AES decryption method and device based on FPGA, equipment and medium

Abstract

The invention relates to an AES (Advanced Encryption Standard) decryption method, device and equipment based on an FPGA (Field Programmable Gate Array) and a medium, based on the characteristic that front and back rounds of a calculation module are irrelevant in a decryption process, by fully utilizing an idle time sequence of the calculation module in the same time, the traditional processing of a group of ciphertexts is improved into the serial processing of four groups of ciphertexts, namely, the decryption calculation of the four groups of ciphertexts is completed, and the decryption efficiency is improved. Compared with a traditional full-parallel scheme, the AES decryption speed can be greatly improved, the resource occupation is only one fourth of that of the traditional full-parallel scheme, and therefore the application requirement of the AES in the field of high-speed data real-time processing of satellites is met.

Description

Technical Field

[0001] The present invention belongs to the technical field of data decryption, and relates to an AES decryption method, device, equipment and medium implemented based on FPGA. Background Art

[0002] Satellite data transmission links are used to transmit payload data collected onboard to the ground via high-speed links. Since this collected payload data is generally valuable, it is desirable to decrypt this data. AES, as a common commercial decryption method, is widely used in various scenarios. However, when applied to high-speed communications, the decryption processing speed cannot keep up with the air interface data transmission rate, resulting in a low application rate in the field of high-speed, real-time satellite data processing. To increase the decryption speed of AES, direct full parallel processing or increasing the operating clock are generally adopted. Using full parallel processing results in excessive resource overhead, and while increasing the operating clock does not significantly increase resources, it will degrade overall timing, limiting its improvement capabilities. Therefore, to meet the application requirements of AES in the field of high-speed, real-time satellite data processing, how to more effectively increase the decryption speed of AES has become a technical problem that needs to be solved. Summary of the Invention

[0003] In response to the problems existing in the above-mentioned traditional methods, the present invention proposes an AES decryption method based on FPGA, an FPGA device with high-speed AES decryption function, a computer device and a computer-readable storage medium, which can more effectively improve the AES decryption speed and meet the application requirements of AES in the field of high-speed real-time data processing of satellites.

[0004] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0005] On the one hand, an AES decryption method based on FPGA is provided, comprising the steps of:

[0006] Generate all the keys required for AES decryption through the AES key expansion module in the FPGA chip and cache them in RAM;

[0007] After reading the first round key from RAM, the round key addition logic in the FPGA chip performs round key addition on the four input ciphertexts according to the first round key. The round key addition logic is the combination logic used to perform four round key addition operations.

[0008] After reading the next secret key of the first round key from RAM, the serial decryption logic module in the FPGA chip serially performs row shift, byte replacement, round key addition and column confusion on the four sets of pre-processed data according to the next secret key; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic and column confusion logic. The round key addition logic is configured as a serial round key addition operation, the column confusion logic is configured as a serial column confusion transformation operation, the row shift logic is configured as a serial row shift transformation operation, and the byte replacement logic is configured as a serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption;

[0009] When performing the final round decryption on the data, the serial decryption logic module performs row shifting, byte replacement and round key addition on the four groups of pre-processed data according to the final round key read from the RAM.

[0010] On the other hand, another AES decryption method based on FPGA is provided, including the following steps:

[0011] Generate all the keys required for AES decryption through the AES key expansion module in the FPGA chip and cache them in RAM;

[0012] After reading the first round key from RAM, the round key addition logic in the FPGA chip performs round key addition on the four input ciphertexts according to the first round key. The round key addition logic is the combination logic used to perform four round key addition operations.

[0013] After reading the next secret key of the first round key from RAM, the serial decryption logic module in the FPGA chip serially performs row shift, byte replacement, round key addition and column confusion on the four sets of pre-processed data according to the next secret key; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic and column confusion logic. The round key addition logic is configured as a serial round key addition operation, the column confusion logic is configured as a serial column confusion transformation operation, the row shift logic is configured as a serial row shift transformation operation, and the byte replacement logic is configured as a serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption;

[0014] When performing the last round of decryption on the data, the serial decryption logic module performs row shift and byte replacement on the four groups of pre-processed data according to the last round key read from the RAM, and then the multiplexed round key addition combination logic performs round key addition on the four groups of pre-processed data according to the last round key.

[0015] In another aspect, there is provided an FPGA device having a high-speed AES decryption function, comprising:

[0016] AES key expansion module, used to generate all the keys required for AES decryption and cache them in RAM;

[0017] The round key addition combination logic module is used to perform round key addition on the four input ciphertexts according to the first round key after reading the first round key from RAM; the round key addition combination logic is the combination logic used to implement four round key addition operations;

[0018] A serial decryption logic module is used to read the next secret key of the first round key from the RAM and then serially perform row shift, byte replacement, round key addition, and column confusion on the four sets of pre-processed data according to the next secret key; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic, and column confusion logic. The round key addition logic is configured as a serial round key addition operation, the column confusion logic is configured as a serial column confusion transformation operation, the row shift logic is configured as a serial row shift transformation operation, and the byte replacement logic is configured as a serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption;

[0019] The serial decryption logic module is also used to perform row shifting, byte replacement and round key addition on the four groups of pre-processed data according to the final round secret key read from the RAM when performing the final round decryption on the data.

[0020] In another aspect, another FPGA device with high-speed AES decryption function is provided, characterized in that it includes:

[0021] AES key expansion module, used to generate all the keys required for AES decryption and cache them in RAM;

[0022] The round key addition combination logic module is used to perform round key addition on the four input ciphertexts according to the first round key after reading the first round key from RAM. The round key addition combination logic module is the combination logic for implementing four round key addition operations.

[0023] A serial decryption logic module is used to read the next secret key of the first round key from the RAM and then serially perform row shift, byte replacement, round key addition, and column confusion on the four sets of pre-processed data according to the next secret key; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic, and column confusion logic. The round key addition logic is configured as a serial round key addition operation, the column confusion logic is configured as a serial column confusion transformation operation, the row shift logic is configured as a serial row shift transformation operation, and the byte replacement logic is configured as a serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption;

[0024] When performing the last round of decryption on the data, the serial decryption logic module is also used to perform row shifting and byte replacement on the four groups of pre-processed data according to the last round key read from the RAM, and the round key addition combination logic is also used to perform round key addition on the data output after the serial decryption logic module performs byte replacement according to the last round key.

[0025] On the other hand, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned FPGA-based AES decryption method when executing the computer program.

[0026] On the other hand, a computer readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned AES decryption method based on FPGA are implemented.

[0027] One of the above technical solutions has the following advantages and beneficial effects:

[0028] The above-mentioned FPGA-based AES decryption method, device, equipment and medium are based on the characteristic that there is no correlation between the front and rear wheels of the computing module during the decryption process. By making full use of the idle timing of the computing module, the traditional processing of one group of ciphertexts (i.e., a group of payload data to be decrypted collected on the satellite) is improved to serial processing of four groups of ciphertexts in the same time, that is, the decryption calculation of four groups of ciphertexts is completed. Compared with the traditional full-parallel solution, it can not only greatly improve the AES decryption speed, but also reduce the resource usage to only one-fourth of the traditional full-parallel solution, thereby meeting the application requirements of AES in the field of high-speed data real-time processing of satellites. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the conventional technology, the following briefly introduces the drawings required for use in the embodiments or the conventional technology descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0030] Figure 1 Schematic diagram of the flow of an AES decryption method implemented based on FPGA in one embodiment;

[0031] Figure 2 A schematic diagram of the AES128 key expansion process in one embodiment;

[0032] Figure 3 A schematic diagram of the AES128 decryption process in one embodiment;

[0033] Figure 4A schematic diagram of a cyclic operation control process for AES decryption in one embodiment;

[0034] Figure 5 1. AES128 decryption process diagram using the above-mentioned AES decryption method in one embodiment;

[0035] Figure 6 A schematic diagram of an idle period for round key addition in one embodiment;

[0036] Figure 7 This is an overall schematic diagram of the improved decryption process in one embodiment;

[0037] Figure 8 A schematic diagram of a three-way parallel decryption design in one embodiment;

[0038] Figure 9 FIG1 is a schematic diagram of an AES128 decryption process using another AES decryption method in one embodiment;

[0039] Figure 10 FIG1 is a timing diagram of round operations of another AES decryption method according to an embodiment;

[0040] Figure 11 A schematic diagram illustrating utilizing the idle time of each logic module to improve operating efficiency according to another AES decryption method in one embodiment;

[0041] Figure 12 A schematic diagram of the module framework of an FPGA device with high-speed AES decryption function in one embodiment. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and Examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the description of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0043] It should be noted that the reference to "embodiment" in this document means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The presentation of this phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It will be understood by those skilled in the art that the embodiments described herein may be combined with other embodiments. The term "and / or" used in the specification of the present invention and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0044] The following describes the implementation of the present invention in detail with reference to the accompanying drawings in the embodiments of the present invention.

[0045] The decryption of the AES decryption algorithm consists of N rounds, and the number of rounds depends on the key length: for example, a 16-byte key (AES128) corresponds to 10 rounds, a 24-byte key (AES192) corresponds to 12 rounds, and a 32-byte key (AES256) corresponds to 14 rounds. The first N-1 rounds consist of four different transformations: byte substitution (SubBytes), row shift (ShiftRows), column confusion (MixColumns), and round key addition (AddRoundKey). Among them, byte substitution is to use an S-box to complete the byte-to-byte substitution of the group. Row shift is a simple byte shift within a row. Column confusion is to use the field GF(2 8 ) is a substitute for the arithmetic properties on the ciphertext. The round key addition is the bitwise exclusive OR XOR of the current group and a part of the extended key. In the AES encryption and decryption process, each step of the decryption algorithm corresponds to the inverse operation of the encryption algorithm, and the order of all encryption and decryption operations is exactly the opposite. The key for each round in encryption and decryption is obtained by the seed key through the key expansion algorithm. The 16-byte ciphertext, ciphertext and round key in the encryption and decryption algorithm are all represented by a 4×4 matrix. The specific detailed knowledge of the above AES can be understood by referring to the AES itself and its related explanations known in the art, and will not be elaborated one by one in this manual.

[0046] The currently used AES decryption algorithm requires multiple rounds of calculations, and each round strictly follows the four steps of row shifting, byte replacement, round key addition, and column obfuscation. Each round has time overhead, which makes it difficult to increase the speed of the decryption algorithm. To increase the decryption speed, the operating clock is often increased or multiple modules are used in parallel. Increasing the processing clock to increase the decryption speed has limited improvement capabilities, and excessively high clock frequencies can easily lead to FPGA timing degradation. Using multiple modules in parallel will lead to a rapid increase in resource overhead.

[0047] Existing patent CN201310047034 provides an ultra-high-speed FPGA-based AES processor and its implementation method. By compressing the number of operational steps, it reduces the number of clock cycles required for each decryption group. The present invention, based on the principle of decoupling the front and rear cycles of the computational module during decryption (assuming the four clocks are considered four channels, there is no correlation between the four channels; however, the same channel does have correlation due to the iterative process), rationally utilizes processing time gaps to achieve a speed increase while maintaining the original algorithm architecture, resource overhead, and process. To further increase decryption processing speed, the present invention's solution can also add resources to one or more decryption branches to decrypt more ciphertext groups. In contrast, the existing patent CN201310047034 only increases the decryption capacity of one ciphertext group per additional decryption branch. The present invention's solution maximizes performance when decrypting consecutive ciphertext blocks. The solution of the present invention is applicable to data decryption in a scenario using a high-speed AES encryption method based on FPGA corresponding to the AES decryption method based on FPGA described below. The AES decryption method based on FPGA is the reverse process of the AES encryption method based on FPGA.

[0048] In one embodiment, Figure 1 As shown, an AES decryption method based on FPGA implementation is provided, which may include the following steps S20 to S26:

[0049] S20, generates all the keys required for AES decryption through the AES key expansion module in the FPGA chip and caches them in RAM;

[0050] S22, after reading the first round key from the RAM, the round key addition combination logic in the FPGA chip performs round key addition on the four sets of input ciphertexts according to the first round key; the round key addition combination logic is the combination logic for performing four round key addition operations;

[0051] S24, after reading the next secret key of the first round key from the RAM, the serial decryption logic module in the FPGA chip serially performs row shift, byte replacement, round key addition and column confusion on the four groups of pre-processed data according to the next secret key; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic and column confusion logic, the round key addition logic is configured as a serial round key addition operation, the column confusion logic is configured as a serial column confusion transformation operation, the row shift logic is configured as a serial row shift transformation operation, and the byte replacement logic is configured as a serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption;

[0052] S26, when performing final round decryption on the data, the serial decryption logic module performs row shifting, byte replacement and round key addition on the four groups of pre-processed data according to the final round key read from the RAM.

[0053] It can be understood that, first, the AES key expansion module is used to generate the key required for AES decryption. The specific process is as follows Figure 2 As shown (wherein, in each of the figures containing ST_IDLE and IDLE, ST_IDLE and IDLE both represent idle states), it should be noted that, for the convenience of intuitive display and explanation, the following mainly uses AES128 as an example for explanation, and other AES decryption algorithms are similar. Since the decryption of AES128 requires ten rounds of processing, each round corresponds to a round of secret keys, so when the AES secret key is expanded, ten secret keys actually need to be generated, plus the original session key, a total of 11 secret keys. Since the decryption of AES128 is a serial calculation, the front and back rounds are correlated, so when generating the extended secret key, a serial process is also used, and all the generated secret keys are cached in RAM. When used for decryption, the required secret keys can be read directly from RAM, thereby saving time overhead.

[0054] Next is the AES decryption process. Taking AES128 as an example, the AES128 decryption module (i.e. the serial decryption logic module and round key plus combination logic) is used to decrypt the input ciphertext according to the secret key generated by the AES128 secret key expansion. The specific process can be as follows: Figure 3 As shown, to conserve resources, in the eleven decryption rounds, the first round's round key addition is implemented using round key addition combinational logic, while the subsequent ten rounds reuse the same serial decryption logic module. In the first round, only round key addition is performed. In the middle rounds, each round reuses the serial decryption logic module's logic to perform row shifts, byte substitutions, round key addition, and column obfuscation. In the final round, only row shifts, byte substitutions, and round key addition are performed. Decryption rounds proceed sequentially, and the keys required for each round are read from RAM.

[0055] The AES decryption process described above shows that the main cost of AES decryption is the round decryption process. If the cost of each module in the round decryption (i.e., the logic modules corresponding to row shifting, byte replacement, round key addition, and column obfuscation) is 1 clock, then the total cost of AES128-round decryption is 40 clocks. To increase the processing speed of decryption, a more direct approach is to share the AES key expansion process and then run multiple decryption processes in parallel according to actual needs. If the speed needs to be increased by 2 times, then one more AES decryption module can be run in parallel, but the resource cost of the round decryption will double. Alternatively, the decryption processing clock can be doubled, but the performance improvement of this approach is relatively limited, and it is difficult to shorten the decryption time by increasing the processing clock indefinitely.

[0056] Therefore, neither of the two direct processing methods mentioned above is an ideal way to increase the decryption processing speed. In order to increase the decryption processing speed, you can also appropriately increase the resources, but if the speed increase multiplier and the resource multiplier are the same, the resource consumption will still be too high, which is not the best solution.

[0057] The AES decryption process has four steps: row shift, byte replacement, round key addition, and column confusion. The first round uses combinational logic (i.e., round key plus combinational logic) for calculation, and the subsequent ten rounds are processed by the serial decryption logic module. After a total of 11 rounds of calculations (taking AES128 as an example), the decryption of a set of ciphertexts is completed. The entire process control can be regarded as follows: Figure 4 As shown in the figure. In traditional techniques, assuming that row shifting, byte replacement, round key addition, and column obfuscation each take up one clock, the total time overhead for the 11 rounds of key operations is 1 (first round) + 4*9 (middle rounds) + 3 (last round) = 40. A set of ciphertext data requires 40 clocks to decrypt. Assuming there are 60 sets of ciphertext data, the total time overhead is 40*60 = 2400 clocks.

[0058] This embodiment notes that during round decryption, the row shifting, byte replacement, round key addition, and column obfuscation processes are sequential serial processes. Furthermore, the first and second rounds of decryption in the intermediate rounds have no data correlation, except for the different keys. Therefore, this embodiment leverages this characteristic to fully utilize the timing. Specifically, the remaining three clock cycles of each logic block in the serial decryption logic module are serially utilized. This significantly accelerates processing speed under the same resource conditions. Simple parallel processing (such as simply adding parallel decryption branches, as in conventional techniques) increases processing speed but increases resource overhead by at least fourfold. It should be noted that the improvement requirements of this invention stem from satellite data transmission links. Since data is decrypted frame by frame, it can support serial ciphertext input. Because FPGA chips are divided into sequential and combinational logic, logic not prefixed herein is assumed to be sequential logic (such as row shift logic, byte replacement logic, round key addition logic, and column obfuscation logic).

[0059] This example also assumes that row shifting, byte replacement, round key addition, and column obfuscation each take up one clock. Therefore, if the remaining three clocks in each logical operation are fully utilized, four rounds of decryption can be performed simultaneously. Therefore, the total time overhead for the 11 rounds of key operations is 4*9+0+4=40. This means that one set of ciphertext decryption output is completed every 40 clocks, and four sets of ciphertext decryption outputs are completed every 43 clocks. The average decryption time for each set of ciphertext is 10.75 clocks. Assuming there are 60 sets of ciphertext data, the time overhead is 43*(60 / 4)=645 clocks. Therefore, it can be deduced that the average decryption time for each of the 60 sets of ciphertext data is 10.75 clocks.

[0060] A complete new process design for AES128 decryption can be achieved by Figure 5 In the process architecture shown, due to the relative timing design of the FPGA chip, the first round of processing is directly implemented in the FPGA chip as a combination logic (i.e., round key plus combination logic) for hardware implementation. This embodiment can save one clock and can complete the decryption of one group of ciphertext every 40 clocks. The row shift logic, byte replacement logic, round key addition logic, and column obfuscation logic used in the FPGA chip to implement row shift, byte replacement, round key addition, and column obfuscation are all modularly designed. Taking the conventional decryption design as an example, Figure 6 As shown, in the traditional technology, for round key addition, after the middle round completes the round key addition operation, it enters an idle state and needs to wait for 3 clocks before it can be used again. Therefore, the round key addition has an idle period of 3 clocks.

[0061] Based on the non-correlation of calculations between rounds (i.e., as long as the exact input is provided, the output is fixed), this embodiment fully utilizes the idle time of each logic module (i.e., through serial timing multiplexing, the remaining three clocks of each module are fully utilized, so that one logic module completes four calculations within four serial input clocks) to improve operating efficiency. The specific improvement measures are as follows: The entire calculation process fully utilizes the timing characteristics of each logic module. One group of ciphertext can be decrypted every 40 clocks, and the average decryption time for each group of ciphertext is 10.75 clocks.

[0062] The above-mentioned FPGA-based AES decryption method is based on the characteristic that there is no correlation between the front and rear wheels of the computing module during the decryption process. By making full use of the idle timing of the computing module, it is improved from the traditional processing of one group of ciphertexts (i.e., the payload data to be decrypted collected on the satellite) to the serial processing of four groups of ciphertexts in the same time, that is, completing the decryption calculation of four groups of ciphertexts. Compared with the traditional fully parallel scheme, it can not only greatly improve the AES decryption speed, but also reduce the resource usage to only one-fourth of the traditional fully parallel scheme, thus meeting the application requirements of AES in the field of high-speed data real-time processing of satellites.

[0063] In one embodiment, the serial decryption logic module and the round key plus combination logic configured in the FPGA chip include N parallel groups, each group including a serial decryption logic module and a round key plus combination logic; N is a positive integer not less than 2.

[0064] It is understandable that if the decryption speed needs to be further improved, the decryption speed can be improved by adopting the method of parallel decryption branches. For example, one more AES decryption branch can be used in parallel to achieve this goal. For example, three AES decryption modules can be used in parallel. Then, the three AES decryption modules can complete the decryption of 12 groups of ciphertexts in the same amount of time.

[0065] Specifically, if the decryption speed is still not fast enough, you can further consider using parallel processing to perform decryption, such as a parallel three-way AES decryption module (such as Figure 8 As shown in the figure, with 60 ciphertext groups and assuming that every four groups are fed into one AES decryption module, the time overhead for decrypting all 60 ciphertext groups (calculated based on the maximum envelope) is 43 * (60 / 4 / 3) = 215 clock cycles. From this, we can deduce that for 60 ciphertext groups, the average decryption time per ciphertext group is 3.58 clock cycles. When using the above-mentioned parallel multi-channel AES decryption module design, compared to the traditional single-channel decryption solution with multi-channel parallel decryption, this embodiment achieves the same decryption speed target with only one-quarter of the resource usage of the traditional solution, a significant improvement.

[0066] If a higher rate is required, multi-path expansion can be supported. That is, a single-path AES decryption can support the decryption of 4 groups of ciphertexts. The number of decrypted ciphertext blocks increased by 4*N, where N is the number of parallel decryption paths. The use of multi-path expansion forms a serial-parallel mesh decryption network, which can quickly expand decryption while moderately increasing resources. The decryption speed is increased by 4N. The overall AES decryption process can be summarized as follows: Figure 7 As shown, the design of the corresponding three-way parallel AES decryption module can be as follows Figure 8 As shown in Figure 2, the overall decryption speed can be as follows: (1) Single-way AES decryption module, decrypting one set of ciphertext every 40 clocks, and each round of operation can simultaneously input four sets of ciphertext for processing. (2) Three-way parallel decryption, decrypting three sets of ciphertext every 40 clocks.

[0067] In one embodiment, AES decryption includes AES128 decryption, AES192 decryption, and AES256 decryption.

[0068] It's understandable that the application in the above embodiments is based on AES128 decryption as an example. As the theoretical analysis above shows, AES192 and AES256 decryption require 12 and 14 rounds, respectively. Therefore, the same principle can be extended to apply to AES192 and AES256 decryption. The entire computational process fully utilizes the timing characteristics of each logic module. A single decryption branch can encrypt a set of plaintext every 40 clocks, with an average encryption time of approximately 10 clocks per set of plaintext. Using this scheme, the time required for AES192 decryption is: 4*11+0+4=48; the time required for AES256 decryption is: 4*13+0+4=56.

[0069] In one embodiment, Figure 9 As shown, another AES decryption method based on FPGA is also provided, which can include the following processing steps:

[0070] Generate all the keys required for AES decryption through the AES key expansion module in the FPGA chip and cache them in RAM;

[0071] After reading the first round key from RAM, the round key addition logic in the FPGA chip performs round key addition on the four input ciphertexts according to the first round key. The round key addition logic is the combination logic used to perform four round key addition operations.

[0072] After reading the next secret key of the first round key from RAM, the serial decryption logic module in the FPGA chip serially performs row shift, byte replacement, round key addition and column confusion on the four sets of pre-processed data according to the next secret key; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic and column confusion logic. The round key addition logic is configured as a serial round key addition operation, the column confusion logic is configured as a serial column confusion transformation operation, the row shift logic is configured as a serial row shift transformation operation, and the byte replacement logic is configured as a serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption;

[0073] When performing the last round of decryption on the data, the serial decryption logic module performs row shift and byte replacement on the four groups of pre-processed data according to the last round key read from the RAM, and then the multiplexed round key addition combination logic performs round key addition on the four groups of pre-processed data according to the last round key.

[0074] It can be understood that this processing method is essentially based on the non-correlation of calculations between wheels, and fully utilizes the idle time of each logic module to improve operating efficiency (those skilled in the art can adaptably improve other similar technical solutions under this guidance to achieve improved operating efficiency, which all fall within the scope of adaptability extension of the present invention).

[0075] Specifically, such as Figure 9 As shown, in the method of this embodiment, the first round uses the round key plus combination logic to perform the round key addition operation. After the first round of round key addition operation, the intermediate round operation is entered. By continuously reusing the serial decryption logic module to perform row shift, byte replacement, round key addition and column confusion, in the final round of decryption, the serial decryption logic module is first reused to perform row shift and byte replacement operations, and then the round key plus combination logic is reused to perform the round key addition operation. This can further shorten the processing time by 2 clocks compared to the method in the previous embodiment without increasing resources. That is, the decryption output of one group of ciphertext can be completed every 38 clocks.

[0076] Specifically, such as Figure 10 and Figure 11 As shown, in this embodiment, the first round is round key addition (implemented using round key addition combinational logic). The second round consists of row shifts, byte substitutions, round key additions, and column shuffling. This continues until the final round consists of row shifts, byte substitutions, and round key additions. Thus, the first round of round key additions uses the round key addition combinational logic and takes no time. Furthermore, the final round of round key additions also reuses the round key addition combinational logic and also takes no time. This further reduces the decryption time by two clock cycles compared to the previous decryption method.

[0077] Compared with the method in the previous embodiment, since the decryption processing in the middle round adopts sequential logic, although only three modules are working in the final round, in order to process the four-way serial input, it is still necessary to wait for one clock in actual implementation (that is, there will be a waste of one clock). This embodiment adopts this processing method of multiplexing round keys plus combinational logic, which no longer needs to waste this clock, so the actual shortened time is 2 clocks instead of 1 clock.

[0078] The FPGA-based AES decryption method of this embodiment takes advantage of the fact that there is no correlation between the front and rear wheels of the computing module during the decryption process. By fully utilizing the idle timing of the computing module, the method improves the traditional processing of one set of ciphertexts (i.e., a set of payload data collected on board to be decrypted) to serial processing of four sets of ciphertexts within the same time period, completing the decryption calculations of the four sets of ciphertexts. Compared with the traditional fully parallel solution, this method not only significantly improves the AES decryption speed, but also reduces the resource usage to only one-fourth of that of the traditional fully parallel solution, thereby meeting the application requirements of AES in the field of high-speed real-time data processing on satellites.

[0079] It should be understood that although Figure 1 The steps in the diagram are shown in the order indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0080] In one embodiment, Figure 12As shown, an FPGA device with high-speed AES decryption function is also provided, including an AES key expansion module 11, a serial decryption logic module 13, and a round key addition combination logic module 15. The AES key expansion module 11 is used to generate all the keys required for AES decryption and cache them in RAM. The round key addition combination logic module 15 is used to read the first round key from RAM and then perform round key addition on the four input ciphertexts according to the first round key; the round key addition combination logic 15 is a combination logic for performing four round key addition operations. The serial decryption logic module 13 is used to read the next key after the first round key from RAM and then serially perform row shifting, byte replacement, round key addition, and column obfuscation on the four sets of pre-processed data according to the next key. The serial decryption logic module 13 includes row shift logic, byte replacement logic, round key addition logic, and column obfuscation logic. The round key addition logic is configured to perform serial round key addition operations, the column obfuscation logic is configured to perform serial column obfuscation transformation operations, the row shift logic is configured to perform serial row shift transformation operations, and the byte replacement logic is configured to perform serial byte replacement operations. The serial decryption logic module is reused to perform decryption in all intermediate decryption rounds. During the final round of decryption, the serial decryption logic module 13 is also used to perform row shifting, byte replacement, and round key addition on the four sets of pre-processed data using the final round key read from RAM.

[0081] The FPGA device with high-speed AES decryption function of this embodiment is based on the characteristic that there is no correlation between the front and rear wheels of the computing module during the decryption process. By fully utilizing the idle timing of the computing module, the device is improved from the traditional processing of one group of ciphertexts (i.e., a group of payload data collected on the satellite to be decrypted) to serial processing of four groups of ciphertexts in the same time, that is, completing the decryption calculation of the four groups of ciphertexts. Compared with the traditional fully parallel solution, it can not only greatly improve the AES decryption speed, but also reduce the resource usage to only one-fourth of the traditional fully parallel solution, thereby meeting the application requirements of AES in the field of high-speed real-time data processing of satellites.

[0082] In one embodiment, the serial decryption logic module and the round key addition combination logic module include N parallel groups, each group including a serial decryption logic module and a round key addition combination logic module; N is a positive integer not less than 2.

[0083] In one embodiment, AES decryption includes AES128 decryption, AES192 decryption, and AES256 decryption.

[0084] In one embodiment, another FPGA device with high-speed AES decryption functionality is provided, comprising an AES key expansion module, a serial decryption logic module, and a round key addition combinational logic module. The AES key expansion module generates all keys required for AES decryption and caches them in RAM. The round key addition combinational logic module reads the first round key from RAM and then performs round key addition on four input ciphertexts based on the first round key. The round key addition combinational logic module provides combinational logic for performing four round key addition operations. The serial decryption logic module is used to read the next secret key of the first round from RAM and then serially perform row shifting, byte replacement, round key addition, and column obfuscation on the four sets of pre-processed data according to the next secret key. The serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic, and column obfuscation logic. The round key addition logic is configured for serial round key addition operations, the column obfuscation logic is configured for serial column obfuscation transformation operations, the row shift logic is configured for serial row shift transformation operations, and the byte replacement logic is configured for serial byte replacement operations. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption. When performing the final round of decryption on the data, the serial decryption logic module is also used to perform row shifting and byte replacement on the four sets of pre-processed data according to the final round key read from RAM. The round key addition combination logic is also used to perform round key addition on the data output after the serial decryption logic module performs byte replacement according to the final round key.

[0085] The FPGA-based AES decryption device of this embodiment takes advantage of the fact that there is no correlation between the front and rear wheels of the computing module during the decryption process. By fully utilizing the idle timing of the computing module, the device improves the traditional processing of one set of ciphertexts (i.e., a set of payload data collected on board to be decrypted) to serial processing of four sets of ciphertexts within the same time period, completing the decryption calculations of the four sets of ciphertexts. Compared with the traditional fully parallel solution, this not only significantly improves the AES decryption speed, but also reduces the resource usage to only one-fourth of that of the traditional fully parallel solution, thereby meeting the application requirements of AES in the field of high-speed real-time data processing on satellites.

[0086] It is understood that the explanation of the various features of the above-mentioned FPGA device with high-speed AES decryption function can be understood in the same way as the corresponding explanations in the various embodiments of the AES decryption method implemented based on FPGA. Each module in the above-mentioned FPGA device with high-speed AES decryption function can be implemented in whole or in part by software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of a device with data processing function in hardware form, or can be stored in the memory of the aforementioned device in software form, so that the processor can call and execute the operations corresponding to the above modules. The aforementioned device can be, but is not limited to, various types of FPGA chips or encryption and decryption devices existing in the art.

[0087] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the following processing steps when executing the computer program: generating all keys required for AES decryption through an AES key expansion module in an FPGA chip and caching them in RAM; after reading a first-round key from RAM, performing round key addition on four groups of input ciphertexts according to the first-round key through round key addition combination logic in the FPGA chip; the round key addition combination logic is a combination logic for implementing four round key addition operations; after reading the next key of the first-round key from RAM, performing round key addition on the four groups of pre-processed data through a serial decryption logic module in the FPGA chip. According to the next secret key, row shift, byte replacement, round key addition and column confusion are serially performed; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic and column confusion logic, the round key addition logic is configured as a serial round key addition operation, the column confusion logic is configured as a serial column confusion transformation operation, the row shift logic is configured as a serial row shift transformation operation, and the byte replacement logic is configured as a serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate round decryptions; when the last round decryption is performed on the data, the serial decryption logic module performs row shift, byte replacement and round key addition on the four groups of pre-processed data according to the last round secret key read from the RAM.

[0088] When executing a computer program, the processor implements the following processing steps: generating all the secret keys required for AES decryption through the AES secret key expansion module in the FPGA chip and caching them in RAM; after reading the first round secret key from RAM, performing round key addition on the four groups of input ciphertexts according to the first round secret key through the round key addition combination logic in the FPGA chip; the round key addition combination logic is a combination logic for implementing four round key addition operations; after reading the next secret key of the first round secret key from RAM, performing row shift, byte replacement, round key addition and column confusion serially on the four groups of pre-processed data according to the next secret key through the serial decryption logic module in the FPGA chip; the serial decryption logic The logic module includes row shift logic, byte replacement logic, round key addition logic and column confusion logic. The round key addition logic is configured as a serial round key addition operation, the column confusion logic is configured as a serial column confusion transformation operation, the row shift logic is configured as a serial row shift transformation operation, and the byte replacement logic is configured as a serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption. When the last round of decryption is performed on the data, the serial decryption logic module performs row shift and byte replacement on the four groups of pre-processed data according to the last round key read from the RAM, and then the round key addition combination logic is reused to perform round key addition on the four groups of pre-processed data according to the last round key.

[0089] In one embodiment, when executing the computer program, the processor may further implement the additional steps or sub-steps in each embodiment of the above-mentioned AES decryption method based on FPGA.

[0090] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following processing steps are implemented: after reading the first-round key from the RAM, all the keys required for AES decryption are generated by the AES key expansion module in the FPGA chip and cached to the RAM; after reading the first-round key from the RAM, the round key addition combination logic in the FPGA chip performs round key addition on the four groups of input ciphertexts according to the first-round key; the round key addition combination logic is a combination logic for implementing four round key addition operations; after reading the next key of the first-round key from the RAM, the serial decryption logic module in the FPGA chip performs round key addition on the four groups of pre-processed data according to the next round key. A secret key serially performs row shift, byte replacement, round key addition and column confusion; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic and column confusion logic, the round key addition logic is configured as a serial round key addition operation, the column confusion logic is configured as a serial column confusion transformation operation, the row shift logic is configured as a serial row shift transformation operation, and the byte replacement logic is configured as a serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate round decryptions; when the last round decryption is performed on the data, the serial decryption logic module performs row shift, byte replacement and round key addition on the four groups of pre-processed data according to the last round secret key read from the RAM.

[0091] When the computer program is executed by the processor, the following processing steps are implemented: all the secret keys required for AES decryption are generated by the AES secret key expansion module in the FPGA chip and cached to RAM; after reading the first round secret key from RAM, the round key addition combination logic in the FPGA chip is used to perform round key addition on the four groups of input ciphertexts according to the first round secret key; the round key addition combination logic is a combination logic for implementing four round key addition operations; after reading the next secret key of the first round secret key from RAM, the serial decryption logic module in the FPGA chip is used to serially perform row shift, byte replacement, round key addition and column confusion on the four groups of pre-processed data according to the next secret key; the serial decryption logic The logic module includes row shift logic, byte replacement logic, round key addition logic and column confusion logic. The round key addition logic is configured as a serial round key addition operation, the column confusion logic is configured as a serial column confusion transformation operation, the row shift logic is configured as a serial row shift transformation operation, and the byte replacement logic is configured as a serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption. When the last round of decryption is performed on the data, the serial decryption logic module performs row shift and byte replacement on the four groups of pre-processed data according to the last round key read from the RAM, and then the round key addition combination logic is reused to perform round key addition on the four groups of pre-processed data according to the last round key.

[0092] In one embodiment, when the computer program is executed by a processor, it can also implement the additional steps or sub-steps in each embodiment of the above-mentioned AES decryption method based on FPGA.

[0093] Those skilled in the art will appreciate that all or part of the processes in the above-described embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-described methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus dynamic random access memory (Rambus DRAM, abbreviated as RDRAM) and interface dynamic random access memory (DRDRAM).

[0094] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0095] The above embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that a person skilled in the art would be able to make numerous modifications and improvements without departing from the spirit of the present invention, all of which fall within the scope of the present invention. Therefore, the scope of the present invention shall be determined by the appended claims.

Claims

1. An AES decryption method based on FPGA, characterized in that: Including steps: Generate all the keys required for AES decryption through the AES key expansion module in the FPGA chip and cache them in RAM; After reading the first round key from the RAM, the round key addition combination logic in the FPGA chip performs round key addition on the four sets of input ciphertexts according to the first round key; the round key addition combination logic is a combination logic for implementing four round key addition operations; After reading the next secret key of the first round key from the RAM, the serial decryption logic module in the FPGA chip serially performs row shift, byte replacement, round key addition and column obfuscation on the four groups of pre-processed data according to the next secret key; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic and column obfuscation logic, the round key addition logic is configured for serial round key addition operation, the column obfuscation logic is configured for serial column obfuscation transformation operation, the row shift logic is configured for serial row shift transformation operation, and the byte replacement logic is configured for serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption; When final round decryption is performed on the data, the serial decryption logic module performs row shifting, byte replacement, and round key addition on the four groups of pre-processed data according to the final round key read from the RAM.

2. The AES decryption method based on FPGA according to claim 1, characterized in that: The serial decryption logic module and round key plus combination logic configured in the FPGA chip include N parallel groups, each group including one serial decryption logic module and one round key plus combination logic; N is a positive integer not less than 2.

3. The AES decryption method based on FPGA implementation according to claim 2 or 3, characterized in that: The AES decryption includes AES128 decryption, AES192 decryption and AES256 decryption.

4. An AES decryption method based on FPGA, characterized in that: Including steps: Generate all the keys required for AES decryption through the AES key expansion module in the FPGA chip and cache them in RAM; After reading the first round key from the RAM, the round key addition combination logic in the FPGA chip performs round key addition on the four sets of input ciphertexts according to the first round key; the round key addition combination logic is a combination logic for implementing four round key addition operations; After reading the next secret key of the first round key from the RAM, the serial decryption logic module in the FPGA chip serially performs row shift, byte replacement, round key addition and column obfuscation on the four groups of pre-processed data according to the next secret key; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic and column obfuscation logic, the round key addition logic is configured for serial round key addition operation, the column obfuscation logic is configured for serial column obfuscation transformation operation, the row shift logic is configured for serial row shift transformation operation, and the byte replacement logic is configured for serial byte replacement operation. The serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption; When performing the final round decryption on the data, the serial decryption logic module performs row shift and byte replacement on the four groups of pre-processed data according to the final round key read from the RAM, and then reuses the round key addition combination logic to perform round key addition on the four groups of pre-processed data according to the final round key.

5. An FPGA device with high-speed AES decryption function, characterized in that: include: AES key expansion module, used to generate all the keys required for AES decryption and cache them in RAM; a round key addition combination logic module, configured to read the first round key from the RAM and then perform round key addition on the four input ciphertexts according to the first round key; the round key addition combination logic is a combination logic for implementing four round key addition operations; A serial decryption logic module is configured to, after reading the next secret key of the first-round secret key from the RAM, serially perform row shifting, byte replacement, round key addition, and column obfuscation on four sets of pre-processed data according to the next secret key; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic, and column obfuscation logic; the round key addition logic is configured to perform a serial round key addition operation, the column obfuscation logic is configured to perform a serial column obfuscation transformation operation, the row shift logic is configured to perform a serial row shift transformation operation, and the byte replacement logic is configured to perform a serial byte replacement operation; the serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption; The serial decryption logic module is further configured to perform row shifting, byte replacement, and round key addition on four groups of pre-processed data according to the final round secret key read from the RAM when performing final round decryption on the data.

6. The FPGA device with high-speed AES decryption function according to claim 5, characterized in that: The serial decryption logic module and the round key adding and combining logic module include N parallel groups, each group includes one serial decryption logic module and one round key adding and combining logic module; N is a positive integer not less than 2.

7. The FPGA device with high-speed AES decryption function according to claim 5 or 6, characterized in that: The AES decryption includes AES128 decryption, AES192 decryption and AES256 decryption.

8. An FPGA device with high-speed AES decryption function, characterized in that: include: AES key expansion module, used to generate all the keys required for AES decryption and cache them in RAM; a round key addition combination logic module, configured to read the first round key from the RAM and then perform round key addition on the four input ciphertexts according to the first round key; the round key addition combination logic module is a combination logic for implementing four round key addition operations; A serial decryption logic module is configured to, after reading the next secret key of the first-round secret key from the RAM, serially perform row shifting, byte replacement, round key addition, and column obfuscation on four sets of pre-processed data according to the next secret key; the serial decryption logic module includes row shift logic, byte replacement logic, round key addition logic, and column obfuscation logic; the round key addition logic is configured to perform a serial round key addition operation, the column obfuscation logic is configured to perform a serial column obfuscation transformation operation, the row shift logic is configured to perform a serial row shift transformation operation, and the byte replacement logic is configured to perform a serial byte replacement operation; the serial decryption logic module is reused to perform decryption in all intermediate rounds of decryption; When performing the last round of decryption on the data, the serial decryption logic module is also used to perform row shifting and byte replacement on the four groups of pre-processed data according to the last round key read from the RAM, and the round key addition combination logic is also used to perform round key addition on the data output after the serial decryption logic module performs byte replacement according to the last round key.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the AES decryption method based on FPGA as described in any one of claims 1 to 4 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the FPGA-based AES decryption method according to any one of claims 1 to 4 are implemented.

Images