two groups of circuit paths, the multi-channel protection circuit model corresponding to the linear operation part includes two groups of circuit paths; the multi-channel protection circuit model corresponding to the linear operation part is as follows:

[0108] Res2=rand_bit?(X'(Y'+C')'+(X+C)'Y+(X'+C')'Y'+(Y+C)'X):Z⊕K

[0109] Among them, X and Y represent the conditional selection operations corresponding to A and B respectively, Z and K represent the conditional selection operations corresponding to the random numbers of preset bits corresponding to A and B respectively; (X'(Y'+C')'+(X+C)'Y+(X'+C')'Y'+(Y+C)'X) and Z⊕K represent the first group of circuit paths and the second group of circuit paths corresponding to the deformed multi-path protection circuit model respectively; rand_bit represents a single-bit random number; ?: represents the conditional operator; Res2 represents the operation result of the multi-path protection circuit model, that is, the total circuit power consumption corresponding to the linear operation part.

[0110] Further, when rand_bit=0, X=rand_A, Y=rand_B, Z=A, K=B, rand_A and rand_B participate in the operation of the first group of circuit paths, A and B participate in the operation of the second group of circuit paths, and Res2 takes the result of A and B participating in the operation of the second group of circuit paths, that is, the total power consumption of the circuit corresponding to the linear operation part includes the power consumption of rand_A and rand_B participating in the operation of the first group of circuit paths and the power consumption of A and B participating in the operation of the second group of circuit paths. When rand=1, X=A, Y=B, Z=rand_A, K=rand_B, rand_A and rand_B participate in the operation of the second group of circuit paths, A and B participate in the operation of the first group of circuit paths, and Res2 takes the result of A and B participating in the operation of the first group of circuit paths, that is, the total power consumption of the circuit corresponding to the linear operation part includes the power consumption of rand_A and rand_B participating in the operation of the second group of circuit paths and the power consumption of A and B participating in the operation of the first group of circuit paths.

[0111] It should be noted that this embodiment illustrates the generation method of the multi-path protection circuit model in the case of two sets of input data and two sets of circuit paths. When there are multiple sets of input data, the generation method of the multi-path protection circuit model is similar to the above generation method. If it is necessary to further improve the side channel anti-attack effect, the two sets of circuit paths can be expanded to multiple sets of circuit paths. The circuit expression of the circuit path can adopt formula (1) to formula (3) and their extended formulas.

[0112] In this embodiment, the input data in the initial deformation model is replaced according to the conditional selection operation corresponding to the input data in the conditional selection operation, so that the input data can be deformed into the conditional selection operation corresponding to the input data. According to the replaced model, the conditional selection operation, the circuit path corresponding to the linear operation part and the conditional operator, a multi-channel protection circuit model corresponding to the linear operation part is generated. Since the multi-channel circuit model also includes selection conditions for multiple circuit paths, under different selection conditions, the conditional selection operation will return different data, input data or a random number of preset bits, so that the multiple circuit paths of the multi-channel protection circuit model perform operations on different data under different selection conditions, thereby making the operating power consumption of different circuit paths different, so as to resist side channel attacks and effectively protect the block cipher algorithm.

[0113] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0114] Based on the same inventive concept, the embodiment of the present application also provides a block cipher algorithm protection device for implementing the block cipher algorithm protection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more block cipher algorithm protection device embodiments provided below can refer to the limitations on the block cipher algorithm protection method above, and will not be repeated here.

[0115] In an exemplary embodiment, Figure 6 As shown, a block cipher algorithm protection device is provided, comprising: an initial model acquisition module 602, a condition generation module 604, a model deformation module 606 and a cipher protection module 608, wherein:

[0116] The initial model acquisition module 602 is used to acquire the initial deformation model corresponding to the linear operation part in the block cipher algorithm.

[0117] The condition generation module 604 is used to generate a conditional selection operation according to the input data in the linear operation part and a random number with a preset number of bits.

[0118] The model deformation module 606 is used to select an operation according to a condition, deform the initial deformation model, and obtain a multi-channel protection circuit model corresponding to the linear operation part.

[0119] The cryptographic protection module 608 is used to protect the block cryptographic algorithm through a multi-path protection circuit model.

[0120] In an exemplary embodiment, the condition generation module 604 is used to generate a random number of preset bits corresponding to the input data in the linear operation part; and generate a conditional selection operation based on the input data, the random number of preset bits corresponding to the input data, and the conditional operator.

[0121] In an exemplary embodiment, the condition generation module 604 is used to determine the conditional operator according to the amount of input data; and generate a conditional selection operation according to the input data, a random number of preset digits corresponding to the input data, and the conditional operator.

[0122] In an exemplary embodiment, when the input data includes two groups of input data, the conditional selection operation is as follows:

[0123] X=rand_bit?A:rand_A

[0124] Y=rand_bit?B:rand_B

[0125] Z=rand_bit?rand_A:A

[0126] K=rand_bit?rand_B:B

[0127] Wherein, A and B represent the first group of input data and the second group of input data respectively; rand_A and rand_B represent the random numbers of preset bits corresponding to A and B respectively; rand_bit represents a single-bit random number; ?: represents a conditional operator; X represents the conditional selection operation corresponding to A, when rand_bit=1, X=A, when rand_bit=0, X=rand_A; Y represents the conditional selection operation corresponding to B; Z represents the conditional selection operation corresponding to rand_A, when rand_bit=1, Z=rand_A, when rand_bit=0, Z=A; K represents the conditional selection operation corresponding to rand_B.

[0128] In an exemplary embodiment, the model deformation module 606 is used to replace the input data in the initial deformation model according to the conditional selection operation corresponding to the input data in the conditional selection operation to obtain a replaced model; based on the replaced model, the conditional selection operation, the circuit path corresponding to the linear operation part and the conditional operator, a multi-path protection circuit model corresponding to the linear operation part is generated.

[0129] In an exemplary embodiment, when the input data includes two sets of input data, the initial deformation model is as follows:

[0130] Res1=A⊕B=A'(B'+C')'+(A+C)'B+(A'+C')'B'+(B+C)'A

[0131] Among them, A and B represent the first group of input data and the second group of input data respectively; ⊕ represents the exclusive OR operation; A' represents the logical negation value of A; B' represents the logical negation value of B; C represents a random number, C' represents the logical negation value of C; Res1 represents the exclusive OR result of A and B.

[0132] In an exemplary embodiment, when the linear operation part includes two groups of circuit paths, the multi-path protection circuit model corresponding to the linear operation part includes two groups of circuit paths; the multi-path protection circuit model corresponding to the linear operation part is as follows:

[0133] Res2=rand_bit?(X'(Y'+C')'+(X+C)'Y+(X'+C')'Y'+(Y+C)'X):Z⊕K

[0134] Wherein, X and Y represent the conditional selection operations corresponding to A and B respectively, Z and K represent the conditional selection operations corresponding to the random numbers of preset bits corresponding to A and B respectively; (X'(Y'+C')'+(X+C)'Y+(X'+C')'Y'+(Y+C)'X) and Z⊕K represent the first group of circuit paths and the second group of circuit paths corresponding to the multi-path protection circuit model respectively; rand_bit represents a single-bit random number; ?: represents a conditional operator; Res2 represents the operation result of the multi-path protection circuit model, when rand_bit=0, its value is the result of A and B participating in the operation of the second group of circuit paths, including the power consumption of rand_A and rand_B participating in the operation of the first group of circuit paths and the power consumption of A and B participating in the operation of the second group of circuit paths, when rand_bit=1, its value is the result of A and B participating in the operation of the first group of circuit paths, including the power consumption of rand_A and rand_B participating in the operation of the second group of circuit paths and the power consumption of A and B participating in the operation of the first group of circuit paths.

[0135] Each module in the above block cipher algorithm protection device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0136] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as the initial deformation model corresponding to the linear operation part in the block cipher algorithm and the multi-path protection circuit model corresponding to the linear operation part. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a block cipher algorithm protection method is implemented.

[0137] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0138] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0139] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0140] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0141] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0142] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0143] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0144] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A block cipher algorithm protection method, characterized in that: The method comprises: Obtain an initial deformation model corresponding to the linear operation part in the block cipher algorithm; Generate a conditional selection operation according to the input data in the linear operation part and a random number of preset bits; According to the conditional selection operation, the initial deformation model is deformed to obtain a multi-path protection circuit model corresponding to the linear operation part, and the block cipher algorithm is protected by the multi-path protection circuit model.

2. The method according to claim 1, characterized in that Generating a conditional selection operation according to the input data in the linear operation part and a random number of preset bits includes: Generate a random number of preset bits corresponding to the input data in the linear operation part; A conditional selection operation is generated according to the input data, a random number of preset bits corresponding to the input data, and a conditional operator.

3. The method according to claim 2, characterized in that Generating a conditional selection operation according to the input data, a random number of preset bits corresponding to the input data, and a conditional operator includes: determining a conditional operator according to the amount of the input data; A conditional selection operation is generated according to the input data, a random number of preset bits corresponding to the input data, and the conditional operator.

4. The method according to claim 3, characterized in that When the input data includes two groups of input data, the conditional selection operation is as follows: X=rand_bit?A:rand_A Y=rand_bit?B:rand_B Z=rand_bit?rand_A:A K=rand_bit?rand_B:B Wherein, A and B represent the first group of input data and the second group of input data respectively; rand_A and rand_B represent the random numbers of preset bits corresponding to A and B respectively; rand_bit represents a single-bit random number; ?: represents a conditional operator; X represents the conditional selection operation corresponding to A, when rand_bit=1, X=A, when rand_bit=0, X=rand_A; Y represents the conditional selection operation corresponding to B; Z represents the conditional selection operation corresponding to rand_A, when rand_bit=1, Z=rand_A, when rand_bit=0, Z=A; K represents the conditional selection operation corresponding to rand_B.

5. The method according to claim 1, characterized in that The selecting operation according to the condition, deforming the initial deformation model to obtain the multi-path protection circuit model corresponding to the linear operation part comprises: replacing the input data in the initial deformation model according to the conditional selection operation corresponding to the input data in the conditional selection operation to obtain a replaced model; A multi-path protection circuit model corresponding to the linear operation part is generated according to the replaced model, the conditional selection operation, the circuit path corresponding to the linear operation part, and the conditional operator.

6. The method according to claim 5, characterized in that When the input data includes two sets of input data, the initial deformation model is as follows: Res1=A⊕B=A'(B'+C')'+(A+C)'B+(A'+C')'B'+(B+C)'A Among them, A and B represent the first group of input data and the second group of input data respectively; ⊕ represents the exclusive OR operation; A' represents the logical negation value of A; B' represents the logical negation value of B; C represents a random number, C' represents the logical negation value of C; Res1 represents the exclusive OR result of A and B.

7. The method according to claim 6, characterized in that When the linear operation part includes two groups of circuit paths, the multi-path protection circuit model corresponding to the linear operation part includes two groups of circuit paths; the multi-path protection circuit model corresponding to the linear operation part is as follows: Res2=rand_bit?(X'(Y'+C')'+(X+C)'Y+(X'+C')'Y'+(Y+C)'X):Z⊕K Wherein, X and Y represent the conditional selection operations corresponding to A and B respectively, Z and K represent the conditional selection operations corresponding to the random numbers of preset bits corresponding to A and B respectively; (X'(Y'+C')'+(X+C)'Y+(X'+C')'Y'+(Y+C)'X) and Z⊕K represent the first group of circuit paths and the second group of circuit paths corresponding to the multi-path protection circuit model respectively; rand_bit represents a single-bit random number; ?: represents a conditional operator; Res2 represents the operation result of the multi-path protection circuit model, when rand_bit=0, its value is the result of A and B participating in the operation of the second group of circuit paths, including the power consumption of rand_A and rand_B participating in the operation of the first group of circuit paths and the power consumption of A and B participating in the operation of the second group of circuit paths, when rand_bit=1, its value is the result of A and B participating in the operation of the first group of circuit paths, including the power consumption of rand_A and rand_B participating in the operation of the second group of circuit paths and the power consumption of A and B participating in the operation of the first group of circuit paths.

8. A block cipher algorithm protection device, characterized in that: The device comprises: An initial model acquisition module is used to obtain an initial deformation model corresponding to the linear operation part in the block cipher algorithm; A condition generation module, used for generating a conditional selection operation according to the input data in the linear operation part and a random number of preset bits; A model deformation module, used for selecting an operation according to the condition, deforming the initial deformation model, and obtaining a multi-channel protection circuit model corresponding to the linear operation part; The cryptographic protection module is used to protect the block cryptographic algorithm through the multi-path protection circuit model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images