Mask protection method and device and electronic equipment

Abstract

The invention relates to a mask protection method and device and electronic equipment. The method comprises the following steps: in each round of encryption process, determining to-be-encrypted data of the round and random data of the round; generating a selection signal matched with a target bit in the random data of the current round; under the condition that the selection signal indicates to start the mask protection mode of the current round, performing mask processing on the to-be-encrypted data of the current round based on the random data of the current round to obtain mask data of the current round; based on the mask data of the current round, carrying out encryption operation of the current round to obtain an encryption result of the current round; under the condition that the selection signal indicates to start the basic encryption mode of the current round, carrying out the encryption operation of the current round on the to-be-encrypted data of the current round to obtain an encryption result of the current round; wherein under the condition that the current round is not the last round, the encryption result of the current round is used as the to-be-encrypted data of the next round of the current round. By adopting the method, the safety can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a mask protection method, device and electronic equipment. Background Art

[0002] With the development of information security technology, the Advanced Encryption Standard (AES) came into being. It completes data encryption through multiple rounds of byte substitution (SubBytes), row shift (ShiftRows), column mixing (MixColumns) and round key addition (AddRoundKey) operations.

[0003] However, during the hardware implementation of the Advanced Encryption Standard, intermediate key-related values may be leaked through side channel information during device operation, such as power consumption, electromagnetic radiation, execution time, and heat changes. This side channel information can then be captured and analyzed by attackers, posing certain security risks. Summary of the Invention

[0004] Based on this, it is necessary to provide a mask protection method, device and electronic device that can improve security in response to the above technical problems.

[0005] In a first aspect, the present application provides a mask protection method, comprising: During each round of encryption, the data to be encrypted and the random data of this round are determined; generating a selection signal that matches a target bit in the random data of the current round; When the selection signal indicates to start the mask protection mode of the current round, masking the data to be encrypted in the current round based on the random data of the current round to obtain mask data of the current round; Performing an encryption operation of this round based on the mask data of this round to obtain an encryption result of this round; When the selection signal indicates to start the basic encryption mode of the current round, performing the encryption operation of the current round on the data to be encrypted in the current round to obtain the encryption result of the current round; Wherein, in the case that the current round is not the last round, the encryption result of the current round is used as the data to be encrypted in the next round of the current round.

[0006] In a second aspect, the present application further provides a mask protection device, comprising a random number generation module, a signal generation module, a selector, a mask protection circuit, and a basic encryption circuit; the random number generation module is respectively connected to the signal generation module, the mask protection circuit, and the basic encryption circuit; the selector is respectively connected to the signal generation module, the mask protection circuit, and the basic encryption circuit; The random number generation module is used to generate random data for each round of encryption; The signal generating module is configured to generate a selection signal that matches a target bit in the random data of the current round; The selector is configured to receive the selection signal, and to enable the mask protection circuit when the selection signal indicates that the mask protection mode of this round is enabled, and to enable the basic encryption circuit when the selection signal indicates that the basic encryption mode of this round is enabled; The mask protection circuit is configured to, when enabled, receive the random data of the current round and the data to be encrypted of the current round, perform mask processing on the data to be encrypted of the current round based on the random data of the current round to obtain the mask data of the current round, and perform the encryption operation of the current round based on the mask data of the current round to obtain the encryption result of the current round; The basic encryption circuit is used to receive the data to be encrypted in the current round when it is enabled, perform the encryption operation of the current round on the data to be encrypted in the current round, and obtain the encryption result of the current round; wherein, if the current round is not the last round, the encryption result of the current round is used as the data to be encrypted in the next round of the current round.

[0007] In a third aspect, the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps in the above method when executing the computer program.

[0008] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps in the above method when executed by a processor.

[0009] In a fifth aspect, the present application also provides a computer program product, comprising a computer program, which implements the steps in the above method when executed by a processor.

[0010] The mask protection method, apparatus, electronic device, storage medium, and computer program product described above determine the data to be encrypted and the random data for each round of encryption. The random data for this round is random, and a selection signal is generated that matches the target bits in the random data for this round, thereby ensuring the randomness of the selection signal during each round of encryption. When the selection signal indicates that the mask protection mode for this round is enabled, the data to be encrypted for this round is masked based on the random data for this round to obtain the mask data for this round. An encryption operation for this round is performed based on the mask data for this round to obtain the encryption result for this round. This ensures that the true intermediate values are always covered by the mask, effectively blocking the correlation between the true intermediate values and side channel information, thereby ensuring security. When the selection signal indicates that the basic encryption mode for this round is enabled, the encryption operation for this round is performed on the data to be encrypted for this round to obtain the encryption result for this round. If this round is not the last round, the encryption result for this round is used as the data to be encrypted for the next round, thereby achieving multi-round encryption. The selection signal can indicate whether to enable the mask protection mode or the base encryption mode for each round. Therefore, the randomness of the selection signal ensures the unpredictability of the mode used in each encryption round. This unpredictability prevents side-channel attackers from developing effective statistical analysis models for each mode, further enhancing security. During the multi-round encryption process, the direct protection of the mask protection mode and the unpredictability of both the mask protection mode and the base encryption mode are simultaneously introduced, creating a dual protection mechanism that significantly enhances security. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A diagram of the application environment of a mask protection method provided in an embodiment of the present application.

[0012] Figure 2 A flowchart of a mask protection method provided in an embodiment of the present application.

[0013] Figure 3 A flowchart of the inversion operation step in a byte substitution module provided in an embodiment of the present application.

[0014] Figure 4 This is a diagram of the internal structure of a mask protection device provided in an embodiment of the present application.

[0015] Figure 5 A simplified flowchart of a mask protection method provided in an embodiment of the present application.

[0016] Figure 6 This is a structural block diagram of a mask protection device provided in an embodiment of the present application.

[0017] Figure 7This is a diagram of the internal structure of an electronic device provided in an embodiment of the present application.

[0018] Figure 8 This is a diagram of the internal structure of another electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0020] In an exemplary embodiment, Figure 1 , a diagram illustrating an application environment for a mask protection method is provided. The mask protection device includes a random number generation module 102, a signal generation module 104, a selector 106, a mask protection circuit 108, and a basic encryption circuit 110. The random number generation module 102 is connected to the signal generation module 104, the mask protection circuit 108, and the basic encryption circuit 110, respectively. The selector 106 is connected to the signal generation module 104, the mask protection circuit 108, and the basic encryption circuit 110, respectively.

[0021] The random number generation module 102 can generate random data for each round of encryption. The signal generation module 104 can generate a selection signal that matches the target bits in the random data for the current round. The selector 106 can receive the selection signal and, if the selection signal indicates that the mask protection mode for the current round is enabled, enable the mask protection circuit 108. If the selection signal indicates that the basic encryption mode for the current round is enabled, enable the basic encryption circuit 110.

[0022] When enabled, the mask protection circuit 108 can receive the current round of random data and the current round of data to be encrypted, perform a mask process on the current round of data to be encrypted based on the current round of random data to obtain the current round of mask data, and perform the current round of encryption operation based on the current round of mask data to obtain the current round of encryption result. When enabled, the basic encryption circuit 110 can receive the current round of data to be encrypted, perform the current round of encryption operation on the current round of data to be encrypted, and obtain the current round of encryption result.

[0023] In some embodiments, the mask protection method provided in this application may also be applied to electronic devices. The electronic devices may include, but are not limited to, at least one of a terminal or a server.

[0024] In some embodiments, the mask protection device may be built-in or integrated into an electronic device. The electronic device may implement the mask protection method provided in this application by driving the mask protection device.

[0025] In an exemplary embodiment, Figure 2 As shown, a flow chart of a mask protection method is provided, in which the method is applied to Figure 1 The mask protection device shown is used as an example for description, including the following steps 202 to 210.

[0026] Step 202: During each round of encryption, the data to be encrypted and the random data of the current round are determined.

[0027] For example, the random data for each round may include a pseudo-random number generated based on the random seed for each round. During the first round of encryption, the mask protection device may obtain the data to be encrypted and the random seed for the current round. During each subsequent round of encryption, the encryption result of the previous round is determined as the data to be encrypted for the current round, and a random seed associated with the random data for the previous round is determined. During each round of encryption, pseudo-random numbers are generated based on the random seed for the current round to obtain the random data for the current round.

[0028] In some embodiments, the random number seed associated with the previous round of random data may include at least one of the previous round of random data, random substitution data obtained after a byte substitution operation on the previous round of random data, or data obtained after a Boolean operation on the previous round of random data.

[0029] In some embodiments, the mask protection device can split the plaintext data into at least two shared factors. In the first round of encryption, the shared factors are subjected to round key addition operations to obtain the data to be encrypted in this round.

[0030] In some embodiments, the mask protection device can obtain the random number seed for the current round generated by the seed generation module or the random number seed for the current round input externally during the first round of encryption. The seed generation module can include at least one of a true random number generator or a pseudo-random number generator. In each round of encryption after the first round, the random data of the previous round or the random substitution data generated during the previous round of encryption is determined as the random number seed for the current round. It is understood that only the random number seed for the first round needs to be generated separately by the seed generation module. The random number seed for each round after the first round is generated during the previous round of encryption. In order to ensure randomness as much as possible, the seed generation module can preferably use a true random number generator.

[0031] In some embodiments, the seed generation module can be disposed outside the mask protection device. The seed generation module can also be disposed inside the mask protection device and connected to the random number generation module within the mask protection device. During the first round of encryption, the random number generation module can receive the random number seed for the current round generated by the seed generation module and generate pseudo-random numbers based on the random number seed to obtain random data for the current round.

[0032] In some embodiments, if the mask protection mode of the previous round is enabled, the random substitution data generated during the encryption process of the previous round is used as the random number seed for the current round. If the basic encryption mode of the previous round is enabled, the random data of the previous round is used as the random number seed for the current round.

[0033] In some embodiments, the mask protection device may include a shared generator, a random number generation module, a mask protection circuit, and a basic encryption circuit. The shared generator is connected to the mask protection circuit and the basic encryption circuit respectively. The random number generation module is connected to the mask protection circuit and the basic encryption circuit respectively.

[0034] The random number generation module can generate random data for each round of encryption. During the first round of encryption, the shared generator can receive plaintext data and split the plaintext data into at least two shared factors. The enabled mask protection circuit or the enabled basic encryption circuit can receive the shared factors and perform a round key addition operation on the shared factors to obtain the encrypted data for the current round. Furthermore, during each subsequent round of encryption, the encryption result of the previous round is received to obtain the encrypted data for the current round.

[0035] In some embodiments, the random number generation module may include at least one of a true random number generator or a pseudo random number generator. It is understood that since a true random number generator consumes more resources, a pseudo random number generator may be preferred as the random number generation module.

[0036] In some embodiments, the pseudo-random generator may be, but is not limited to, a linear feedback shift register.

[0037] In some embodiments, both the mask protection circuit and the basic encryption circuit include a round key addition module. The round key addition module is used to perform round key addition operations. It is understood that after the shared factor is processed by the round key addition module, the encrypted data for the current round can be obtained.

[0038] Step 204: Generate a selection signal that matches the target bit in the random data of this round.

[0039] The selection signal indicates whether to enable mask protection mode or basic encryption mode for each round. Mask protection mode refers to an encryption mode that applies mask protection. Basic encryption mode refers to an encryption mode that does not apply mask protection. In both modes, the encryption operations in each round except the final round include byte substitution, row shift, column mix, and round key addition. The final round includes byte substitution, row shift, and round key addition.

[0040] Exemplarily, the mask protection device may determine a value of at least one target bit from the random data of this round, and generate a selection signal that matches the value of at least one target bit.

[0041] In some embodiments, the mask protection device can determine the respective level states corresponding to the values of at least one target bit. The selection signal is determined based on the respective level states. For example, the number of target bits can be 1. If the value of the target bit is 1, the level state of the matching selection signal can be a high level. If the value of the target bit is 0, the level state of the matching selection signal can be a low level.

[0042] In some embodiments, the mask protection device can determine the timing of each level state based on the order of at least one target bit. The level states are combined into a selection signal according to the timing of each level state. For example, the number of target bits can be 3. If the values on the three target bits are 1, 0, and 1 respectively, the level state of the matching selection signal can be high level-low level-high level. If the values on the three target bits are 0, 1, and 0 respectively, the level state of the matching selection signal can be low level-high level-low level.

[0043] In some embodiments, the mask protection device may perform a Boolean operation on the value of at least one target bit to obtain a Boolean operation result, and generate a selection signal based on a level state corresponding to the Boolean operation result.

[0044] In some embodiments, the level state of the selection signal can be high or low. Different level states are used to indicate whether to enable the mask protection mode or the basic encryption mode for each round. For example, when the level state of the selection signal is high, it can be used to indicate whether to enable the mask protection mode for each round. When the level state of the selection signal is low, it can be used to indicate whether to enable the basic encryption mode for each round.

[0045] In some embodiments, the selection signal may include different level state combinations, which are used to indicate whether to enable the mask protection mode or the basic encryption mode for each round.

[0046] In some embodiments, the mask protection device may include a signal generation module. The signal generation module is connected to the random number generation module. The random number generation module can generate random data for each round of encryption. Furthermore, the signal generation module can receive the random data for each round and generate a selection signal that matches a target bit in the random data for each round.

[0047] Step 206 : When the selection signal indicates to start the mask protection mode of this round, mask processing is performed on the data to be encrypted in this round based on the random data of this round to obtain the mask data of this round.

[0048] Exemplarily, when the selection signal indicates to start the mask protection mode of this round, the mask protection device may perform an XOR operation on the random data of this round and the data to be encrypted of this round to obtain the mask data of this round.

[0049] In some embodiments, the mask protection mode and basic encryption mode can be implemented in hardware. A select signal instructs a multiplexer (MUX) to activate the mask protection circuit or basic encryption circuit for each round. The mask protection circuit is a hardware circuit that implements the mask protection mode. The basic encryption circuit is a hardware circuit that implements the basic encryption mode. The mask protection device can transmit a select signal to the selector, instructing the selector to activate the mask protection circuit or basic encryption circuit based on the level of the select signal.

[0050] In some embodiments, the mask guard device may include a signal generating module and a selector connected to each other. The selector may receive a selection signal generated by the signal generating module.

[0051] In some embodiments, the mask protection device may transmit a selection signal to the selector to instruct the selector to enable the mask protection circuit when the level of the selection signal is at a first level, and to enable the mask protection circuit when the level of the selection signal is at a second level. The first level may be, but is not limited to, a high level, and the second level may be, but is not limited to, a low level.

[0052] In some embodiments, the mask protection mode and the basic encryption mode may be implemented by software. This embodiment does not limit the specific manner of software implementation.

[0053] In some embodiments, the mask protection device may have a built-in mask protection program. When the selection signal indicates that the mask protection mode for the current round is enabled, the mask protection program may be run by the mask protection device to mask the data to be encrypted in the current round based on the random data in the current round to obtain the mask data for the current round, and then perform the encryption operation in the current round based on the mask data for the current round to obtain the encryption result for the current round.

[0054] In some embodiments, the mask protection device may use at least one masking method to mask the data to be encrypted in this round based on the random data in this round to obtain the masked data in this round. The masking method may include a modular addition operation, an exclusive-or operation, or a finite field multiplication operation.

[0055] Step 208: Perform encryption operation of this round based on the mask data of this round to obtain encryption result of this round.

[0056] Exemplarily, the mask protection device may perform a byte substitution operation and a linear transformation operation based on the mask data of the current round to obtain the encryption result of the current round. The linear transformation operation of each round except the last round includes a row shift operation, a column mix operation, and a round key addition operation. The linear transformation operation of the last round includes a row shift operation and a round key addition operation.

[0057] In some embodiments, each round of encryption operations can be implemented by an encryption operation module in the mask protection circuit or the basic encryption circuit. The two circuits can reuse various encryption operation modules. Each encryption operation module may include a byte transformation module, a row shift module, a column mixing module, and a round key addition module. The byte transformation module is used to perform byte substitution operations. The row shift module is used to perform row shift operations. The column mixing module is used to perform column mixing operations. The round key addition module is used to perform round key addition operations.

[0058] It is understood that encryption operations in all rounds are not identical. Therefore, the mask protection circuit or the basic encryption circuit can adjust the available operation modules in each round based on the current round. For example, in the last round, the mask protection circuit or the basic encryption circuit can disable the column mix module used for the column mix operation.

[0059] In some embodiments, the mask protection device may perform a byte substitution operation based on the current round's mask data and the current round's random data to obtain mask substitution data corresponding to the current round's mask data and random substitution data corresponding to the current round's random data. A linear transformation operation is then performed based on the random substitution data and the mask substitution data to obtain the current round's encryption result.

[0060] In some embodiments, the mask protection device may perform a demasking process on the mask-substituted data based on the random substitution data to obtain byte-substituted data of this round, and perform a linear transformation operation of this round on the byte-substituted data of this round to obtain an encryption result of this round.

[0061] In some embodiments, the mask protection device may perform a linear transformation operation on the masked substitution data to obtain a masked encryption result, and demask the masked encryption result based on the random substitution data to obtain a current round of encryption result.

[0062] In some embodiments, the mask protection device may include a mask protection circuit. The mask protection circuit that is enabled may perform encryption operations of this round based on the mask data of this round to obtain encryption results of this round.

[0063] Step 210, when the selection signal indicates to start the basic encryption mode of this round, the encryption operation of this round is performed on the data to be encrypted in this round to obtain the encryption result of this round; wherein, when this round is not the last round, the encryption result of this round is used as the data to be encrypted in the next round of this round.

[0064] Exemplarily, the mask protection device may include a selector connected to a signal generation module, and a basic encryption circuit connected to the selector. The signal generation module may generate a selection signal. The selector may receive the selection signal and, when the selection signal is at a second level, enable the basic encryption circuit. The enabled basic encryption circuit may then perform the current round of encryption operations on the data to be encrypted, thereby obtaining the current round of encryption results.

[0065] In some embodiments, the basic encryption mode can be implemented via software. For example, the mask protection device can include a built-in basic encryption program for each round. When the selection signal indicates that the basic encryption mode for the current round has been activated, the mask protection device can execute the basic encryption program to perform the encryption operation for the current round on the data to be encrypted, thereby obtaining the encryption result for the current round.

[0066] In the above-mentioned mask protection method, during each round of encryption, the data to be encrypted and the random data for this round are determined; the random data for this round is random, and a selection signal is generated that matches the target bits in the random data for this round, thereby ensuring the randomness of the selection signal during each round of encryption. When the selection signal indicates that the mask protection mode for this round is enabled, the data to be encrypted for this round is masked based on the random data for this round to obtain the mask data for this round; an encryption operation is performed on the mask data for this round to obtain the encryption result for this round, thereby ensuring that the true intermediate value is always covered by the mask, effectively blocking the correlation between the true intermediate value and the side channel information, and ensuring security. When the selection signal indicates that the basic encryption mode for this round is enabled, the encryption operation for this round is performed on the data to be encrypted for this round to obtain the encryption result for this round; wherein, if this round is not the last round, the encryption result of this round is used as the data to be encrypted for the next round of this round, thereby achieving multi-round encryption. The selection signal can indicate whether to enable the mask protection mode or the base encryption mode for each round. Therefore, the randomness of the selection signal ensures the unpredictability of the mode used in each encryption round. This unpredictability prevents side-channel attackers from developing effective statistical analysis models for each mode, further enhancing security. During the multi-round encryption process, the direct protection of the mask protection mode and the unpredictability of both the mask protection mode and the base encryption mode are simultaneously introduced, creating a dual protection mechanism that significantly enhances security.

[0067] In some embodiments, during each round of encryption, the data to be encrypted and the random data of this round are determined, including: during each round of encryption, the data to be encrypted and the random number seed of this round are determined; and pseudo-random numbers are generated based on the random number seed of this round to obtain the random data of this round.

[0068] Exemplarily, the mask protection device can split the plaintext data into at least two shared factors. During the first round of encryption, a round key addition operation is performed on the shared factors to obtain the encrypted data for the current round and the random number seed for the current round. During each round of encryption, the encryption result of the current round is output as the encrypted data for the next round. If the selection signal indicates to enable the mask protection mode for the current round, the random replacement data of the current round is output as the random number seed for the next round. If the selection signal indicates to enable the basic encryption mode for the current round, the random data of the current round is output as the random number seed for the next round. During each round of encryption after the first round, the encrypted data for the current round outputted in the previous round and the random number seed for the current round are obtained.

[0069] The random number seed of this round is input into the random number generation module to instruct the random number generation module to generate pseudo-random numbers to obtain the random data of this round.

[0070] In some embodiments, a random number generation module is connected to the basic encryption circuit and the mask protection circuit, respectively. The random number generation module can receive the random number seed for each round output by the basic encryption circuit or the mask protection circuit. The mask protection circuit outputs the random substitution data generated in each round as the random number seed for the next round, and the basic encryption circuit outputs the random data generated in each round as the random number seed for the next round.

[0071] In some embodiments, the random number generation module may be, but is not limited to, a linear feedback shift register. A linear feedback shift register (LFSR) is a digital circuit that generates a pseudo-random sequence through a linear feedback mechanism. The LFSR receives the current round's random number seed and generates pseudo-random numbers based on a primitive polynomial to produce the current round's random data.

[0072] In this embodiment, generating pseudo-random numbers consumes fewer resources than generating true random numbers. By determining the data to be encrypted and the random number seed of each round during the encryption process, and generating pseudo-random numbers based on the random number seed of the current round to obtain the random data of the current round, computing resources can be greatly saved.

[0073] In some embodiments, generating a selection signal that matches a target bit in the current round of random data includes: determining values on at least two target bits from the current round of random data; performing a Boolean operation based on the values on the at least two target bits to obtain a Boolean operation result; and generating a selection signal based on a level state corresponding to the Boolean operation result.

[0074] For example, the mask protection device can extract the value of each target bit from the random data of the current round. An exclusive OR operation is performed on the value of each target bit to obtain a Boolean operation result. If the Boolean operation result is non-zero, a selection signal with a first level state is generated. If the Boolean operation result is zero, a selection signal with a second level state is generated.

[0075] In some embodiments, to prevent multiple consecutive repeated bits from affecting the generation effect of the selection signal, such as 0000 or 1111, the number of bits between each two target bits is not less than 1. The number of bits between each two target bits can be related to the total number of target bits. For example, the number of bits between each two target bits is not less than 1 / n of the ratio of the total number of random data bits to the total number of target bits, where n is greater than 1.

[0076] In some embodiments, the first level state may be, but is not limited to, a high level state, and the second level state may be, but is not limited to, a low level state.

[0077] In some embodiments, the mask protection device may include a random number generation module and a signal generation module connected to each other. The random number generation module may generate random data for this round. Further, after receiving the random data for this round, the signal generation module may determine the values of at least two target bits from the random data for this round, perform a Boolean operation based on the values of the at least two target bits, obtain a Boolean operation result, and generate a selection signal based on the level state corresponding to the Boolean operation result.

[0078] In this embodiment, the values of at least two target bits are determined from the random data of this round; a Boolean operation is performed based on the values of the at least two target bits to obtain a Boolean operation result; a selection signal is generated based on the level state corresponding to the Boolean operation result. The selection signal is associated with the random data of this round and also has randomness. The randomness of the selection signal ensures the unpredictability of the mode adopted in each round of encryption process, which can improve the security of mask protection.

[0079] In some embodiments, an encryption operation of this round is performed based on the mask data of this round to obtain the encryption result of this round, including: performing a byte substitution operation based on the mask data of this round and the random data of this round to obtain mask substitution data corresponding to the mask data of this round, and random substitution data corresponding to the random data of this round; performing a linear transformation operation of this round based on the random substitution data and the mask substitution data to obtain the encryption result of this round.

[0080] For example, the mask protection device may convert the mask data of this round and each byte of the random data of this round from the finite field GF(2 8 ) isomorphically mapped to the finite field GF(2 4 ), in the finite field GF(2 4 ) to perform inverse operation and obtain the finite field GF(2 4 ) inverse element, based on the finite field GF(2 4 ) inverse element in the inverse isomorphism mapping, and we get the finite field GF(2 8 ) inverse element. Based on the finite field GF(2 8 ) to obtain the replacement data corresponding to each byte. The replacement data corresponding to each byte in the current round of mask data are concatenated to obtain the mask replacement data corresponding to the current round of mask data. The replacement data corresponding to each byte in the current round of random data are concatenated to obtain the random replacement data corresponding to the current round of random data.

[0081] The mask protection device can perform a demasking process on the mask substitution data based on the random substitution data to obtain the byte substitution data of this round, and perform a linear transformation operation of this round on the byte substitution data of this round to obtain the encryption result of this round.

[0082] In some embodiments, the mask protection circuit may include a byte substitution module and a linear transformation module connected to each other. The linear transformation module may include a row shift module, a column mixing module, and a round key addition module. The enabled mask protection circuit may input the mask data and random data of the current round into its own byte substitution module, and perform a byte substitution operation through the byte substitution module to obtain mask substitution data corresponding to the mask data of the current round and random substitution data corresponding to the random data of the current round. Furthermore, the mask substitution data and random substitution data are input into its own linear transformation module, and a linear transformation operation of the current round is performed through the linear transformation module to obtain the encryption result of the current round.

[0083] In some embodiments, the enabled mask protection circuit may transmit the mask data of the current round and the random data of the current round to the byte substitution module respectively.

[0084] In some embodiments, the enabled mask protection circuit may segment the mask data and random data of the current round, and then transmit each segment of the bit sequence to the byte substitution module respectively.

[0085] In some embodiments, the mask protection device can perform an exclusive-OR operation on the random substitution data and the mask substitution data to demask the mask substitution data and obtain the byte-substituted data for the current round. During each round of encryption except the final round, the byte-substituted data for the current round is sequentially subjected to a row shift operation, a column mix operation, and a round key addition operation to obtain the encryption result for the current round. During the final round of encryption, the byte-substituted data for the current round is sequentially subjected to a row shift operation and a round key addition operation to obtain the encryption result for the current round.

[0086] In some embodiments, as Figure 3 As shown in the figure, a flowchart of the inverse operation steps in the byte substitution module is provided. The byte substitution module processes each byte, and each byte is 8 bits. The 8-bit input is mapped isomorphically from GF256 to GF16 to obtain the high bit q[3:0] and the low bit p[3:0]. It can be understood that GF256 is GF(2 8 ), GF16 is GF(2 4 ). Square the high-order q[3:0] and the low-order p[3:0] respectively to obtain a high-order square result and a low-order square result. Multiply the high-order q[3:0] and the low-order p[3:0] to obtain an intermediate multiplication result. XOR the high-order square result, the intermediate multiplication result, and the low-order square result to obtain an intermediate XOR result. Inverse the intermediate XOR result to obtain the inverse element in the finite field GF16. Multiply the high-order q[3:0] and the inverse element in the finite field GF16 to obtain a first multiplication result. Obtain the high-order and low-order XOR results of the high-order q[3:0] and the low-order p[3:0]. Multiply the high-order and low-order XOR results by the inverse element in the finite field GF16 to obtain a second multiplication result. Inversely isomorphically map the first and second multiplication results from GF16 to GF256 to obtain the inverse element in the finite field GF256.

[0087] In some embodiments, the byte substitution module may implement the byte substitution operation by looking up a table.

[0088] In this embodiment, a byte substitution operation is performed based on the current round's masked data and random data to obtain masked substitution data corresponding to the current round's masked data, as well as random substitution data corresponding to the current round's random data. The side channel information generated during the byte substitution operation is related to both the random data and the masked data, further weakening the correlation between the side channel information and the true intermediate value, effectively resisting side channel attacks. During the current round of encryption, if a linear transformation operation is performed solely based on the masked substitution data, the generated encryption result will always contain mask information. Since the basic encryption mode requires the input data to be unmasked, and the encryption result of the current round is used as the data to be encrypted in the next round, any residual masking will directly undermine the logical consistency of the basic encryption mode in subsequent rounds. The random substitution data is critical for demasking. Therefore, performing a linear transformation operation based on the random substitution data and the masked substitution data in the current round enables demasking during the linear transformation operation, resulting in an unmasked encryption result for the current round and ensuring the accuracy of the basic encryption mode in the next round.

[0089] In some embodiments, the random data of this round includes a pseudo-random number generated based on the random number seed of this round; when this round is not the last round, the random data of this round or the random replacement data generated during the encryption process of this round is used as the random number seed of the next round after this round.

[0090] For example, the mask protection device can obtain the random number seed for the current round during the first round of encryption. During each round of encryption, if the selection signal indicates that the mask protection mode for the current round is enabled, the random substitution data generated in the current round is output as the random number seed for the next round. If the selection signal indicates that the basic encryption mode for the current round is enabled, the random data for the current round is output as the random number seed for the next round. Pseudo-random numbers are generated based on the random number seed for the current round to obtain the random data for the current round.

[0091] In some embodiments, the mask protection device includes a random number generation module connected to the basic encryption circuit and the mask protection circuit. The mask protection circuit, when enabled, can transmit the random substitution data generated in the current round to the random number generation module, which can receive the random substitution data and obtain a random number seed for the current round. The basic encryption circuit, when enabled, can transmit the random data generated in the current round to the random number generation module, which can receive the random data and obtain a random number seed for the current round.

[0092] In this embodiment, the random data of this round includes a pseudo-random number generated based on the random number seed of this round; when this round is not the last round, the random data of this round or the random substitution data generated during the encryption process of this round is used as the random number seed of the next round of this round. In the encryption process of each round, the recursive generation and transfer of random number seeds from this round to the next round can be achieved, which is more convenient. In addition, the use of pseudo-random numbers can avoid the call of the hardware true random number generator and reduce power consumption overhead.

[0093] In some embodiments, a byte substitution operation is performed based on the mask data of this round and the random data of this round to obtain mask substitution data corresponding to the mask data of this round and random substitution data corresponding to the random data of this round, including: determining each bit sequence that matches a preset bit width from the mask data of this round and the random data of this round; performing a byte substitution operation on each bit sequence at a preset time interval to obtain sequence substitution data corresponding to each bit sequence; and determining the mask substitution data corresponding to the mask data of this round and the random substitution data corresponding to the random data of this round based on the sequence substitution data corresponding to each bit sequence.

[0094] Exemplarily, the preset bit width is consistent with the input bit width of the byte substitution module. The total bit width of the mask data of this round and the random data of this round is greater than the preset bit width. The mask protection device can segment the mask data of this round and the random data of this round to obtain a bit sequence in which each segment is consistent with the preset bit width. For example, the total bit width of the mask data of this round and the random data of this round is twice the input bit width, and the mask data of this round and the random data of this round can be split into two bit sequences. The two bit sequences include a high-order bit sequence and a low-order bit sequence, respectively. The high-order bit sequence contains half of the high bits of the mask data of this round and half of the high bits of the random data of this round, and the low-order bit sequence contains half of the low bits of the mask data of this round and half of the low bits of the random data of this round.

[0095] The mask protection device may input each of the bit sequences into the byte substitution module, with a preset time interval between two consecutive inputs. The preset time interval is no less than the time delay of the byte substitution module. Specifically, the mask protection device may first input the low-order bit sequence into the byte substitution module, and after timing the preset time interval, input the high-order bit sequence into the byte substitution module.

[0096] The mask protection device can use the byte substitution module to perform a byte substitution operation on each byte in each bit sequence to obtain the replacement data corresponding to each byte in each bit sequence. The replacement data corresponding to each byte in the current round of mask data are spliced together to obtain the mask replacement data corresponding to the current round of mask data. The replacement data corresponding to each byte in the current round of random data are spliced together to obtain the random replacement data corresponding to the current round of random data.

[0097] In some embodiments, the mask protection device may randomly determine the preset time interval of this round from at least one preset time interval, and input each bit sequence into the byte substitution module according to the preset time interval of this round.

[0098] In some embodiments, the mask protection device may include a mask protection circuit. The enabled mask protection circuit can determine, from the current round's mask data and the current round's random data, each bit sequence that matches a preset bit width. At preset time intervals, the byte substitution module performs a byte substitution operation on each bit sequence to obtain sequence substitution data corresponding to each bit sequence. Based on the sequence substitution data corresponding to each bit sequence, the mask substitution data corresponding to the current round's mask data and the random substitution data corresponding to the current round's random data are determined.

[0099] In this embodiment, from the mask data and random data of this round, each bit sequence that matches the input bit width of the byte substitution module is determined; at a preset time interval, a byte substitution operation is performed on each bit sequence to obtain sequence substitution data corresponding to each bit sequence; based on the sequence substitution data corresponding to each bit sequence, the mask substitution data corresponding to the mask data of this round and the random substitution data corresponding to the random data of this round are determined. In the mask protection mode, the byte substitution operation is performed based on the mask data and random data of this round. The total time delay consumed includes at least one preset time interval, which is bound to be different from the time delay consumed by the byte substitution operation on the encrypted data of this round in the basic encryption mode. When the basic encryption mode and mask protection mode enabled in each round are unpredictable, the timing in the byte substitution module is also unpredictable, which is equivalent to realizing the masking of the timing, increasing the difficulty for attackers to obtain the accurate attack point and ensuring security.

[0100] In some embodiments, when the selection signal indicates to turn on the mask protection mode of this round, the data to be encrypted in this round is masked based on the random data of this round to obtain the mask data of this round, including: when the selection signal indicates to turn on the mask protection mode of this round, the mask protection circuit is selected through the selector; based on the mask protection circuit, the random data of this round and the data to be encrypted in this round are XORed to obtain the mask data of this round; when the selection signal indicates to turn on the basic encryption mode of this round, the encryption operation of this round is performed on the data to be encrypted in this round to obtain the encryption result of this round, including: when the selection signal indicates to turn on the basic encryption mode of this round, the basic encryption circuit is selected through the selector; based on the basic encryption circuit, the encryption operation of this round is performed on the data to be encrypted in this round to obtain the encryption result of this round.

[0101] Exemplarily, both the mask protection mode and the basic encryption mode are implemented in hardware. The mask protection device includes a mask protection circuit for implementing the mask protection mode and a basic encryption circuit for implementing the basic encryption mode. The mask protection device can send a selection signal to the selector to instruct the selector to enable the mask protection circuit when the level of the selection signal is at a first level, or to enable the basic encryption circuit when the level of the selection signal is at a second level.

[0102] The selected mask protection circuit can receive the random data of this round and the data to be encrypted of this round, perform an XOR operation on the random data of this round and the data to be encrypted of this round to obtain the mask data of this round, perform a byte substitution operation on the random data of this round and the mask data of this round to obtain the random substitution data corresponding to the random data of this round and the mask substitution data corresponding to the mask data of this round, then perform an XOR operation on the random substitution data and the mask substitution data to obtain the byte substitution data of this round, and finally perform a linear transformation operation of this round on the byte substitution data of this round to obtain the encryption result of this round.

[0103] The selected basic encryption circuit can receive the data to be encrypted in this round, perform a byte substitution operation on the data to be encrypted in this round to obtain the byte substitution result in this round, perform a linear transformation operation on the byte substitution result in this round to obtain the encryption result in this round.

[0104] In this embodiment, when the selection signal indicates the activation of the current round's mask protection mode, the mask protection circuit is enabled via a selector. Based on the mask protection circuit, an exclusive-OR operation is performed on the current round's random data and the current round's data to be encrypted, yielding the current round's mask data. When the selection signal indicates the activation of the current round's basic encryption mode, the basic encryption circuit is enabled via a selector. Based on the basic encryption circuit, the current round's encryption operation is performed on the current round's data to be encrypted, yielding the current round's encryption result. Using the selection signal and selector, either the mask protection circuit or the basic encryption circuit can be conveniently enabled to activate either the mask protection mode or the basic encryption mode, significantly improving convenience.

[0105] In some embodiments, as Figure 4 As shown in FIG, a diagram of the internal structure of a mask protection device is provided. The mask protection device may include a shared generator, a random number generation module, a signal generation module, a selector, a mask protection circuit, and a basic encryption circuit. The shared generator is connected to the mask protection circuit and the basic encryption circuit, respectively. The random number generation module is connected to the signal generation module, the mask protection circuit, and the basic encryption circuit, respectively. The signal generation module is connected to the selector.

[0106] Mask guards can be used to perform Figure 5 The simplified flowchart of the mask protection method is shown in FIG. Figure 5 When the level state of the selection signal is high, the "1" path in each selector is selected, and the processing flow corresponding to the mask protection circuit is realized. Figure 5 When the level state of the selection signal is low, the "0" path in each selector is selected, and the processing flow corresponding to the basic encryption circuit is realized.

[0107] The share generator may receive plaintext data and split the plaintext data into at least two share factors.

[0108] The random number generation module can receive the random number seed of the current round from the external input during the first round of encryption. In each round of encryption after the first round, the basic encryption circuit or the mask protection circuit that was selected in the previous round outputs the random number seed of the current round. In each round of encryption, pseudo-random numbers are generated according to the random number seed of the current round to obtain the random data of the current round. The signal generation module may receive random data from each round of encryption, determine the values of at least two target bits from the random data of the current round, perform an exclusive-OR operation on the values of the at least two target bits, and obtain a Boolean operation result. If the Boolean operation result is non-zero, a selection signal with a high level state is generated; if the Boolean operation result is zero, a selection signal with a low level state is generated.

[0109] Each selector can receive a selection signal, and when the level state of the selection signal is a high level state, the mask protection circuit is turned on, and when the level state of the selection signal is a low level state, the basic encryption circuit is turned on.

[0110] During the first round of encryption, the enabled mask protection circuit receives a shared factor and performs a round key addition operation on the shared factor to obtain the data to be encrypted for the current round. During each subsequent round of encryption, the circuit receives the encryption result of the previous round to obtain the data to be encrypted for the current round. During each round of encryption, the circuit receives random data for the current round. An exclusive-OR operation is performed on the random data and the data to be encrypted for the current round to obtain the mask data for the current round. Because the total bit width of the mask data and random data for the current round is twice the preset bit width, the enabled mask protection circuit can segment the mask data and random data for the current round to obtain a high-order bit sequence and a low-order bit sequence. The low-order bit sequence is first input into its own byte substitution module. After a preset time interval, the high-order bit sequence is then input into its own byte substitution module. The byte substitution module then performs a byte substitution operation on each byte in each bit sequence to obtain the corresponding substitution data for each byte in each bit sequence. The enabled mask protection circuit concatenates the substitution data corresponding to each byte in the current round's mask data to obtain the masked substitution data corresponding to the current round's masked data. It also concatenates the substitution data corresponding to each byte in the current round's random data to obtain the random substitution data corresponding to the current round's random data. The random substitution data generated in this round is output as the random number seed for the next round. An exclusive-OR operation is performed on the masked substitution data and the random substitution data to obtain the byte substitution result for this round. The linear transformation module performs a linear operation on the byte substitution result of this round to obtain the encryption result for this round.

[0111] During the first round of encryption, the enabled basic encryption circuit receives a shared factor and performs a round key addition operation on the shared factor to obtain the encrypted data for the current round. In each subsequent round of encryption, the encryption result of the previous round is received to obtain the encrypted data for the current round. During each round of encryption, the random data of the current round is directly output as the random number seed for the next round. A byte substitution module then performs a byte substitution operation on the encrypted data to obtain the byte substitution result of the current round. A linear transformation module then performs a linear operation on the byte substitution result to obtain the encryption result of the current round.

[0112] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0113] Based on the same inventive concept, embodiments of the present application also provide a mask protection device for implementing the aforementioned mask protection method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more mask protection device embodiments provided below can be found in the above-described limitations of the mask protection method and will not be further elaborated here.

[0114] In an exemplary embodiment, Figure 6 As shown, a mask protection device 600 is provided, including: a random number generation module 602, a signal generation module 604, a selector 606, a mask protection circuit 608 and a basic encryption circuit 610; the random number generation module 602 is respectively connected to the signal generation module 604, the mask protection circuit 608 and the basic encryption circuit 610; the selector 606 is respectively connected to the signal generation module 604, the mask protection circuit 608 and the basic encryption circuit 610.

[0115] The random number generation module 602 is used to generate random data for each round of encryption.

[0116] The signal generating module 604 is configured to generate a selection signal that matches a target bit in the random data of this round.

[0117] The selector 606 is used to receive a selection signal, and when the selection signal indicates to start the mask protection mode of this round, the mask protection circuit 608 is selected, and when the selection signal indicates to start the basic encryption mode of this round, the basic encryption circuit 610 is selected.

[0118] The mask protection circuit 608 is used to receive the random data of this round and the data to be encrypted of this round when it is selected, mask the data to be encrypted of this round based on the random data of this round to obtain the mask data of this round, perform the encryption operation of this round based on the mask data of this round, and obtain the encryption result of this round.

[0119] The basic encryption circuit 610 is used to receive the data to be encrypted in this round when it is selected, perform the encryption operation of this round on the data to be encrypted in this round, and obtain the encryption result of this round; wherein, if this round is not the last round, the encryption result of this round is used as the data to be encrypted in the next round of this round.

[0120] In some embodiments, the random data of the current round includes a pseudo-random number generated based on the random number seed of the current round. The mask protection circuit 608 is configured to output the random substitution data generated in the current round as the random number seed of the next round when enabled during each round of encryption. The basic encryption circuit 610 is configured to output the random data of the current round as the random number seed of the next round when enabled during each round of encryption.

[0121] In some embodiments, the random number generation module 602 is configured to receive a random number seed for each round of encryption, and generate a pseudo-random number based on the random number seed for the current round to obtain random data for the current round.

[0122] In some embodiments, the random number generation module 602 includes a linear feedback shift register; the linear feedback shift register is used to receive the random number seed of each round of encryption process, and generate pseudo-random numbers based on the random number seed of the current round to obtain random data of the current round.

[0123] In some embodiments, the signal generation module 604 is used to determine the values of at least two target bits from the random data of this round; perform a Boolean operation based on the values of at least two target bits to obtain a Boolean operation result; and generate a selection signal based on the level state corresponding to the Boolean operation result.

[0124] In some embodiments, the mask protection circuit 608 is used to perform a byte substitution operation based on the mask data of this round and the random data of this round in each round of encryption process, when enabled, to obtain mask substitution data corresponding to the mask data of this round and random substitution data corresponding to the random data of this round; and perform a linear transformation operation of this round based on the random substitution data and the mask substitution data to obtain the encryption result of this round.

[0125] In some embodiments, the mask protection circuit 608 is used to output the random data of this round or the random substitution data generated during the encryption process of this round as the random number seed for the next round if the current round is not the last round during each round of encryption.

[0126] In some embodiments, the basic encryption circuit 610 is configured to, during each round of encryption, output the random data of the current round as a random number seed for the next round if the current round is not the last round, when enabled.

[0127] In some embodiments, the mask protection circuit 608 is used to, during each round of encryption, determine, from the mask data and random data of this round, each bit sequence that matches a preset bit width, when enabled; perform a byte substitution operation on each bit sequence at a preset time interval to obtain sequence substitution data corresponding to each bit sequence; and determine, based on the sequence substitution data corresponding to each bit sequence, the mask substitution data corresponding to the mask data of this round and the random substitution data corresponding to the random data of this round.

[0128] In some embodiments, the selector 606 is used to, during each round of encryption, enable the mask protection circuit 608 when the selection signal indicates to enable the mask protection mode of this round, and enable the basic encryption circuit 610 when the selection signal indicates to enable the basic encryption mode of this round; the mask protection circuit 608 is used to, when enabled, perform an XOR operation on the random data of this round and the data to be encrypted of this round to obtain the mask data of this round; the basic encryption circuit 610 is used to, when enabled, perform the encryption operation of this round on the data to be encrypted of this round to obtain the encryption result of this round.

[0129] Each module in the mask protection device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in an electronic device in hardware form, or can be stored in a memory in the electronic device in software form, so that the processor can call and execute the corresponding operations of each module.

[0130] In an exemplary embodiment, an electronic device is provided, the internal structure of which can be as shown in FIG. Figure 7 As shown. The electronic device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The input / output interface of the electronic device is used to exchange information between the processor and an external device. The communication interface of the electronic device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a mask protection method is implemented.

[0131] In an exemplary embodiment, an electronic device is provided. The electronic device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 8 As shown. The electronic device includes a processor, memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interface. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the electronic device is used to exchange information between the processor and external devices. The communication interface of the electronic device is used to communicate with external terminals via wired or wireless means, and the wireless means can be achieved via Wi-Fi, mobile cellular networks, NFC (near field communication), or other technologies. When executed by the processor, the computer program implements a mask protection method. The display unit of the electronic device is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the electronic device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the electronic device casing, or an external keyboard, touchpad or mouse.

[0132] Those skilled in the art will understand that Figure 7 or Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the electronic device to which the solution of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0133] In one embodiment, an electronic device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0134] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0135] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0136] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the above-mentioned embodiments. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), data processing logic devices based on quantum computing, and the like.

[0137] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0138] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A mask protection method, characterized in that: The method comprises: During each round of encryption, the data to be encrypted and the random data of this round are determined; generating a selection signal that matches a target bit in the random data of the current round; When the selection signal indicates to start the mask protection mode of the current round, masking the data to be encrypted in the current round based on the random data of the current round to obtain mask data of the current round; Performing an encryption operation of this round based on the mask data of this round to obtain an encryption result of this round; When the selection signal indicates to start the basic encryption mode of the current round, performing the encryption operation of the current round on the data to be encrypted in the current round to obtain the encryption result of the current round; Wherein, in the case that the current round is not the last round, the encryption result of the current round is used as the data to be encrypted in the next round of the current round.

2. The method according to claim 1, characterized in that In each round of encryption, determining the data to be encrypted and the random data of the current round includes: During each round of encryption, the data to be encrypted and the random number seed for this round are determined; Generate pseudo-random numbers based on the random number seed of this round to obtain random data of this round.

3. The method according to claim 1, characterized in that Generating a selection signal that matches a target bit in the random data of the current round includes: Determine values of at least two target bits from the random data of the current round; Performing a Boolean operation based on the values of the at least two target bits to obtain a Boolean operation result; A selection signal is generated based on a level state corresponding to the Boolean operation result.

4. The method according to claim 1, wherein The encryption operation of this round is performed based on the mask data of this round to obtain the encryption result of this round, including: Performing a byte substitution operation based on the mask data of the current round and the random data of the current round to obtain mask substitution data corresponding to the mask data of the current round and random substitution data corresponding to the random data of the current round; A linear transformation operation of this round is performed based on the random substitution data and the mask substitution data to obtain an encryption result of this round.

5. The method according to claim 4, characterized in that The random data of this round includes a pseudo-random number generated based on the random number seed of this round; In the case that the current round is not the last round, the random data of the current round or the random replacement data generated during the encryption process of the current round is used as the random number seed for the next round after the current round.

6. The method according to claim 4, characterized in that The performing a byte substitution operation based on the mask data of the current round and the random data of the current round to obtain mask substitution data corresponding to the mask data of the current round and random substitution data corresponding to the random data of the current round includes: Determining, from the mask data of the current round and the random data of the current round, respective bit sequences that match a preset bit width; performing a byte substitution operation on each of the bit sequences at preset time intervals to obtain sequence substitution data corresponding to each of the bit sequences; Based on the sequence replacement data corresponding to each bit sequence, the mask replacement data corresponding to the mask data of the current round and the random replacement data corresponding to the random data of the current round are determined.

7. The method according to any one of claims 1 to 6, characterized in that When the selection signal indicates to start the mask protection mode of the current round, masking the data to be encrypted in the current round based on the random data of the current round to obtain the mask data of the current round includes: When the selection signal indicates to start the mask protection mode of this round, the mask protection circuit is turned on by the selector; Based on the mask protection circuit, performing an XOR operation on the random data of the current round and the data to be encrypted of the current round to obtain mask data of the current round; When the selection signal indicates to start the basic encryption mode of the current round, performing the encryption operation of the current round on the data to be encrypted in the current round to obtain the encryption result of the current round includes: When the selection signal indicates to start the basic encryption mode of this round, the basic encryption circuit is selected by the selector; Based on the basic encryption circuit, the encryption operation of this round is performed on the data to be encrypted in this round to obtain the encryption result of this round.

8. A mask protection device, characterized in that: The device includes a random number generation module, a signal generation module, a selector, a mask protection circuit and a basic encryption circuit; the random number generation module is connected to the signal generation module, the mask protection circuit and the basic encryption circuit respectively; the selector is connected to the signal generation module, the mask protection circuit and the basic encryption circuit respectively; The random number generation module is used to generate random data for each round of encryption; The signal generating module is configured to generate a selection signal that matches a target bit in the random data of the current round; The selector is configured to receive the selection signal, and to enable the mask protection circuit when the selection signal indicates that the mask protection mode of this round is enabled, and to enable the basic encryption circuit when the selection signal indicates that the basic encryption mode of this round is enabled; The mask protection circuit is configured to, when enabled, receive the random data of the current round and the data to be encrypted of the current round, perform mask processing on the data to be encrypted of the current round based on the random data of the current round to obtain the mask data of the current round, and perform the encryption operation of the current round based on the mask data of the current round to obtain the encryption result of the current round; The basic encryption circuit is used to receive the data to be encrypted in the current round when it is enabled, perform the encryption operation of the current round on the data to be encrypted in the current round, and obtain the encryption result of the current round; wherein, if the current round is not the last round, the encryption result of the current round is used as the data to be encrypted in the next round of the current round.

9. The device according to claim 8, characterized in that The random number generation module includes a linear feedback shift register; The linear feedback shift register is used to receive the random number seed of each round of encryption, and generate pseudo-random numbers according to the random number seed of the current round to obtain random data of the current round.

10. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images