Method, device, system and equipment capable of authenticating encryption machine and medium

Abstract

The invention relates to the field of communication and electronic information security, and provides a method, a device, a system, equipment and a medium capable of authenticating encryption equipment, a CTR scheduling module and a G function scheduling module are designed, an encryption module based on a symmetric key encryption algorithm is arranged in the CTR scheduling module, a finite field multiplication module is arranged in the G function scheduling module, and the encryption module and the G function scheduling module are integrated. The CTR scheduling module schedules the encryption module, the G function scheduling module schedules the finite field multiplication module, encryption and decryption operation is cooperatively completed, and a ciphertext C and a mark T are output. According to the invention, the encryption rate and the use area of hardware are balanced, and a relatively high encryption and decryption rate is obtained while a relatively small use area of the hardware is used.

Description

Technical Field

[0001] The present invention relates to the field of communication and electronic information security, and in particular to a method, device, system, equipment and medium capable of identifying an encryption machine. Background Art

[0002] SM4 is a commercial cryptographic algorithm independently developed by my country. It is a block algorithm that uses symmetric key encryption. The block length of the algorithm is 128 bits and the key length is 128 bits. Both the encryption algorithm and the key expansion algorithm use a 32-round nonlinear iterative structure.

[0003] GCM (Galois / Counter Mode) is an operation mode of the block algorithm used for symmetric key encryption. This operation mode is a combination of the CTR mode of the block algorithm and the GHASH function (G function) of the Galois domain. The CTR mode provides confidentiality protection for data; the GHASH function provides integrity protection for data.

[0004] When performing encryption operations in GCM mode, there are four input signals: encryption key K, start variable S, plaintext D and additional identifiable data A; there are two output signals: ciphertext C and flag T.

[0005] The GCM mode encryption process is defined as follows:

[0006] The originator should perform the following steps to protect data D and ensure the integrity of the additional authenticating data A.

[0007] a) Select a start variable S of arbitrary length; a different S can be selected for each protected data, and S can be known to the message recipient; there is no need to ensure that the value of S is unpredictable or secret;

[0008] b) Divide D into blocks to obtain a sequence of data groups: D1, D2, ... D m ; where D1 contains the first 128 bits of D, D2 contains the second 128 bits of D, and so on, until D m Contains the last r bits of D (0<r≤128); hence, len(D)=(m-1)×128+r;

[0009] c) Let H = e K (0 128 );

[0010] d) If len(S) = 96, Y0 = S||0 31 ||1; otherwise Y0=G(H,{},S);

[0011] e) For i=1, 2, ..., m-1, perform the following two steps:

[0012] 1) Y i =inc(Y i-1 )

[0013] 2) C i =D i ⊕e K (Y i )

[0014] f)Y m =inc(Y m-1 );

[0015] g)C m =D m ⊕(e K (Y m ))| r ;

[0016] h)T=(G(H,A,C1||C2||…||C m )⊕(e K (Y0))| t ;

[0017] Through the above process, the identifiable encrypted data output of data D is C=C1||C2||…||C m ||T.

[0018] The identifiable encrypted data C generated by this scheme has t bits more than the original data D. In addition, the initiator needs to send a variable-length start variable S and additional identifiable data A to the receiver.

[0019] The GCM mode decryption process is defined as follows:

[0020] The recipient should perform the following steps to decrypt and verify the authenticatable encrypted data C and verify the additional authenticatable data A.

[0021] a) If the length of C is less than t, stop the calculation and return an error;

[0022] b) Determine integers m and r so that the number of bits of C is equal to (m-1)×128+r+t, where 0<r≤128; divide C into blocks to obtain a data packet sequence: C1, C2, …, C m ,T; where C1 contains the first 128 bits of C, C2 contains the second 128 bits of C, and so on, until C m Contains r bits (0<r≤128); Finally, let T be the last t bits of C;

[0023] c) Let H = e K (0 128 );

[0024] d) If len(S) = 96, Y0 = S||0 31 ||1; otherwise Y0=G(H,{},S);

[0025] e)T'=(G(H,A,C1||C2||…||C m )⊕(e K (Y0))| t ;

[0026] f) If T≠T', stop the calculation and return an error;

[0027] g) For i=1, 2, ..., m-1, perform the following two steps:

[0028] 1) Y i =inc(Y i-1 )

[0029] 2) D i =C i ⊕e K (Y i )

[0030] h)Y m =inc(Y m-1 );

[0031] i)D m =C m ⊕(e K (Y m ))| r ;

[0032] j) output D and additional identifiable data A;

[0033] When using the existing encryption scheme, the CTR operation process is highly coupled with the G function operation process, the data interaction during the operation is complex, the G function scheduling module is complex in design and the operation rate is low, it is difficult to balance the encryption rate and hardware usage area, and it is impossible to obtain a higher encryption and decryption rate while using less hardware usage area. Summary of the invention

[0034] The present invention aims to provide a method, device, system, equipment and medium for authenticating an encryption machine, so as to obtain a higher encryption and decryption rate while using less hardware usage area.

[0035] In a first aspect, the present invention provides an authenticatable encryption method, comprising:

[0036] (1) After the GCM operation is started, the CTR scheduling module starts the encryption module input 0 128 And calculate the H value, and then wait to receive the Y0 value;

[0037] (2) After receiving the H value, the G function scheduling module starts to calculate the Y0 value;

[0038] (3) After the Y0 value calculation is completed, the G function scheduling module starts to receive additional identifiable data A, and performs G function calculation based on the additional identifiable data A and the H value as the initial value of the subsequent calculation flag T;

[0039] (4) At the same time as step (3), after the CTR scheduling module receives the Y0 value, it writes the Y0 value into the encryption module and calculates e K (Y0); where e K () indicates encryption using encryption key K;

[0040] (5) After the CTR scheduling module writes the Y0 value into the encryption module, it notifies the external to write the plaintext D. The plaintext D is divided into groups D1, D2, …, D m Write to the input register, each time a group is written, the Y generation logic generates Y as designed i (1≤i≤m) and write it into the encryption module, calculate e K (Y1),…,E K (Y m );

[0041] (6) The calculation result of the encryption module e K (Y0), e K (Y1),…,e K (Y m ) Enter the encryption result register in order;

[0042] (7) The G function dispatch module reads e from the encryption result register K (Y0) is stored, and then e is read sequentially K (Y1),…,e K (Y m ) and read D1, ..., D m , calculate the ciphertext block sequence C1, ..., C m ; When performing decryption operations, use the ciphertext sequence C1, ..., C m With e K (Y1),…,e K (Y m ) calculates the plaintext sequence D1, ..., D m ;

[0043] (8) While calculating the ciphertext sequence, the G function scheduling module calls the finite field multiplication module to sequentially group the ciphertext into groups C1, ..., C m And the finite field multiplication module output value Z1, ..., Z mPerform iterative operations, and when the last group C is sent m After that, len(A)||len(C) is sent to the last G function operation; when decryption operation is performed, the ciphertext sequence C1, ..., C read from the input register is directly used. m Perform G function operation; where len() indicates the data length;

[0044] (9) After completing the last G function operation in step (8), the G function scheduling module sends the operation result Z of the finite field multiplication module function to m With r K (Y0) is calculated and the flag T is obtained and output.

[0045] In some embodiments, in step (2), if the length of the start variable S is equal to 96 bits, S||0 31 ||1 is used as the Y0 value; if the length of S is not equal to 96 bits, the S values ​​are received sequentially to call the finite field multiplication module, and the G function is calculated based on the S length and H value as the Y0 value.

[0046] In some embodiments, the calculations in the method are as follows:

[0047] In step (7), read e K (Y1),…,e K (Y m ) and read D1, ..., D m Perform XOR operation to obtain the ciphertext block sequence C1, ..., C m ; When performing decryption operations, use the ciphertext sequence C1, ..., C m With e K (Y1),…,e K (Y m ) is XORed to obtain the plaintext sequence D1, ..., D m ;

[0048] In step (8), the ciphertext is grouped into C1, ..., C m And the finite field multiplication module output value Z1, ..., Z m Perform XOR and then iterate;

[0049] In step (9), the operation result Z of the finite field multiplication module function is m With e K (Y0) is XORed to get the flag T.

[0050] In a second aspect, the present invention further provides an identifiable encryption device for executing the above identifiable encryption method, comprising a CTR scheduling module and a G function scheduling module connected to each other;

[0051] The CTR scheduling module is provided with an encryption module based on a symmetric key encryption algorithm;

[0052] The G function scheduling module is provided with a finite field multiplication module.

[0053] In some embodiments, the symmetric key encryption algorithm of the encryption module is the SM4 algorithm.

[0054] In some embodiments, the encryption module includes a key expansion module and 32 encryption cores; the key expansion module performs key expansion only when the key is updated.

[0055] In some embodiments, the finite field multiplication module is implemented using combinational logic.

[0056] In a third aspect, the present invention further provides an authenticatable encryption system, comprising a plurality of the above-mentioned authenticatable encryption devices; each of the authenticatable encryption devices performs parallel calculations.

[0057] In a fourth aspect, the present invention further provides an electronic device, comprising:

[0058] at least one processor; and a memory communicatively coupled to the at least one processor;

[0059] The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the above method by executing the instructions stored in the memory.

[0060] In a fifth aspect, the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store instructions, and when the instructions are executed, the above method is implemented.

[0061] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0062] 1. The present invention designs a CTR scheduling module and a G function scheduling module. The CTR scheduling module is provided with an encryption module based on a symmetric key encryption algorithm, and the G function scheduling module is provided with a finite field multiplication module. The CTR scheduling module schedules the encryption module, and the G function scheduling module schedules the finite field multiplication module, and the encryption and decryption operations are completed in coordination, and the ciphertext C and the flag T are output. Therefore, the present invention balances the encryption rate and the hardware usage area, and obtains a higher encryption and decryption rate while using less hardware usage area.

[0063] 2. The encryption module in the present invention uses only one key extension module, and the key extension is only performed when the key is updated, so that the encryption and decryption calculations of the data stream can be continuously performed without changing the key, which reduces the hardware usage area and reduces the data stream cache pressure.

[0064] 3. The complexity of the present invention is low and it is easy to implement on FPGA and ASIC. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 4 is a structural block diagram of an identifiable encryption device in an embodiment of the present invention.

[0066] Figure 2 The figure is a principle block diagram of an identifiable encryption method in an embodiment of the present invention.

[0067] Figure 3 The figure is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0069] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0070] like Figure 1 As shown, the present invention provides an identifiable encryption device, comprising a CTR scheduling module and a G function scheduling module connected to each other; the CTR scheduling module is provided with an encryption module based on a symmetric key encryption algorithm; the G function scheduling module is provided with a finite field multiplication module.

[0071] In this embodiment, the symmetric key encryption algorithm of the encryption module is the SM4 algorithm (therefore, the encryption module is also the SM4 encryption module in the attached figure), and other 128-bit grouping algorithms, such as AES, etc., may also be used. The number of encryption cores of the SM4 algorithm is the same as the number of encryption operation iterations, that is, 32 encryption cores, so the operation cycle is 32 clock cycles, and the next group can be written in the next clock after the current group is written, so that continuous writing of data streams can be achieved.

[0072] In this embodiment, the finite field multiplication module is implemented using combinational logic to match the rate of the grouping algorithm. According to the definition of function G, the finite field multiplication module starts the multiplication operation when the encryption and decryption data is valid, and in the actual operation process, the encryption rate can be much higher than the encryption rate of the grouping algorithm.

[0073] In this embodiment, the G function scheduling module uses the GHASH function to obtain a flag T according to the additional identifiable data A and the transmitted encrypted and decrypted data, which is used to indicate whether the message encrypted according to the GCM mode is complete.

[0074] like Figure 2 As shown, based on the above-mentioned identifiable encryption device, the process of an identifiable encryption method is as follows:

[0075] (1) After the GCM operation is started, the CTR scheduling module starts the encryption module input 0 128 And calculate the H value, and then wait to receive the Y0 value;

[0076] (2) After receiving the H value, the G function scheduling module starts to calculate the Y0 value; if the length of the starting variable S is equal to 96 bits, S||0 31 || 1 as the Y0 value; if the length of S is not equal to 96 bits, the S values ​​are received sequentially and the finite field multiplication module is called to calculate G(H,{},S) as the Y0 value;

[0077] (3) After the Y0 value is calculated, the G function scheduling module begins to receive additional identifiable data A and calculates G(H,{},A) as the initial value of the subsequent calculation flag T;

[0078] (4) At the same time as step (3), after the CTR scheduling module receives the Y0 value, it writes the Y0 value into the encryption module and calculates e K (Y0); where e K () indicates encryption using encryption key K;

[0079] (5) After the CTR scheduling module writes the Y0 value into the encryption module, it notifies the outside that the plaintext D can be written. The plaintext D is divided into groups D1, D2, …, D m Write to the input register, each time a group is written, the Y generation logic generates Y as designed i (1≤i≤m) and write it into the encryption module, calculate e K (Y1),…,e K (Y m );

[0080] (6) The calculation result of the encryption module e K (Y0), e K (Y1),…,e K (Y m ) Enter the encryption result register in order;

[0081] (7) The G function dispatch module reads e from the encryption result register K (Y0) is stored, and then e is read sequentially K(Y1),…,e K (Y m ) and read D1, ..., D m Perform XOR calculation D1⊕e K (Y1),…,D m ⊕e K (Y m ) to obtain the ciphertext block sequence C1, ..., C m ; When performing decryption operations, use the ciphertext sequence C1, ..., C m With e K (Y1),…,e K (Y m ) is XORed to obtain the plaintext sequence D1, ..., D m ;

[0082] (8) While calculating the ciphertext sequence, the G function scheduling module calls the finite field multiplication module to sequentially group the ciphertext into groups C1, ..., C m And the finite field multiplication module output value Z1, ..., Z m After XOR, iterative operation is performed. When the last group C is sent m After that, len(A)||len(C) is sent to the last G function operation; when decryption operation is performed, the ciphertext sequence C1, ..., C read from the input register is directly used. m Perform G function operation; where len() indicates the data length;

[0083] (9) After completing the last G function operation in step (8), the G function scheduling module sends the operation result Z of the finite field multiplication module function to m With e K (Y0) is XORed and the flag T is obtained and output.

[0084] The present invention designs a CTR scheduling module and a G function scheduling module. The CTR scheduling module is provided with an encryption module based on a symmetric key encryption algorithm, and the G function scheduling module is provided with a finite field multiplication module. The CTR scheduling module schedules the encryption module, and the G function scheduling module schedules the finite field multiplication module, and the encryption and decryption operations are completed in coordination, and the ciphertext C and the flag T are output. Therefore, the present invention balances the encryption rate and the hardware usage area, and obtains a higher encryption and decryption rate while using less hardware usage area. In addition, the encryption module in the present invention only uses one secret key expansion module, and the secret key expansion is only performed when the secret key is updated, so that the encryption and decryption calculations of the data stream can be continuously performed without changing the secret key, which reduces the hardware usage area and reduces the data stream cache pressure. At the same time, the complexity of the present invention is low and it is easy to implement on FPGA and ASIC.

[0085] Based on the same technical concept, an embodiment of the present invention further provides an identifiable encryption system, comprising a plurality of the above-mentioned identifiable encryption devices; each of the identifiable encryption devices can perform parallel calculations to achieve a higher encryption and decryption rate.

[0086] Based on the same technical concept, an embodiment of the present invention further provides an electronic device, which can implement the identifiable encryption method process provided by the above embodiment of the present invention. In one embodiment, the electronic device can be a server, or a terminal device or other electronic device. Figure 3 As shown, the electronic device may include:

[0087] At least one processor, and a memory connected to the at least one processor. The specific connection medium between the processor and the memory is not limited in the embodiment of the present invention. Figure 3 The example in this article is that the processor and memory are connected through a bus. Figure 3 The connections between other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into address bus, data bus, control bus, etc. Figure 3 In the diagram, only one thick line is used, but this does not mean that there is only one bus or only one type of bus. Alternatively, a processor can also be called a controller, and there is no limitation on the name.

[0088] In an embodiment of the present invention, the memory stores instructions that can be executed by at least one processor, and the at least one processor can execute an authenticatable encryption method discussed above by executing the instructions stored in the memory. The processor can implement Figure 3 The functions of each module in the device shown.

[0089] Among them, the processor is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory and calling data stored in the memory, various functions of the device and processing data.

[0090] In an optional design, the processor may include one or more processing units, and the processor may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor. In some embodiments, the processor and the memory may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0091] The processor may be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of an identifiable encryption method disclosed in the embodiments of the present invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0092] As a non-volatile computer-readable storage medium, the memory can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), programmable read-only memory (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic memory, disk, optical disk, etc. The memory is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in the embodiment of the present invention can also be a circuit or any other device that can realize a storage function, used to store program instructions and / or data.

[0093] By designing and programming the processor, the code corresponding to the identifiable encryption method introduced in the above embodiment can be fixed into the chip, so that the chip can perform the steps of the identifiable encryption method in the above embodiment when running. How to design and program the processor is a technology well known to those skilled in the art and will not be described here.

[0094] Based on the same inventive concept, an embodiment of the present invention further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes an authenticatable encryption method discussed above.

[0095] In some optional embodiments, the present invention also provides various aspects of an identifiable encryption method that can also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of an identifiable encryption method according to various exemplary embodiments of the present invention described above in this specification.

[0096] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of a unit described above can be further divided into multiple units to be embodied. In addition, although the operation of the method of the present invention is described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step for execution, and / or one step can be decomposed into multiple steps for execution.

[0097] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a server, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] Program code for performing the operations of the present invention may be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user equipment, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0100] Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0101] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0103] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An authenticatable encryption method, characterized in that: include: (1) After the GCM operation is started, the CTR scheduling module starts the encryption module input 0 128 And calculate the H value, and then wait to receive the Y0 value; (2) After receiving the H value, the G function scheduling module starts to calculate the Y0 value; (3) After the Y0 value calculation is completed, the G function scheduling module starts to receive additional identifiable data A, and performs G function calculation based on the additional identifiable data A and the H value as the initial value of the subsequent calculation flag T; (4) At the same time as step (3), after the CTR scheduling module receives the Y0 value, it writes the Y0 value into the encryption module and calculates e K (Y0); where e K () indicates encryption using encryption key K; (5) After the CTR scheduling module writes the Y0 value into the encryption module, it notifies the external to write the plaintext D. The plaintext D is divided into groups D1, D2, …, D m Write to the input register, each time a group is written, the Y generation logic generates Y as designed i (1≤i≤m) and write it into the encryption module, calculate e K (Y1),…,e K (Y m ); (6) The calculation result of the encryption module e K (Y0), e K (Y1),…,e K (Y m ) Enter the encryption result register in order; (7) The G function dispatch module reads e from the encryption result register K (Y0) is stored, and then e is read sequentially K (Y1),…,e K (Y m ) and read D1, ..., D m , calculate the ciphertext block sequence C1, ..., C m ; When performing decryption operations, use the ciphertext sequence C1, ..., C m With e K (Y1),…,e K (Y m ) calculates the plaintext sequence D1, ..., D m ; (8) While calculating the ciphertext sequence, the G function scheduling module calls the finite field multiplication module to sequentially group the ciphertext into groups C1, ..., C m And the finite field multiplication module output value Z1, ..., Z m Perform iterative operations, and when the last group C is sent m After that, len(A)||len(C) is sent to the last G function operation; when decryption operation is performed, the ciphertext sequence C1, ..., C read from the input register is directly used. m Perform G function operation; where len() indicates the data length; (9) After completing the last G function operation in step (8), the G function scheduling module sends the operation result Z of the finite field multiplication module function to m With e K (Y0) is calculated and the flag T is obtained and output.

2. The authenticatable encryption method according to claim 1, characterized in that: In step (2), if the length of the starting variable S is equal to 96 bits, set S||0 31 ||1 is used as the Y0 value; if the length of S is not equal to 96 bits, the S values ​​are received sequentially to call the finite field multiplication module, and the G function is calculated based on the S length and H value as the Y0 value.

3. The authenticatable encryption method according to claim 1, characterized in that: The calculations in the method are as follows: In step (7), read e K (Y1),…,e K (Y m ) and read D1, ..., D m Perform XOR operation to obtain the ciphertext block sequence C1, ..., C m ; When performing decryption operations, use the ciphertext sequence C1, ..., C m With e K (Y1),…,e K (Y m ) is XORed to obtain the plaintext sequence D1, ..., D m ; In step (8), the ciphertext is grouped into C1, ..., C m And the finite field multiplication module output value Z1, ..., Z m Perform XOR and then iterate; In step (9), the operation result Z of the finite field multiplication module function is m With e K (Y0) is XORed to get the flag T.

4. An identifiable encryption device, used to execute the identifiable encryption method according to any one of claims 1 to 3, characterized in that: It includes a connected CTR scheduling module and a G function scheduling module; The CTR scheduling module is provided with an encryption module based on a symmetric key encryption algorithm; The G function scheduling module is provided with a finite field multiplication module.

5. The authenticatable encryption device according to claim 4, characterized in that: The symmetric key encryption algorithm of the encryption module is the SM4 algorithm.

6. The authenticatable encryption device according to claim 5, characterized in that: The encryption module includes a key expansion module and 32 encryption cores; the key expansion module performs key expansion only when the key is updated.

7. The authenticatable encryption device according to claim 4, characterized in that: The finite field multiplication module is implemented using combinational logic.

8. An authenticatable encryption system, characterized in that: The method comprises a plurality of authenticatable encryption devices as described in any one of claims 4 to 7; each of the authenticatable encryption devices performs calculations in parallel.

9. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method as described in any one of claims 1 to 3 by executing the instructions stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 3 is implemented.

Images