AES encryption method and device based on FPGA, equipment and medium

Abstract

The invention relates to an AES (Advanced Encryption Standard) encryption method, device and equipment based on an FPGA (Field Programmable Gate Array) and a medium, based on the characteristic that front and back rounds of a calculation module are irrelevant in an encryption process, the traditional processing of a group of plaintexts is improved into serial processing of four groups of plaintexts within the same time by fully utilizing an idle time sequence of the calculation module, namely, the encryption calculation of the four groups of plaintexts is completed, and the calculation efficiency is improved. Compared with a traditional full-parallel scheme, the AES encryption speed can be greatly improved, the resource occupation is only one fourth of that of the traditional full-parallel scheme, and therefore the application requirement of the AES in the field of high-speed data real-time processing of satellites is met.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption and relates to an AES encryption method, device, equipment and medium implemented based on FPGA. Background Art

[0002] Satellite data transmission links are used to transmit payload data collected onboard to the ground via high-speed links. Since this collected payload data is generally valuable, it is desirable to encrypt this data. AES, as a common commercial encryption method, is widely used in various scenarios. However, when applied to high-speed communications, the encryption processing speed cannot keep up with the air interface data transmission rate, resulting in a low application rate in the field of high-speed real-time data processing on satellites. To increase the encryption speed of AES, direct full parallelization or increased working clock speed are generally adopted. Using full parallel processing results in excessive resource overhead, and while increasing the working clock will not significantly increase resources, it will worsen the overall timing, limiting its improvement capabilities. Therefore, in order to meet the application requirements of AES in the field of high-speed real-time data processing on satellites, how to more effectively increase the encryption speed of AES has become a technical problem that needs to be solved. Summary of the Invention

[0003] In response to the problems existing in the above-mentioned traditional methods, the present invention proposes an AES encryption method based on FPGA, an FPGA device with high-speed AES encryption function, a computer device and a computer-readable storage medium, which can more effectively improve the encryption speed of AES and meet the application requirements of AES in the field of high-speed data real-time processing of satellites.

[0004] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0005] On the one hand, an AES encryption method based on FPGA is provided, comprising the steps of:

[0006] Generate all the keys required for AES encryption through the AES key expansion module in the FPGA chip and cache them in RAM;

[0007] After reading the first round key from RAM, the four sets of plaintext input are encrypted using the first round key through the round key plus combination logic in the FPGA chip. The round key plus combination logic is the combination logic used to serially perform four round key addition operations.

[0008] After reading the next secret key of the first round key from the RAM, the serial encryption logic module in the FPGA chip serially performs byte replacement, row shift transformation, column confusion transformation and round key addition on the four groups of pre-processed data according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column confusion logic and round key addition logic, the byte replacement logic is configured as a serial byte replacement operation, the row shift logic is configured as a serial row shift transformation operation, the column confusion logic is configured as a serial column confusion transformation operation, and the round key addition logic is configured as a serial round key addition operation;

[0009] When performing the final round of encryption on the data, the serial encryption logic module serially performs byte replacement, row shift transformation and round key addition on the four groups of pre-processed data according to the final round key read from the RAM.

[0010] On the other hand, another AES encryption method based on FPGA is provided, comprising the steps of:

[0011] Generate all the keys required for AES encryption through the AES key expansion module in the FPGA chip and cache them in RAM;

[0012] After reading the first round key from RAM, the four sets of plaintext input are encrypted using the first round key through the round key plus combination logic in the FPGA chip. The round key plus combination logic is the combination logic used to serially perform four round key addition operations.

[0013] After reading the next secret key of the first round key from the RAM, the serial encryption logic module in the FPGA chip serially performs byte replacement, row shift transformation, column confusion transformation and round key addition on the four groups of pre-processed data according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column confusion logic and round key addition logic, the byte replacement logic is configured as a serial byte replacement operation, the row shift logic is configured as a serial row shift transformation operation, the column confusion logic is configured as a serial column confusion transformation operation, and the round key addition logic is configured as a serial round key addition operation;

[0014] When performing the final round of encryption on the data, the serial encryption logic module performs byte replacement and row shift transformation on the four groups of pre-processed data in serial according to the final round key read from RAM, and then the multiplexed round key addition combination logic performs round key addition on the four groups of pre-processed data.

[0015] In another aspect, there is provided an FPGA device having a high-speed AES encryption function, comprising:

[0016] AES key expansion module, used to generate all the keys required for AES encryption and cache them in RAM;

[0017] The round key addition combination logic module is used to read the first round key from RAM and perform the first round encryption on the four input plaintexts according to the first round key; the round key addition combination logic module is the combination logic for serially implementing four round key addition operations;

[0018] A serial encryption logic module is used to read the next secret key of the first round key from the RAM and then serially perform byte replacement, row shift transformation, column confusion transformation and round key addition on the four sets of pre-processed data according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column confusion logic and round key addition logic, the byte replacement logic is configured to perform serial byte replacement operations, the row shift logic is configured to perform serial row shift transformation operations, the column confusion logic is configured to perform serial column confusion transformation operations, and the round key addition logic is configured to perform serial round key addition operations;

[0019] The serial encryption logic module is also used to serially perform byte replacement, row shift transformation and round key addition on four groups of pre-processed data according to the final round secret key read from RAM when performing the final round encryption on the data.

[0020] In another aspect, another FPGA device with high-speed AES encryption function is provided, comprising:

[0021] AES key expansion module, used to generate all the keys required for AES encryption and cache them in RAM;

[0022] The round key addition combination logic module is used to read the first round key from RAM and perform the first round encryption on the four input plaintexts according to the first round key; the round key addition combination logic module is the combination logic for serially implementing four round key addition operations;

[0023] A serial encryption logic module is used to read the next secret key of the first round key from the RAM and then serially perform byte replacement, row shift transformation, column confusion transformation and round key addition on the four sets of pre-processed data according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column confusion logic and round key addition logic, the byte replacement logic is configured to perform serial byte replacement operations, the row shift logic is configured to perform serial row shift transformation operations, the column confusion logic is configured to perform serial column confusion transformation operations, and the round key addition logic is configured to perform serial round key addition operations;

[0024] When performing the final round of encryption on the data, the serial encryption logic module is also used to serially perform byte replacement and row shift transformation on the four groups of pre-processed data according to the final round secret key read from the RAM, and the round key addition combination logic module is also used to perform round key addition on the four groups of pre-processed data according to the final round secret key.

[0025] On the other hand, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned AES encryption method based on FPGA when executing the computer program.

[0026] On the other hand, a computer readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned AES encryption method based on FPGA are implemented.

[0027] One of the above technical solutions has the following advantages and beneficial effects:

[0028] The above-mentioned FPGA-based AES encryption method, device, equipment and medium are based on the characteristic that there is no correlation between the front and rear wheels of the computing module during the encryption process. By making full use of the idle timing of the computing module, the traditional processing of one group of plaintexts (i.e., a group of encrypted payload data collected on the satellite) is improved to serial processing of four groups of plaintexts in the same time, that is, the encryption calculation of four groups of plaintexts is completed. Compared with the traditional full-parallel scheme, it can not only greatly improve the AES encryption speed, but also reduce the resource usage to only one-fourth of the traditional full-parallel scheme, thereby meeting the application requirements of AES in the field of high-speed data real-time processing of satellites. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the conventional technology, the following briefly introduces the drawings required for use in the embodiments or the conventional technology descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0030] Figure 1 Schematic diagram of the flow of an AES encryption method implemented based on FPGA in one embodiment;

[0031] Figure 2 A schematic diagram of the AES128 key expansion process in one embodiment;

[0032] Figure 3 A schematic diagram of the AES128 encryption process in one embodiment;

[0033] Figure 4 A schematic diagram of a cyclic operation control process of AES encryption in one embodiment;

[0034] Figure 5 1. AES128 encryption process diagram using the above-mentioned AES encryption method in one embodiment;

[0035] Figure 6A schematic diagram of an idle period for round key addition in one embodiment;

[0036] Figure 7 A schematic diagram of utilizing the idle time of each logic module to improve operating efficiency in one embodiment;

[0037] Figure 8 This is a schematic diagram of the overall improved encryption process in one embodiment;

[0038] Figure 9 A schematic diagram of a three-way parallel encryption design in one embodiment;

[0039] Figure 10 A schematic diagram of an AES128 encryption process of another AES encryption method implemented based on FPGA in one embodiment;

[0040] Figure 11 A schematic diagram of the module framework of an FPGA device with high-speed AES encryption function in one embodiment. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and Examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the description of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0042] It should be noted that the reference to "embodiment" in this document means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The presentation of this phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It will be understood by those skilled in the art that the embodiments described herein may be combined with other embodiments. The term "and / or" used in the specification of the present invention and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0043] The following describes the implementation of the present invention in detail with reference to the accompanying drawings in the embodiments of the present invention.

[0044] The encryption of the AES encryption algorithm consists of N rounds, and the number of rounds depends on the key length: for example, a 16-byte key (AES128) corresponds to 10 rounds, a 24-byte key (AES192) corresponds to 12 rounds, and a 32-byte key (AES256) corresponds to 14 rounds. The first N-1 rounds consist of four different transformations: byte substitution (SubBytes), row shift (ShiftRows), column confusion (MixColumns), and round key addition (AddRoundKey). Among them, byte substitution is to use an S-box to complete the byte-to-byte replacement of the group. Row shift is a simple byte shift within a row. Column confusion is to use the field GF(2 8 ) is a substitute for the arithmetic properties on the ciphertext. The round key addition is a bitwise exclusive OR XOR of the current group and a part of the extended key. In the AES encryption and decryption process, each step of the decryption algorithm corresponds to the inverse operation of the encryption algorithm, and the order of all encryption and decryption operations is exactly the opposite. The key for each round in encryption and decryption is obtained by the seed key through the key expansion algorithm. The 16-byte plaintext, ciphertext and wheel key in the encryption and decryption algorithm are all represented by a 4×4 matrix. The specific detailed knowledge of the above AES can be understood by referring to the AES itself and its related explanations known in the art, and will not be elaborated one by one in this manual.

[0045] The currently used AES encryption algorithm requires multiple rounds of calculations, and each round strictly follows the four steps of byte replacement, row shifting, column obfuscation, and round key addition. Each round has time overhead, which makes it difficult to increase the encryption algorithm speed. To increase the encryption speed, the operating clock is often increased or multiple modules are used in parallel. Increasing the processing clock to increase the encryption speed has limited improvement capabilities. Excessively high clock frequency can easily lead to FPGA timing deterioration. Using multiple modules in parallel will lead to a rapid increase in resource overhead.

[0046] Existing patent CN201310047034 provides an ultra-high-speed FPGA-based AES processor and its implementation method. By compressing the operation steps, it reduces the clock cycles required for each encryption group. The present invention, based on the principle of ensuring the lack of correlation between the front and rear wheels of the computing module during the encryption process (assuming the four clocks are considered four channels, there is no correlation between the four channels; however, the same channel does have correlation due to the iterative process), rationally utilizes processing time gaps to achieve a speed increase while maintaining the original algorithm architecture, resource overhead, and process. To further increase encryption processing speed, the present invention's solution can also increase the resources of one or more encryption branches to encrypt more plaintext groups. In contrast, the existing patent CN201310047034 only increases the encryption capacity of one plaintext group per additional encryption branch. The present invention's solution maximizes performance when continuous plaintext needs to be encrypted.

[0047] In one embodiment, Figure 1 As shown, an AES encryption method based on FPGA implementation is provided, which may include the following steps S20 to S26:

[0048] S20, generates all the keys required for AES encryption through the AES key expansion module in the FPGA chip and caches them in RAM;

[0049] S22, after reading the first round key from the RAM, the four sets of input plaintext are encrypted in the first round according to the first round key through the round key plus combination logic in the FPGA chip; the round key plus combination logic is the combination logic for serially performing four round key addition operations;

[0050] S24, after reading the next secret key of the first round key from the RAM, the serial encryption logic module in the FPGA chip serially performs byte replacement, row shift transformation, column obfuscation transformation and round key addition on the four groups of pre-processed data according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column obfuscation logic and round key addition logic, the byte replacement logic is configured to perform serial byte replacement operations, the row shift logic is configured to perform serial row shift transformation operations, the column obfuscation logic is configured to perform serial column obfuscation transformation operations, and the round key addition logic is configured to perform serial round key addition operations;

[0051] S26, when performing the final round encryption on the data, the serial encryption logic module serially performs byte replacement, row shift transformation and round key addition on the four groups of pre-processed data according to the final round secret key read from the RAM.

[0052] It can be understood that, first, the AES key expansion module is used to generate the key required for AES encryption. The specific process is as follows Figure 2 As shown (wherein, in each of the figures containing ST_IDLE and IDLE, ST_IDLE and IDLE both represent idle states), it should be noted that, for the convenience of intuitive display and explanation, the following mainly uses AES128 as an example for explanation, and other AES encryption algorithms are similar. Since AES128 encryption requires ten rounds of processing, each round corresponds to a round of secret keys, so ten secret keys actually need to be generated when the AES secret key is expanded, plus the original session key, a total of 11 secret keys. Since AES128 encryption is a serial calculation, a serial process is also used when generating the extended secret key, and all generated secret keys are cached in RAM. When used for encryption, the required secret keys can be read directly from RAM, thereby saving time overhead.

[0053] Next is the AES encryption process. Taking AES128 as an example, the AES128 encryption module (i.e. the round key plus combination logic and serial encryption logic module) is used to encrypt the input plaintext according to the secret key generated by the AES128 secret key expansion. The specific process can be as follows: Figure 3 As shown, to conserve resources, in the eleven rounds of encryption, the first round's round key addition is implemented using combinatorial logic, while the same round key addition is reused for the subsequent ten rounds. In the first round, only round key addition is performed; in the final round, only byte substitution, row shifting, and round key addition are performed. The keys required for all round encryptions are read from RAM.

[0054] The AES encryption process described above shows that the main cost of AES encryption is the round encryption process. If the cost of each module in the round encryption (i.e., byte substitution, row shifting, column obfuscation, and the round key plus corresponding logic module) is 1 clock, then the total cost of AES128 round encryption is 40 clocks. To increase the encryption processing speed, a more direct approach is to share the AES key expansion process and then run multiple encryption processes in parallel according to actual needs. If the speed needs to be increased by 2 times, then one more AES encryption module can be run in parallel, but the resource cost of the round encryption will double. Alternatively, the encryption processing clock can be directly doubled, but the performance improvement of this approach is relatively limited, and it is difficult to shorten the encryption time by increasing the processing clock indefinitely.

[0055] Therefore, neither of the two direct processing methods mentioned above is an ideal way to increase encryption processing speed. To increase encryption processing speed, you can also appropriately increase resources, but if the speed increase multiplier and resource multiplier are the same, the resource overhead will still be too high and is not the best solution.

[0056] The AES encryption process has four steps: byte substitution, row shift, column confusion, and round key addition. After the first round of calculation using combinational logic (i.e., round key plus combinational logic), the subsequent ten rounds are processed cyclically using the serial encryption logic module. After a total of 11 rounds of calculations (taking AES128 as an example), the encryption of a set of plaintext is completed. The entire process control can be regarded as follows: Figure 4 As shown in the figure. In traditional technology, assuming that byte substitution, row shifting, column obfuscation, and round key addition each take up one clock, the total time overhead for the 11 rounds of key operations is 1 (first round) + 4*9 (middle rounds) + 3 (last round) = 40. A set of plaintext data requires 40 clocks to encrypt. Assuming there are 60 sets of plaintext data, the total time overhead is 40*60 = 2400 clocks.

[0057] This embodiment notes that during round encryption, the byte replacement, row shifting, column obfuscation, and round key addition processes are sequential serial processes. Furthermore, the first and second rounds of encryption in the intermediate rounds have no data correlation, except for the different keys. Therefore, this embodiment leverages this characteristic to fully utilize the timing: Specifically, the remaining three clocks of each logic block in the serial encryption logic module are serially utilized. This significantly accelerates processing speed under the same resource conditions. If simple parallel processing is employed (e.g., simply adding parallel encryption branches, as in conventional techniques), while processing speed is increased, resource overhead is at least quadrupled. It should be noted that the improvement requirements of this invention stem from satellite data transmission links. Since data is encrypted by frame, it can support plaintext serial input. Since FPGA chips are divided into sequential and combinational logic, logic not prefixed herein is assumed to be sequential logic (e.g., byte replacement logic, row shift logic, column obfuscation logic, and round key addition logic).

[0058] This embodiment also assumes that the clock overhead of byte substitution, row shifting, column obfuscation, and round key addition each takes up one clock. Therefore, in a round of encryption with four steps, four rounds of encryption can be performed in parallel by fully utilizing the remaining three clocks in each logic operation. Therefore, the total time overhead for the 11 rounds of key operations is 4*9+0+4=40, meaning that one set of plaintext is output every 40 clocks, and four sets of plaintext are encrypted every 43 clocks. The average encryption time for each set of plaintext is 10.75 clocks. Assuming there are 60 sets of plaintext data, the time overhead is 43*(60 / 4)=645 clocks.

[0059] A complete new process design for AES128 encryption can be achieved by Figure 5The process architecture shown in the figure is implemented in hardware by directly implementing the first round of round key addition in the FPGA chip as combinational logic (i.e., round key plus combinational logic). This saves one clock and allows one group of plaintext to be encrypted every 40 clocks. The byte replacement logic, row shift logic, column obfuscation logic, and round key addition logic in the FPGA chip, which are used to implement byte replacement, row shift, column obfuscation, and round key addition, are all modular in design. Taking conventional encryption design as an example, Figure 6 As shown, in the traditional technology, for round key addition, after the middle round completes the round key addition operation, it enters an idle state and needs to wait for 3 clocks before it can be used again. Therefore, the round key addition has an idle period of 3 clocks.

[0060] Based on the non-correlation of calculations between rounds (i.e., as long as the exact input is provided, the output is fixed), this embodiment fully utilizes the idle time of each logic module (i.e., by serially using the remaining three clocks of each module through time multiplexing, one logic module completes four calculations within four serial input clocks) to improve the operation efficiency. Figure 7 As shown, the specific improvement measures are as follows: Figure 7 It can be seen that the entire operation process fully utilizes the timing characteristics of each logic module. One group of plaintext can be encrypted every 40 clocks, and the average encryption time for each group of plaintext is 10.75 clocks.

[0061] The above-mentioned AES encryption method implemented based on FPGA is based on the characteristic that there is no correlation between the front and rear wheels of the computing module during the encryption process. By making full use of the idle timing of the computing module, it is improved from the traditional processing of one group of plaintext (i.e., the payload data to be encrypted collected on the satellite) to the serial processing of four groups of plaintext in the same time, that is, completing the encryption calculation of four groups of plaintext. Compared with the traditional full-parallel scheme, it can not only greatly improve the AES encryption speed, but also reduce the resource usage to only one-fourth of the traditional full-parallel scheme, thereby meeting the application requirements of AES in the field of high-speed data real-time processing of satellites.

[0062] In one embodiment, the round key plus combination logic and serial encryption logic modules configured in the FPGA chip include N parallel groups, each group including a round key plus combination logic and a serial encryption logic module; N is a positive integer not less than 2.

[0063] It is understandable that if the encryption speed needs to be further improved, then the parallel encryption branch method can be used to improve the encryption speed. For example, one more AES encryption branch can be used in parallel to achieve this goal. For example, three AES encryption modules can be used in parallel. Then the three AES encryption modules can complete 12 groups of plaintext encryption in the same original time.

[0064] Specifically, if the encryption speed is still insufficient, then further consideration can be given to using parallel processing for encryption. For example, using three parallel AES encryption modules, with 60 groups of plaintext and considering that every four groups are input into one AES encryption module, the time overhead for encrypting 60 groups of plaintext (calculated based on the maximum envelope) is 43*(60 / 4 / 3)=215 clocks. From this, it can be inferred that for encrypting 60 groups of plaintext, the average encryption time for each group of plaintext is 3.58 clocks. When using the design of the above-mentioned parallel multi-channel AES encryption module, compared to the traditional single-channel encryption extended multi-channel parallel encryption solution, this embodiment only consumes one-quarter of the resources of the traditional solution while achieving the same encryption speed target, which is a significant improvement, for example, in the encryption of high-speed data transmission on board spacecraft.

[0065] If a higher rate is required, multi-channel expansion can be supported. That is, a single-channel AES encryption module can support the encryption of 4 groups of plaintext. The number of encrypted plaintext blocks increased by 4*N, where N is the number of parallel encryption channels. The use of multi-channel expansion forms a serial-parallel mesh encryption network, which can quickly expand the encryption speed under the condition of moderately increasing resources. The encryption speed is increased by 4N. The overall AES encryption process can be summarized as follows: Figure 8 As shown, the design of the corresponding three-way parallel AES encryption module can be as follows Figure 9 As shown in Figure 2, the overall encryption speed can be as follows: (1) Single-way AES encryption module, one group of plaintext is encrypted every 40 clocks, and each round of operation can simultaneously input 4 groups of plaintext for processing. (2) Three-way parallel encryption, three groups of plaintext can be encrypted every 40 clocks.

[0066] In one embodiment, AES encryption includes AES128 encryption, AES192 encryption, and AES256 encryption.

[0067] It can be understood that the application in the above embodiments is introduced based on AES128 encryption as an example. From the theoretical analysis above, it can be seen that for AES192 encryption and AES256 encryption, the number of encryption rounds is 12 and 14 respectively. Therefore, the same logic can be applied to AES192 encryption and AES256 encryption. Figure 7 As can be seen, the entire operation process fully utilizes the timing characteristics of each logic module. A single encryption branch can encrypt a set of plaintext every 40 clocks, with an average encryption time of approximately 10 clocks per set of plaintext. Using the above scheme, the time required for AES192 encryption is: 4*11+0+4=48, and the time required for AES256 encryption is: 4*13+0+4=56.

[0068] In one embodiment, another AES encryption method based on FPGA is provided, which may include the following processing steps:

[0069] Generate all the keys required for AES encryption through the AES key expansion module in the FPGA chip and cache them in RAM;

[0070] After reading the first round key from RAM, the four sets of plaintext input are encrypted using the first round key through the round key plus combination logic in the FPGA chip. The round key plus combination logic is the combination logic used to serially perform four round key addition operations.

[0071] After reading the next secret key of the first round key from the RAM, the serial encryption logic module in the FPGA chip serially performs byte replacement, row shift transformation, column confusion transformation and round key addition on the four groups of pre-processed data according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column confusion logic and round key addition logic, the byte replacement logic is configured as a serial byte replacement operation, the row shift logic is configured as a serial row shift transformation operation, the column confusion logic is configured as a serial column confusion transformation operation, and the round key addition logic is configured as a serial round key addition operation;

[0072] When performing the final round of encryption on the data, the serial encryption logic module performs byte replacement and row shift transformation on the four groups of pre-processed data in serial according to the final round key read from RAM, and then the multiplexed round key addition combination logic performs round key addition on the four groups of pre-processed data.

[0073] It can be understood that this processing method is essentially based on the non-correlation of calculations between wheels, making full use of the idle time of each logic module to improve operating efficiency (those skilled in the art can adaptably improve other similar technical solutions under this guidance to achieve improved operating efficiency, which all fall within the scope of adaptability of the present invention). Specifically, Figure 10 As shown, in the method of this embodiment, the round key addition operation is performed by adding the round key of the final round to the reused round key and combining logic. After the row shift of the final round, the round key addition logic for executing the round key addition is directly entered. This can further shorten the processing time by two clocks compared to the method of the previous embodiment without increasing resources. That is, one set of plaintext encryption output can be completed every 38 clocks. Compared to the method of the previous embodiment, since sequential logic is used after the first round, although only three modules are working in the final round, in order to process the four serial inputs, a clock wait is still required in actual implementation (i.e., one clock is wasted). This embodiment adopts this processing method of reused round keys and combining logic, which eliminates this clock waste, so the actual time reduction is two clocks instead of one.

[0074] The FPGA-based AES encryption method of this embodiment is based on the feature that there is no correlation between the front and rear wheels of the computing module during the encryption process. By making full use of the idle timing of the computing module, the traditional processing of one group of plaintexts (i.e., a group of encrypted payload data collected on the satellite) is improved to serial processing of four groups of plaintexts in the same time, that is, completing the encryption calculation of four groups of plaintexts. Compared with the traditional fully parallel solution, it can not only greatly improve the AES encryption speed, but also reduce the resource usage to only one-fourth of the traditional fully parallel solution, thereby meeting the application requirements of AES in the field of high-speed data real-time processing of satellites.

[0075] It should be understood that although Figure 1 The steps in the diagram are shown in the order indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0076] In one embodiment, Figure 11 As shown, an FPGA device with high-speed AES encryption functionality is also provided, comprising an AES key expansion module 11, a round key addition combination logic module 12, and a serial encryption logic module 13. The AES key expansion module 11 is used to generate all keys required for AES encryption and cache them in RAM. The round key addition combination logic module 12 is used to read the first-round key from RAM and then perform first-round encryption on four input plaintext sets using the first-round key. The round key addition combination logic module is a combination logic for serially performing four round key addition operations. The serial encryption logic module 13 is used to read the next key after the first-round key from RAM and then serially perform byte replacement, row shift transformation, column obfuscation transformation, and round key addition on four sets of pre-processed data using the next key. The serial encryption logic module includes byte replacement logic, row shift logic, column obfuscation logic, and round key addition logic. The byte replacement logic is configured to perform serial byte replacement operations, the row shift logic is configured to perform serial row shift transformation operations, the column obfuscation logic is configured to perform serial column obfuscation transformation operations, and the round key addition logic is configured to perform serial round key addition operations. The serial encryption logic module 13 is further configured to serially perform byte replacement, row shift transformation, and round key addition on the four groups of pre-processed data according to the final round secret key read from the RAM when performing final round encryption on the data.

[0077] The FPGA device with high-speed AES encryption function of this embodiment is based on the feature that there is no correlation between the front and rear wheels of the computing module during the encryption process. By making full use of the idle timing of the computing module, the traditional processing of one group of plaintexts (i.e., a group of encrypted payload data collected on the satellite) is improved to serial processing of four groups of plaintexts in the same time, that is, the encryption calculation of four groups of plaintexts is completed. Compared with the traditional full-parallel solution, it can not only greatly improve the AES encryption speed, but also reduce the resource usage to only one-fourth of the traditional full-parallel solution, thereby meeting the application requirements of AES in the field of high-speed data real-time processing of satellites.

[0078] In one embodiment, the round key plus combination logic module and the serial encryption logic module include N parallel groups, each group including a round key plus combination logic module and a serial encryption logic module; N is a positive integer not less than 2.

[0079] In one embodiment, AES encryption includes AES128 encryption, AES192 encryption, and AES256 encryption.

[0080] In one embodiment, another FPGA device with high-speed AES encryption functionality is provided, comprising: an AES key expansion module for generating all keys required for AES encryption and caching them in RAM; a round key addition combination logic module for performing first-round encryption on four input plaintext sets according to the first-round key after reading the first-round key from RAM; and a combination logic for serially implementing four round key addition operations. A serial encryption logic module for serially performing byte replacement, row shift transformation, column obfuscation transformation, and round key addition on four sets of pre-processed data according to the next key after reading the next-round key from RAM; and a serial encryption logic module comprising byte replacement logic, row shift logic, column obfuscation logic, and round key addition logic. The byte replacement logic is configured for serial byte replacement operations, the row shift logic is configured for serial row shift transformation operations, the column obfuscation logic is configured for serial column obfuscation transformation operations, and the round key addition logic is configured for serial round key addition operations. When performing the final round of encryption on the data, the serial encryption logic module is also used to serially perform byte replacement and row shift transformation on the four groups of pre-processed data according to the final round secret key read from the RAM, and the round key addition combination logic module is also used to perform round key addition on the four groups of pre-processed data according to the final round secret key.

[0081] The FPGA device with high-speed AES encryption function of this embodiment is based on the characteristic that there is no correlation between the front and rear wheels of the computing module during the encryption process. By making full use of the idle timing of the computing module, the traditional processing of one group of plaintext is improved to serial processing of four groups of plaintext in the same time, that is, the encryption calculation of four groups of plaintext is completed. Compared with the traditional full-parallel solution, it can not only greatly improve the AES encryption speed, but also reduce the resource usage to only one-fourth of the traditional full-parallel solution, thereby meeting the application requirements of AES in the field of high-speed data real-time processing of satellites.

[0082] It can be understood that the explanation of the various features of the above-mentioned FPGA device with high-speed AES encryption function can be understood in the same way as the corresponding explanations in the various embodiments of the AES encryption method implemented based on FPGA. Each module in the above-mentioned FPGA device with high-speed AES encryption function can be implemented in whole or in part by software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of a device with data processing function in the form of hardware, or can be stored in the memory of the aforementioned device in the form of software, so that the processor can call and execute the operations corresponding to the above modules. The aforementioned device can be, but is not limited to, various types of FPGA chips or encryption and decryption devices already available in the art.

[0083] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the following processing steps when executing the computer program: generating all keys required for AES encryption through an AES key expansion module in an FPGA chip and caching them in RAM; after reading the first-round key from the RAM, performing the first-round encryption on four groups of input plaintexts according to the first-round key through the round key addition combination logic in the FPGA chip; the round key addition combination logic is a combination logic for serially implementing four round key addition operations; after reading the next key of the first-round key from the RAM, performing the first-round encryption on the four groups of input plaintexts through the serial encryption logic module in the FPGA chip. The four groups of pre-processed data are serially subjected to byte replacement, row shift transformation, column confusion transformation and round key addition according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column confusion logic and round key addition logic, the byte replacement logic is configured as a serial byte replacement operation, the row shift logic is configured as a serial row shift transformation operation, the column confusion logic is configured as a serial column confusion transformation operation, and the round key addition logic is configured as a serial round key addition operation; when the last round of encryption is performed on the data, the serial encryption logic module is serially subjected to byte replacement, row shift transformation and round key addition according to the last round secret key read from the RAM.

[0084] When executing a computer program, the processor may implement the following processing steps: generating all the secret keys required for AES encryption through the AES secret key expansion module in the FPGA chip and caching them in RAM; after reading the first round secret key from RAM, performing the first round encryption on the four groups of input plaintexts according to the first round secret key through the round key plus combination logic in the FPGA chip; the round key plus combination logic is a combination logic for serially implementing four round key addition operations; after reading the next secret key of the first round secret key from RAM, the serial encryption logic module in the FPGA chip serially encrypts the four groups of pre-processed data according to the next secret key. Execute byte replacement, row shift transformation, column confusion transformation and round key addition; the serial encryption logic module includes byte replacement logic, row shift logic, column confusion logic and round key addition logic, the byte replacement logic is configured as a serial byte replacement operation, the row shift logic is configured as a serial row shift transformation operation, the column confusion logic is configured as a serial column confusion transformation operation, and the round key addition logic is configured as a serial round key addition operation; when the last round of encryption is performed on the data, the serial encryption logic module serially performs byte replacement, row shift transformation and round key addition on the four groups of pre-processed data according to the last round key read from the RAM.

[0085] In one embodiment, when executing the computer program, the processor may further implement the additional steps or sub-steps in each embodiment of the above-mentioned AES encryption method based on FPGA.

[0086] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following processing steps are implemented: all keys required for AES encryption are generated by an AES key expansion module in an FPGA chip and cached in RAM; after reading the first-round key from RAM, the first-round encryption is performed on four groups of input plaintexts according to the first-round key by the round key addition combination logic in the FPGA chip; the round key addition combination logic is a combination logic for serially implementing four round key addition operations; after reading the next key of the first-round key from RAM, the four groups of previous-stage encryption are performed by the serial encryption logic module in the FPGA chip. The processed data is serially subjected to byte replacement, row shift transformation, column confusion transformation and round key addition according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column confusion logic and round key addition logic, the byte replacement logic is configured as a serial byte replacement operation, the row shift logic is configured as a serial row shift transformation operation, the column confusion logic is configured as a serial column confusion transformation operation, and the round key addition logic is configured as a serial round key addition operation; when the last round of encryption is performed on the data, the serial encryption logic module serially performs byte replacement, row shift transformation and round key addition on the four groups of pre-processed data according to the last round secret key read from the RAM.

[0087] When the computer program is executed by the processor, the following processing steps are implemented: all the secret keys required for AES encryption are generated by the AES secret key expansion module in the FPGA chip and cached in RAM; after reading the first round secret key from RAM, the four groups of input plaintext are encrypted in the first round according to the first round secret key through the round key plus combination logic in the FPGA chip; the round key plus combination logic is a combination logic for serially implementing four round key addition operations; after reading the next secret key of the first round secret key from RAM, the four groups of pre-processed data are serially executed according to the next secret key through the serial encryption logic module in the FPGA chip. Row byte replacement, row shift transformation, column confusion transformation and round key addition; the serial encryption logic module includes byte replacement logic, row shift logic, column confusion logic and round key addition logic, the byte replacement logic is configured as a serial byte replacement operation, the row shift logic is configured as a serial row shift transformation operation, the column confusion logic is configured as a serial column confusion transformation operation, and the round key addition logic is configured as a serial round key addition operation; when the last round of encryption is performed on the data, the serial encryption logic module performs byte replacement, row shift transformation and round key addition serially on the four groups of pre-processed data according to the last round key read from the RAM.

[0088] In one embodiment, when the computer program is executed by a processor, it can also implement the additional steps or sub-steps in each embodiment of the above-mentioned AES encryption method based on FPGA.

[0089] Those skilled in the art will appreciate that all or part of the processes in the above-described embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-described methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus dynamic random access memory (Rambus DRAM, abbreviated as RDRAM) and interface dynamic random access memory (DRDRAM).

[0090] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0091] The above embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that a person skilled in the art would be able to make numerous modifications and improvements without departing from the spirit of the present invention, all of which fall within the scope of the present invention. Therefore, the scope of the present invention shall be determined by the appended claims.

Claims

1. An AES encryption method based on FPGA, characterized in that: Including steps: Generate all the keys required for AES encryption through the AES key expansion module in the FPGA chip and cache them in RAM; After reading the first-round key from the RAM, the four sets of input plaintext are encrypted in the first round according to the first-round key through the round key plus combination logic in the FPGA chip; the round key plus combination logic is a combination logic for serially implementing four round key addition operations; After reading the next secret key of the first round key from the RAM, the serial encryption logic module in the FPGA chip serially performs byte replacement, row shift transformation, column obfuscation transformation and round key addition on the four groups of pre-processed data according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column obfuscation logic and round key addition logic, the byte replacement logic is configured to perform serial byte replacement operations, the row shift logic is configured to perform serial row shift transformation operations, the column obfuscation logic is configured to perform serial column obfuscation transformation operations, and the round key addition logic is configured to perform serial round key addition operations; When performing final round encryption on data, the serial encryption logic module serially performs byte replacement, row shift transformation and round key addition on four groups of pre-processed data according to the final round secret key read from the RAM.

2. The AES encryption method based on FPGA implementation according to claim 1, characterized in that: The round key plus combination logic and the serial encryption logic module configured in the FPGA chip include N parallel groups, each group including one round key plus combination logic and one serial encryption logic module; N is a positive integer not less than 2.

3. The AES encryption method based on FPGA implementation according to claim 1 or 2, characterized in that: The AES encryption includes AES128 encryption, AES192 encryption and AES256 encryption.

4. An AES encryption method based on FPGA, characterized in that: Including steps: Generate all the keys required for AES encryption through the AES key expansion module in the FPGA chip and cache them in RAM; After reading the first-round key from the RAM, the four sets of input plaintext are encrypted in the first round according to the first-round key through the round key plus combination logic in the FPGA chip; the round key plus combination logic is a combination logic for serially implementing four round key addition operations; After reading the next secret key of the first round key from the RAM, the serial encryption logic module in the FPGA chip serially performs byte replacement, row shift transformation, column obfuscation transformation and round key addition on the four groups of pre-processed data according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column obfuscation logic and round key addition logic, the byte replacement logic is configured to perform serial byte replacement operations, the row shift logic is configured to perform serial row shift transformation operations, the column obfuscation logic is configured to perform serial column obfuscation transformation operations, and the round key addition logic is configured to perform serial round key addition operations; When performing the final round of encryption on the data, the serial encryption logic module serially performs byte replacement and row shift transformation on the four groups of pre-processed data according to the final round key read from the RAM, and then the multiplexed round key addition combination logic performs round key addition on the four groups of pre-processed data.

5. An FPGA device with high-speed AES encryption function, characterized in that: include: AES key expansion module, used to generate all the keys required for AES encryption and cache them in RAM; A round key addition combination logic module is used to read the first round key from the RAM and perform first round encryption on the four input plaintext groups according to the first round key; the round key addition combination logic is used to serially implement four round key addition operations; a serial encryption logic module, configured to, after reading the next secret key of the first-round secret key from the RAM, serially perform byte replacement, row shift transformation, column obfuscation transformation, and round key addition on four sets of pre-processed data according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column obfuscation logic, and round key addition logic, the byte replacement logic being configured to perform serial byte replacement operations, the row shift logic being configured to perform serial row shift transformation operations, the column obfuscation logic being configured to perform serial column obfuscation transformation operations, and the round key addition logic being configured to perform serial round key addition operations; The serial encryption logic module is further used to serially perform byte replacement, row shift transformation and round key addition on four groups of pre-processed data according to the final round secret key read from the RAM when performing the final round encryption on the data.

6. The FPGA device with high-speed AES encryption function according to claim 5, characterized in that: The round key plus combination logic module and the serial encryption logic module include N parallel groups, each group includes one round key plus combination logic module and one serial encryption logic module; N is a positive integer not less than 2.

7. The FPGA device with high-speed AES encryption function according to claim 5 or 6, characterized in that: The AES encryption includes AES128 encryption, AES192 encryption and AES256 encryption.

8. An FPGA device with high-speed AES encryption function, characterized in that: include: AES key expansion module, used to generate all the keys required for AES encryption and cache them in RAM; a round key addition combination logic module, configured to read the first-round key from the RAM and then perform first-round encryption on the four input plaintexts according to the first-round key; the round key addition combination logic module is a combination logic for serially implementing four round key addition operations; a serial encryption logic module, configured to, after reading the next secret key of the first-round secret key from the RAM, serially perform byte replacement, row shift transformation, column obfuscation transformation, and round key addition on four sets of pre-processed data according to the next secret key; the serial encryption logic module includes byte replacement logic, row shift logic, column obfuscation logic, and round key addition logic, the byte replacement logic being configured to perform serial byte replacement operations, the row shift logic being configured to perform serial row shift transformation operations, the column obfuscation logic being configured to perform serial column obfuscation transformation operations, and the round key addition logic being configured to perform serial round key addition operations; When performing the final round of encryption on the data, the serial encryption logic module is also used to serially perform byte replacement and row shift transformation on the four groups of pre-processed data according to the final round key read from the RAM, and the round key addition combination logic module is also used to perform round key addition on the four groups of pre-processed data according to the final round key.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the AES encryption method based on FPGA as described in any one of claims 1 to 4 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the FPGA-based AES encryption method according to any one of claims 1 to 4 are implemented.

Images