SM4 algorithm implementation method and system of double variable wheel structure

Abstract

This invention belongs to the field of hardware security and discloses a method and system for implementing the SM4 algorithm with a dual variable wheel structure. Through the ICB bus, the configuration data required by the host is transmitted to the SM4 algorithm core; the data calculated by the SM4 algorithm core is then transmitted back to the host. The dual variable wheel structure proposed in this invention allows the SM4 algorithm to flexibly configure the number of encryption wheels to balance throughput and resource consumption. Increasing the number of wheels improves encryption and decryption speed under high throughput requirements; decreasing the number of wheels extends battery life under low power requirements. This design, combined with the modularity and low power consumption characteristics of RISC-V, provides efficient and flexible technical support for encryption processing in diverse IoT scenarios.

Description

Technical Field

[0001] This invention belongs to the field of hardware security, specifically relating to a method and system for implementing the SM4 algorithm with a dual variable wheel structure. Background Technology

[0002] The SM4 block cipher algorithm is a symmetric encryption algorithm independently designed in my country and is widely used for data encryption and protection in various IoT devices. However, with the rapid development of IoT technology, the data encryption and decryption requirements of these devices at low clock rates are becoming increasingly complex, and traditional SM4 implementations have revealed many limitations in this scenario. Currently, the implementation of the SM4 algorithm is mainly divided into software encryption and hardware encryption. Although software encryption is simple to implement, it is difficult to provide smooth encryption and decryption services under low clock rate conditions, its computational efficiency is insufficient, and its security is relatively low, easily becoming a bottleneck for system performance. While hardware encryption offers higher performance, it often requires more hardware resources and results in higher power consumption, making it difficult for miniaturized, low-cost IoT devices to withstand. Therefore, existing implementations are insufficient in terms of resources and power consumption to meet the needs of IoT scenarios with low clock rates and low data volumes.

[0003] In addition to the above, current SM4 hardware implementations face two main shortcomings. First, it's difficult to balance throughput with hardware resource consumption. A 32-round pipeline structure can significantly improve encryption throughput, but it also increases hardware resource consumption, limiting its application in miniaturized, low-cost IoT devices. While a 32-round iterative structure can reduce hardware resource consumption, it significantly increases processing time, affecting system response speed and making it unsuitable for high real-time scenarios. Second, power consumption control is also a significant challenge. Most IoT devices rely on battery power and have strict energy consumption requirements. The hardware implementation of the SM4 algorithm may result in high power consumption, impacting battery life. Therefore, while meeting encryption and decryption requirements, reducing power consumption to ensure stable long-term device operation has become a critical issue that urgently needs to be addressed. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention provides a method and system for implementing the SM4 algorithm with a dual variable wheel structure. This variable structure design not only effectively balances throughput, power consumption, and hardware resource consumption, but also improves the system's response speed. This makes the SM4 algorithm more adaptable to meet the application requirements of small, low-clock-rate IoT devices, and provides a secure and reliable technical guarantee for efficient encryption and decryption in low-power IoT devices.

[0005] To achieve the above objectives, the present invention provides the following solution:

[0006] A method for implementing the SM4 algorithm with a dual variable wheel structure, the method comprising:

[0007] The configuration data required by the host is transmitted to the SM4 algorithm core via the ICB bus.

[0008] The data calculated by the SM4 algorithm core is transmitted to the host.

[0009] Preferably, the configuration data required by the host includes: encryption / decryption data, encryption / decryption selection signals, and round selection signals.

[0010] Preferably, the SM4 algorithm core includes: a control module, a parameter storage module, an S-box module, an encryption / decryption module, a key expansion module, and a round buffer module.

[0011] Preferably, the control module, used to implement bit-width matching and signal allocation functions, is in the form of a state machine, divided into four states: IDLE (idle), EC_EN (encryption), DEC_EN (decryption), PRE_KEY (key preparation), and KEY_EXP (key expansion). When it receives the state data EN_SEL transmitted from the ICB bus, it parses it and passes it to the corresponding module, and the state machine enters the corresponding state from the IDLE state. If EN_SEL is 00, it is in the reset state and enters the IDLE state. If EN_SEL is 11, the state machine jumps from IDLE to PRE_KEY state, and then to KEY_EXP state. If EN_SEL is 01, the state machine jumps from IDLE to EN_EN state. If EN_SEL is 10, the state machine jumps from IDLE to DEC_EN state.

[0012] Preferably, the parameter storage module is used to store the system parameter FK and fixed parameter CK required during the SM4 algorithm key expansion process. When the control module gives an enable signal, the parameter is transmitted to the key expansion module.

[0013] Preferably, the S-box module is used to store the mapping data during the nonlinear transformation process of key expansion and encryption / decryption, and the S-box conversion is implemented by a lookup table method.

[0014] Preferably, the encryption / decryption module is divided into two parts: round transformation and reverse transformation. Each round transformation includes shifting, S-box conversion, and corresponding XOR operation. It adopts a combination of pipeline and loop iteration. When the round selection signal parsed by the control module is received, the number of loop rounds and pipeline structure are adjusted. The decryption key input is the reverse of the encryption key.

[0015] Preferably, the key expansion module is a round transformation part, and each round transformation also includes shifting, S-box transformation and corresponding XOR operation; the class adopts a combination of pipeline and loop iteration, and adjusts the number of loop rounds and pipeline structure when it receives the round selection signal parsed by the control module.

[0016] The present invention also provides a system for implementing the SM4 algorithm with a dual variable wheel structure. The system is used to implement the method described in any one of the above methods. The system includes: a first transmission module and a second transmission module.

[0017] The first transmission module is used to transmit the configuration data required by the host to the SM4 algorithm core via the ICB bus;

[0018] The second transmission module is used to transmit the data calculated by the SM4 algorithm core to the host.

[0019] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0020] This invention discloses a dual variable wheel structure SM4 algorithm IP based on a RISC-V processor, suitable for IoT devices operating at low clock speeds and handling small amounts of data for encryption and decryption. Existing SM4 implementations typically fall into two categories: software encryption and hardware encryption. The former suffers from low security and efficiency, while the latter, although offering superior performance, requires significant resources and consumes a large amount of power, making it unsuitable for small, low-power devices. To address these shortcomings, the dual variable wheel structure proposed in this invention allows for flexible configuration of the number of encryption wheels in the SM4 algorithm, balancing throughput and resource consumption. Increasing the number of wheels improves encryption and decryption speed under high throughput requirements, while reducing the number of wheels extends battery life under low power consumption requirements. This design, combined with the modularity and low power consumption characteristics of RISC-V, provides efficient and flexible technical support for encryption processing in diverse IoT scenarios. Attached Figure Description

[0021] To more clearly illustrate the technical solution of the present invention, the drawings used in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the hardware structure for implementing the SM4 algorithm with a dual variable wheel structure according to an embodiment of the present invention.

[0023] Figure 2 This is a state transition diagram of the control module in an embodiment of the present invention;

[0024] Figure 3 This is a block diagram illustrating the principle of SM4-n wheel merging in an embodiment of the present invention;

[0025] Figure 4 This is a block diagram illustrating the principle of the SM4-4 wheel merging in one embodiment of the present invention;

[0026] Figure 5 This is a block diagram illustrating the SM4-32 iteration principle of an embodiment of the present invention. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0029] Example 1

[0030] In ECB mode, there are typically three hardware implementation schemes for the round functions of the SM4 algorithm. The first is a pipelined structure, consisting of 32 cascaded encryption / decryption modules. Knowing the key for each round, encryption / decryption can be completed in just one clock cycle. The second is a loop-iterative structure, which loops the same set of encryption / decryption modules 32 times, completing encryption / decryption with a known key, but requiring 32 clock cycles. The third scheme combines pipelined and loop structures, combining n of the 32 rounds into an "n-round-in-one" circuit and running it cyclically. This method reduces circuit area, but the intermediate results generated in each cycle need to be stored in a register, and a multiplexer is required during the loop. This invention chooses the third scheme.

[0031] To address the problems of existing technologies, this invention proposes a dual variable wheel structure SM4 algorithm IP based on a RISC-V processor. RISC-V is an emerging open-source instruction set architecture with modularity and low power consumption, making it particularly suitable for embedded and IoT devices. The dual variable wheel structure gives the SM4 algorithm highly flexible adjustment capabilities: in high-throughput scenarios, the algorithm can increase the number of wheels to improve encryption speed and handle large data volumes; while in low-power scenarios, the number of wheels can be reduced to lower energy consumption and extend device battery life. This variable structure design not only effectively balances throughput, power consumption, and hardware resource consumption, but also improves system response speed, making the SM4 algorithm more adaptable to the application requirements of small, low-clock-rate IoT devices, and providing a secure and reliable technical guarantee for efficient encryption and decryption in low-power IoT devices.

[0032] The SM4 algorithm implementation of the dual variable wheel structure designed in this invention is divided into an ICB bus part and an SM4 algorithm core part. The entire hardware implementation structure is as follows: Figure 1 As shown.

[0033] The ICB bus section mainly handles read / write protocols, transmitting the data (data) that the host needs to encrypt / decrypt, along with configuration data such as encryption / decryption selection signals (encdec_sel) and round selection signals (round_sel), to the SM4 algorithm core. Then, it transmits the data (out_data) calculated by the algorithm core back to the host.

[0034] Specifically, the computation process mainly consists of encryption / decryption operations and key expansion operations. The encryption process includes 32 rounds of nonlinear iterations and one inversion transformation. Each round of iteration is implemented through round key addition and synthetic permutation. In each round of iteration, the round key rk is used. i An XOR operation is performed, and the round key is generated using a key expansion algorithm. Specifically, for each round iteration, from X... i To X i+4 In the state update, a nonlinear transformation is performed through a synthetic permutation function T, as shown in the following formula:

[0035]

[0036] Wherein, the synthetic permutation function is T(·)=L(τ(·)), and τ(m)=S(m) represents the S-box substitution. This represents a linear transformation. After 32 iterations, the state vector (X) will be transformed. 32 ,X 33 ,X 34 ,X 35 The ciphertext output (Y0, Y1, Y2, Y3) is obtained by reversing the order. The decryption operation is the reverse process of encryption.

[0037] The generation of round keys is the same as the key expansion process, which is similar to the encryption process, mainly differing in the linear shift operation. Specifically, key expansion generates 32 round keys rk. i It shares an S-box with the encryption and decryption processes. The algorithm uses system parameters FK = (FK0, FK1, FK2, FK3) and a fixed parameter CK. i (Round constant) is used to initialize the nonlinear iterative computation of the key.

[0038] The initial key (k0,k1,k2,k3) for key expansion is obtained by XORing the user key K = (K0,K1,K2,K3) with the system parameter FK, i.e.:

[0039]

[0040] In each round of iteration, the round key rk i Generated by the following formula:

[0041]

[0042] Where T(·)=L(τ(·)), τ(m)=S(m) represents S-box substitution. This represents a linear transformation. After 32 iterations, the generated rk i The value will serve as the round key required for each round of the encryption and decryption process.

[0043] The SM4 algorithm core mainly includes a control module, a parameter storage module, an S-box module, an encryption / decryption module, a key expansion module, and a round buffer module. The functional modules are described below:

[0044] 1. Control Module

[0045] The control module implements bit-width matching and signal allocation functions, and is in the form of a state machine, as shown below. Figure 2 As shown, the state is divided into four states: Idle (IDLE), Encryption (EC_EN), Decryption (DEC_EN), Key Preparation (PRE_KEY), and Key Expansion (KEY_EXP). When the state data (EN_SEL) transmitted from the ICB bus is received, it is parsed and passed to the corresponding module. The state machine then transitions from the IDLE state to the corresponding state. If EN_SEL is 00, it is in a reset state and enters the IDLE state; if EN_SEL is 11, the state machine transitions from IDLE to PRE_KEY, and then to KEY_EXP; if EN_SEL is 01, the state machine transitions from IDLE to EN_EN; if EN_SEL is 10, the state machine transitions from IDLE to DEC_EN.

[0046] 2. Parameter storage module

[0047] The parameter storage module mainly stores the system parameter FK and fixed parameter CK required during the SM4 algorithm key expansion process. When the control module gives an enable signal, it transmits these parameters to the key expansion module.

[0048] 3. S-box module

[0049] The S-box module stores the mapping data during the nonlinear transformation process of key expansion and encryption / decryption, and uses a lookup table method to implement the S-box conversion. Since key expansion and encryption / decryption use the same S-box, to save hardware resources, the two modules share a single S-box module.

[0050] 4. Encryption / Decryption Module

[0051] The encryption / decryption module consists of two parts: round transformation and reverse transformation. Each round transformation includes shifting, S-box conversion, and corresponding XOR operations. If there is only one round structure, the round transformation requires 32 iterations. Using a combination of pipelined and iterative loops can improve throughput, such as a four-stage pipeline combined with eight iterations. Upon receiving the round selection signal from the control module, the number of loops and the pipeline structure are adjusted. Since the encryption and decryption processes are identical, only in reverse order, encryption and decryption are multiplexed to reduce area consumption; therefore, the decryption key input is the reverse of the encryption key.

[0052] 5. Key Expansion Module

[0053] The key expansion module mainly consists of round transformations, each of which includes shifting, S-box conversion, and corresponding XOR operations. It also employs a combination of pipelined and iterative loops, adjusting the number of rounds and pipeline structure upon receiving the round selection signal parsed by the control module.

[0054] 6. Wheel buffer module

[0055] The round buffer module mainly consists of a register array, a data selector, and timing control logic, and is used to store the intermediate data generated by the encryption / decryption module and the key expansion module in each round.

[0056] Since the encryption and decryption processes are identical, only in reverse order, they are reused to reduce area consumption. Simultaneously, a "variable round merging" structure is introduced in this design, allowing the encryption / decryption module and key expansion module to flexibly set the number of merged rounds. Specific configurable information is shown in Table 1. The overall system block diagram is as follows. Figure 3 As shown, after each round of operations, the key expansion module stores the intermediate key result in a register for use by the encryption and decryption modules, thereby reducing the number of registers. Furthermore, the key expansion module and the encryption / decryption module can work in parallel for most rounds, effectively improving the algorithm's execution efficiency.

[0057] Table 1 Key Expansion and Encryption / Decryption Round Configuration Table

[0058]

[0059] Example 2

[0060] The SM4 algorithm IP proposed in this invention possesses dynamic configuration capabilities, allowing for flexible adjustments based on IoT application scenarios to meet diverse performance and resource requirements, thereby improving the algorithm's practicality and efficiency. This IP is particularly suitable for scenarios with low clock rates and small data volumes, such as in smart environmental monitoring sensors where devices typically upload small amounts of data under specific conditions, such as air quality or temperature and humidity data. This IP can operate efficiently at low clock rates, providing secure data encryption for such low-power devices and ensuring data transmission security. Its flexible configuration allows the IP to adapt to the encryption performance requirements of different devices in diverse IoT environments, meeting the needs for efficient and secure data transmission.

[0061] In the data transmission section, the design employs a custom bus ICB (Internal Compact Bus) connection method on the Hummingbird E203 processor to connect the designed SM4 algorithm IP to the Hummingbird E203. Compared with the traditional AXI and AHB protocols, the ICB protocol is simpler and easier to control, making it suitable for resource-constrained IoT device applications. The ICB bus contains only two independent channels: a command channel and a result return channel. Read and write operations share the command and return channels, greatly simplifying the communication structure.

[0062] The timing control of the ICB is also very simple: the master device sends a write operation request to the slave device through the ICB command channel. When the signal icb_cmd_read is low (write request) or high (read request), the slave device immediately accepts the request and sets the icb_cmd_ready signal high when the request is valid, indicating that the request has been successfully received. If the slave device returns a correct feedback result in the same clock cycle, the icb_rsp_ready signal is set high, and the master device can immediately receive this result. Through this compact and explicit control method, the ICB achieves low-latency transmission response, reduces the complexity of data transmission, and enables the IP core to perform data interaction efficiently.

[0063] In the encryption / decryption section, when IoT devices require high-speed encryption while being limited by hardware resources, this invention provides an efficient hardware configuration scheme. The number of key expansion and encryption / decryption rounds can be configured to four, and an eight-stage pipeline structure is adopted to improve throughput. The system block diagram of the four-round integration is as follows: Figure 4As shown in the diagram, in this structure, the keyexpansion module consists of multiple "one round for exp" sub-modules. Each sub-module performs one round of key expansion, sequentially generating and updating the round key. The multiplexer MUX1 is used to configure register addresses so that intermediate results are stored in appropriate registers during the iterative key generation process. MUX2 and MUX3 are used to switch the input data for the first and subsequent iterations. The advantage of this design is that it allows for flexible adjustment of the number of encryption / decryption rounds, thereby balancing hardware consumption and computational speed in different scenarios. Assume the data to be encrypted is date_in = (X0, X1, X2, X3), and the initial round key rk = (r0, r1, r2, r3).

[0064] Step 1: The CPU sends encryption / decryption requests and configuration information via the ICB bus.

[0065] Step 2: After receiving the information, the SM4 algorithm IP core starts configuring the number of encryption / decryption rounds and reads the data that needs to be encrypted.

[0066] Step 3: After the data preparation is completed, the first round of key expansion is carried out in an 8-stage pipeline, and the output of each stage of the pipeline is temporarily stored in the round buffer module.

[0067] Step 4: Use the key from the round buffer module to perform the first round of 8-stage pipeline encryption and decryption operations, while simultaneously performing the second round of 8-stage pipeline key expansion, and save all intermediate data to the round buffer module.

[0068] Step 5: Repeat step 4 three times.

[0069] Step 6: After 4 rounds of repetition, the output data is returned to memory via the ICB bus.

[0070] When IoT devices are in a scenario with extremely limited hardware resources, the required key expansion and encryption / decryption rounds should be set to 32 rounds, i.e., 32 iterations. The specific structure is as follows: Figure 5 As shown, this is equivalent to ordinary SM4 encryption and decryption, but the difference is that, except for the key expansion in the first round and the encryption / decryption calculation in the last round, the two are almost parallel, saving resources while ensuring speed. Assume that the data to be encrypted is date_in=(X0,X1,X2,X3), and the initial round key rk=(r0,r1,r2,r3).

[0071] Step 1: The CPU sends encryption / decryption requests and configuration information via the ICB bus.

[0072] Step 2: After receiving the information, the SM4 algorithm IP core starts configuring the number of encryption / decryption rounds and reads the data that needs to be encrypted.

[0073] Step 3: After the data preparation is completed, the first round of key expansion is performed, and the output is temporarily stored in the round buffer module.

[0074] Step 4: Use the key of the round buffer module to perform the first round of encryption and decryption operations, and at the same time perform the second round of key expansion, and save all intermediate data to the round buffer module.

[0075] Step 5: Repeat step 4 for 31 rounds.

[0076] Step 6: After 32 rounds of repetition, the output data is returned to memory via the ICB bus.

[0077] Example 3

[0078] The present invention also provides a system for implementing the SM4 algorithm with a dual variable wheel structure. The system is used to implement the method described in any one of the above methods. The system includes: a first transmission module and a second transmission module.

[0079] The first transmission module is used to transmit the configuration data required by the host to the SM4 algorithm core via the ICB bus;

[0080] The second transmission module is used to transmit the data calculated by the SM4 algorithm core to the host.

[0081] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for implementing the SM4 algorithm with a dual variable wheel structure, characterized in that, The method includes: The configuration data required by the host is transmitted to the SM4 algorithm core via the ICB bus. The data calculated by the SM4 algorithm core is transmitted to the host computer. The SM4 algorithm core includes: a control module, a parameter storage module, an S-box module, an encryption / decryption module, a key expansion module, and a round buffer module; The control module, used for bit-width matching and signal allocation, is a state machine with four states: IDLE (idle), EC_EN (encryption), DEC_EN (decryption), PRE_KEY (key preparation), and KEY_EXP (key expansion). Upon receiving state data (EN_SEL) from the ICB bus, it parses the data and passes it to the corresponding module, causing the state machine to transition from the IDLE state to the appropriate state. For example, if EN_SEL is 00, it enters the reset state and then the IDLE state; if EN_SEL is 11, the state machine transitions from IDLE to PRE_KEY, and then to KEY_EXP; if EN_SEL is 01, it transitions from IDLE to EN_EN; and if EN_SEL is 10, it transitions from IDLE to DEC_EN. The parameter storage module is used to store the system parameter FK and fixed parameter CK required during the SM4 algorithm key expansion process. When the control module gives an enable signal, the parameter is transmitted to the key expansion module. The S-box module is used to store mapping data during the nonlinear transformation process of key expansion and encryption / decryption. The S-box transformation is implemented using a lookup table method. The encryption / decryption module is divided into two parts: round transformation and reverse transformation. Each round transformation includes shifting, S-box conversion, and corresponding XOR operations. It adopts a combination of pipeline and loop iteration. When the round selection signal parsed by the control module is received, the number of loop rounds and pipeline structure are adjusted. The decryption key input is the reverse of the encryption key. The key expansion module is the round transformation part. Each round transformation also includes shifting, S-box transformation and corresponding XOR operation. The class adopts a combination of pipeline and loop iteration. When it receives the round selection signal parsed by the control module, it adjusts the number of loop rounds and pipeline structure.

2. The method according to claim 1, characterized in that, The configuration data required by the host includes: encryption / decryption data, encryption / decryption selection signals, and round selection signals.

3. A system for implementing the SM4 algorithm with a dual variable wheel structure, the system being used to implement the method described in any one of claims 1-2, characterized in that, The system includes: a first transmission module and a second transmission module; The first transmission module is used to transmit the configuration data required by the host to the SM4 algorithm core via the ICB bus; The second transmission module is used to transmit the data calculated by the SM4 algorithm core to the host.

Images