AES-GCM authentication encryption method and device with low resource consumption

Abstract

The invention discloses an AES-GCM authentication encryption method and device with low resource consumption. The method comprises the following steps: firstly, acquiring input data, a symmetric key, an initial vector, to-be-processed data and additional authentication data; a key stream used for encryption is generated through a first processing process, the first processing process comprises the steps of executing AES encryption operation, and the AES encryption operation is completed through multi-cycle iteration with the bit width lower than 128 bits; under the condition that the to-be-processed data is the first plaintext, performing XOR operation on the first plaintext and the key stream to generate a first ciphertext; the authentication tag is generated through a second processing procedure, the second processing procedure comprises executing GHASH calculation, Galois field multiplication contained in the GHASH calculation is completed through multi-cycle iteration with the bit width lower than 128 bits, and the execution time sequence of the first processing procedure and the execution time sequence of the second processing procedure are scheduled to be at least partially overlapped. And the efficient AES-GCM authentication encryption processing is realized.

Description

Technical Field

[0001] This application belongs to the field of cryptographic hardware accelerator technology, and in particular relates to a low-resource-consumption AES-GCM authentication encryption method and apparatus. Background Technology

[0002] The Advanced Encryption Standard Galois / Counter Mode (AES-GCM) algorithm provides integrity authentication while encrypting data, and has become one of the mainstream technologies for ensuring data security in scenarios such as the Internet of Things (IoT) and embedded systems. In these resource-constrained application environments, processor computing power is limited, and implementing AES-GCM in software is difficult to meet real-time requirements. Therefore, using dedicated hardware for acceleration has become an inevitable choice.

[0003] In related technologies, common AES-GCM hardware acceleration solutions are typically designed based on high-bit-width parallel processing architectures to achieve high throughput. These solutions significantly improve data processing speed by parallelizing and pipelining the key computational units of the algorithm.

[0004] However, while the aforementioned high-bit-width parallel architecture improves performance, it also leads to a significant increase in hardware logic size, register count, and wiring resources, resulting in problems such as large chip area, high power consumption, and high cost. This makes it difficult to apply such high-performance hardware solutions in resource-constrained scenarios such as IoT terminals and portable devices where cost and power consumption are extremely sensitive. Summary of the Invention

[0005] This application provides a low-resource-consumption AES-GCM authentication and encryption method and apparatus, which can effectively achieve efficient AES-GCM authentication and encryption processing under limited hardware resources.

[0006] The first aspect of this application provides a low-resource-consumption AES-GCM authentication encryption method, comprising: acquiring input data for an AES-GCM algorithm, wherein the input data includes a symmetric key, an initialization vector, data to be processed, and additional authentication data; generating a key stream for encryption through a first processing step, wherein the first processing step includes performing an Advanced Encryption Standard (AES) encryption operation based on the symmetric key and the initialization vector, wherein the AES encryption operation is completed through multiple iterations with a bit width of less than 128 bits; when the data to be processed is a first plaintext, performing an XOR operation on the first plaintext and the key stream to generate a first ciphertext; and generating an authentication tag through a second processing step, wherein the second processing step includes performing a Galois Hash (GHASH) calculation based on the additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext, wherein the Galois field multiplication operation included in the GHASH calculation is completed through multiple iterations with a bit width of less than 128 bits, and the execution timing of the first processing step and the second processing step is scheduled to at least partially overlap.

[0007] In the technical solution of this application, by requiring both AES encryption operation and Galois field multiplication operation to be completed through multiple cycles with a bit width of less than 128 bits, and scheduling the execution timing of the first processing process and the second processing process to at least partially overlap, the hardware logic resources required for encryption, decryption and authentication operations are significantly reduced, while effectively compensating for the potential performance loss caused by small bit width serialization processing, thus achieving a good balance between hardware resource consumption and overall processing efficiency.

[0008] Optionally, in one possible implementation of the first aspect, the generation of the authentication tag through the second processing step includes: formatting the additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext into multiple 128-bit data blocks; iteratively processing the multiple 128-bit data blocks to obtain the Galois field multiplication result, wherein each iteration includes a Galois field multiplication operation, which includes: performing multiple accumulation operations on portions with a bit width less than 128 bits within multiple consecutive clock cycles to complete the 128-bit Galois field multiplication operation; and performing an XOR operation between the Galois field multiplication result and the authentication encrypted data block to generate the authentication tag, wherein the authentication encrypted data block is obtained by AES encryption of the initial value of the counter determined by the initialization vector using a symmetric key. Therefore, by decomposing the Galois field multiplication operation in GHASH computation into multiple partial accumulation operations with a bit width of less than 128 bits performed in multiple consecutive clock cycles, the field multiplier, which traditionally requires large-scale parallel logic implementation, is transformed into a structure that is iteratively completed by a small number of low-width operation units, greatly reducing the hardware area of ​​the authentication computing unit.

[0009] Optionally, in another possible implementation of the first aspect, the above-mentioned partial accumulation operation with a bit width less than 128 bits is used to complete the 128-bit Galois field multiplication operation, including: using the multiplier of the Galois field multiplication operation as the current operand and initializing the partial product; performing a low-bit-width iteration step, which includes: cyclically shifting the current operand and generating a control signal based on the value of the shifted-out bit; in response to the control signal, performing an XOR operation between the multiplicand of the Galois field multiplication operation and a selected portion of the partial product with a bit width less than 128 bits to update the partial product; performing an update operation based on Galois field rules on the multiplicand; repeating the low-bit-width iteration step until the current operand is processed, and determining the value of the partial product as the result of the current Galois field multiplication operation. Therefore, by employing iterative steps including cyclic shifting, shift-out conditional control, and small-bit-width XOR accumulation to complete each Galois field multiplication, a deterministic and regular timing control flow is achieved. The complete field multiplication function is realized using extremely simple arithmetic logic units, further optimizing the regularity and area efficiency of the circuit structure.

[0010] Optionally, in another possible implementation of the first aspect, the above-mentioned update operation based on the Galois field rule for the multiplicand includes: performing a left shift operation on the multiplicand by one bit, and simultaneously determining the most significant bit before the shift, wherein the update operation and the XOR operation are performed within the same clock cycle; if the most significant bit is a preset value, the left-shifted multiplicand is XORed with a fixed compensation value to complete the modulo reduction. Thus, by arranging the update operation based on the Galois field rule and the XOR operation of the small-width portion accumulation to be performed synchronously within the same clock cycle, a "zero-latency" embedding of the modulo reduction process is achieved in hardware, eliminating the need for additional pipeline stages or waiting cycles for modulo reduction, optimizing the computational critical path of each iteration, and significantly improving the clock frequency and overall computational efficiency of the Galois field multiplication module.

[0011] Optionally, in another possible implementation of the first aspect, the generation of the keystream for encryption through the first processing step includes: performing AES encryption on a counter sequence determined by an initialization vector using a symmetric key to generate the keystream; the AES encryption operation is completed through multiple iterations with a bit width of less than 128 bits, including: in at least one round of the multiple iterations, calling a preset byte substitution lookup table to perform byte substitution on key expansion-related data in a first time period, and calling the byte substitution lookup table to perform byte substitution on encrypted state data in a second time period, wherein the first time period and the second time period do not overlap. Thus, by using the same preset byte substitution lookup table to serve the key expansion and data encryption paths respectively in different and non-overlapping time periods during the multiple iterations of the AES encryption operation, time-division multiplexing of hardware resources is achieved, eliminating the resource overhead of equipping two paths with independent byte substitution lookup tables, and significantly reducing the memory resource consumption of the core encryption module.

[0012] Optionally, in another possible implementation of the first aspect, the aforementioned AES encryption operation performs column obfuscation on the current encrypted state data in at least one encryption round. The column obfuscation operation includes the following steps: dividing the column to be processed in the encrypted state data into multiple data segments with a bit width of less than 128 bits; within multiple consecutive clock cycles, for each data segment, according to the preset AES column obfuscation transformation fixed matrix coefficients, calculating the partial column obfuscation result corresponding to the data segment through multiple finite field addition and multiplication operations with a bit width of less than 128 bits; combining the partial column obfuscation results corresponding to all data segments to obtain the column obfuscation operation result. Thus, by decomposing the matrix multiplication of column obfuscation into serial processing of small data segments, this design avoids the complex parallel matrix multiplication circuits in traditional implementations, replacing them with a series of simple, regular small-bit-width arithmetic logic operations, thereby significantly reducing the hardware complexity and area of ​​the column obfuscation module.

[0013] Optionally, in another possible implementation of the first aspect, the encrypted state data is encrypted state data that has undergone row shifting. Before dividing the columns to be processed in the encrypted state data into multiple data segments with a width of less than 128 bits, the method further includes: reading the row-shifted encrypted state data from the register storing the encrypted state data according to the offset order set by the preset AES row shifting rules. Thus, the storage layout of the state matrix in the register and the address sequence for subsequent data reading have been pre-encoded with the row shifting rules, so that the row shift is naturally completed when the data is read out, thereby completely eliminating the need for explicit row shifting circuitry at the hardware level, further saving area and power consumption.

[0014] Optionally, in another possible implementation of the first aspect, the method further includes: when the data to be processed is a second ciphertext, performing an XOR operation on the second ciphertext and the key stream to generate a second plaintext; generating a first authentication tag through a second processing procedure, wherein the second processing procedure further includes performing GHASH calculation based on the additional authentication data, the second ciphertext, the length of the additional authentication data, and the length of the second ciphertext; comparing and verifying the first authentication tag with the received second authentication tag, and determining the second plaintext to be valid if the verification matches. Thus, by explicitly specifying in the decryption process that the locally generated first authentication tag is compared and verified with the received second authentication tag, and determining the decrypted second plaintext to be valid only if the verification matches, the authentication and decryption semantics required by the AES-GCM standard are fully implemented, ensuring that only data that passes integrity verification is output or used, fundamentally preventing the tampered or forged ciphertext data from being mistakenly accepted, and improving the security and reliability of the entire encrypted communication system or storage system.

[0015] A second aspect of this application provides a low-resource-consumption AES-GCM authentication and encryption device, comprising:

[0016] The data acquisition module is used to acquire the input data of the AES-GCM algorithm, which includes the symmetric key, initialization vector, data to be processed, and additional authentication data.

[0017] The encryption processing module is used to generate a key stream for encryption through a first processing procedure, wherein the first processing procedure includes performing AES encryption operation based on a symmetric key and an initialization vector, and the AES encryption operation is completed through multiple cycles with a bit width of less than 128 bits.

[0018] The XOR operation module is used to perform an XOR operation between the first plaintext and the key stream to generate the first ciphertext when the data to be processed is the first plaintext.

[0019] An authentication processing module is used to generate an authentication tag through a second processing procedure, wherein the second processing procedure includes performing a GHASH calculation based on additional authentication data, a first ciphertext, the length of the additional authentication data, and the length of the first ciphertext. The GHASH calculation includes Galois field multiplication operations that are completed through multiple cycles with a bit width of less than 128 bits. The execution timing of the first processing procedure and the second processing procedure is scheduled to overlap at least partially.

[0020] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the low-resource-consumption AES-GCM authentication encryption method of the first aspect described above.

[0021] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the low-resource-consumption AES-GCM authentication and encryption method of the first aspect described above.

[0022] The fifth aspect of this application provides a computer program product that, when run on an electronic device, causes the electronic device to perform the low-resource-consumption AES-GCM authentication and encryption method of the first aspect described above.

[0023] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart illustrating a low-resource-consumption AES-GCM authentication and encryption method provided in an embodiment of this application; Figure 2 This is a schematic diagram of the low hardware overhead AES-GCM hardware architecture based on a small bit width design provided in the embodiments of this application; Figure 3 This is a schematic diagram of the hardware architecture of the small-bit-width AES encryption core provided in the embodiments of this application; Figure 4 This is a timing diagram of the small-bit-width AES encryption core for single-round encryption provided in an embodiment of this application; Figure 5 This is the overall computation timing diagram of AES-GCM provided in the embodiments of this application; Figure 6 This is a schematic diagram of the area-optimized Galois field multiplication module GMult provided in an embodiment of this application; Figure 7 This is a schematic diagram of a low-resource-consumption AES-GCM authentication and encryption device provided in an embodiment of this application; Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0026] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0027] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0028] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0029] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0030] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0031] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0032] It should be understood that the sequence number of each step in this embodiment does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of this application embodiment.

[0033] To facilitate understanding of the embodiments of this application, the relevant concepts involved in the embodiments of this application will be briefly explained first: 1. Advanced Encryption Standard (AES): AES is a symmetric-key encryption algorithm widely used for data encryption. It uses a fixed-length 128-bit, 192-bit, or 256-bit key to encrypt and decrypt data. The core of AES lies in performing a series of complex substitution and permutation operations on data blocks to ensure data security.

[0034] 2. Galois Counter Mode (GCM): GCM is an authentication encryption mode used to enhance the security of encryption systems. GCM combines Counter Mode (CTR) and Galois field multiplication to generate authentication tags. This mode not only provides encryption of data but also ensures data integrity and authenticity by generating authentication tags.

[0035] 3. Counter Mode (CTR): CTR is a stream cipher mode that uses an incrementing counter combined with a key to generate a series of encrypted streams. These encrypted streams are then XORed bit-by-bit or byte-by-byte with the plaintext data to produce ciphertext.

[0036] 4. Galois Hash: GHASH is a hash function used to generate authentication tags, playing a crucial role in AES-GCM. GHASH works by encrypting data and hashing it with a hash subkey. Galois field multiplication and accumulation are performed to generate a label that verifies data integrity and authenticity. This process leverages the properties of Galois field operations, enabling efficient execution and ensuring the security of authentication. GHASH is a crucial component of data authentication in the AES-GCM model.

[0037] In related technologies, common AES-GCM hardware acceleration solutions are typically designed based on high-bit-width parallel processing architectures to achieve high throughput. These solutions significantly improve data processing speed by parallelizing and pipelining key computational units of the algorithm. However, while improving performance, these high-bit-width parallel architectures also lead to a significant increase in hardware logic size, register count, and wiring resources, resulting in large chip area, high power consumption, and high cost. This makes such high-performance hardware solutions difficult to apply in resource-constrained scenarios such as IoT terminals and portable devices where cost and power consumption are extremely sensitive.

[0038] In view of this, embodiments of this application provide a low-resource-consumption AES-GCM authentication encryption method and apparatus. The method includes: firstly, acquiring input data for the AES-GCM algorithm, wherein the input data includes a symmetric key, an initialization vector, data to be processed, and additional authentication data; then generating a key stream for encryption through a first processing step, wherein the first processing step includes performing AES encryption operations based on the symmetric key and the initialization vector, the AES encryption operations being completed through multiple cycles of iteration with a bit width of less than 128 bits; nextly, when the data to be processed is a first plaintext, performing an XOR operation on the first plaintext and the key stream to generate a first ciphertext; finally generating an authentication tag through a second processing step, wherein the second processing step includes performing GHASH calculation based on the additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext, the GHASH calculation including Galois field multiplication operations being completed through multiple cycles of iteration with a bit width of less than 128 bits, and the execution timing of the first processing step and the second processing step being scheduled to at least partially overlap. Therefore, by requiring both AES encryption and Galois field multiplication to be completed through multiple cycles with a bit width of less than 128 bits, and scheduling the execution timing of the first and second processing processes to at least partially overlap, the hardware logic resources required for encryption, decryption, and authentication operations are significantly reduced, while effectively compensating for the potential performance loss caused by small-bit-width serialization processing, thus achieving a good balance between hardware resource consumption and overall processing efficiency.

[0039] To illustrate the technical solution of this application, specific embodiments are described below.

[0040] Reference Figure 1 The diagram illustrates a flowchart of a low-resource-consumption AES-GCM authentication and encryption method provided in an embodiment of this application. Figure 1 As shown, this low-resource-consumption AES-GCM authentication and encryption method may include the following steps: Step 101: Obtain the input data for the AES-GCM algorithm.

[0041] In this embodiment, the input data refers to the initial information required to initiate and complete an AES-GCM GCM authentication encryption or authentication decryption operation. Specifically, the input data for the AES-GCM algorithm includes a symmetric key. Initial vector The data to be processed (Text_in) and additional authentication data .

[0042] Among them, symmetric key This is the secret key used in the AES encryption algorithm, and its length can be 128 bits, 192 bits, or 256 bits. This symmetric key The AES encryption function has been uniquely determined. The AES encryption function Indicates the input block A deterministic function applying AES encryption. The symmetric key plays a central role in the entire AES-GCM operation, used both to generate the keystream required for counter-mode CTR encryption and to derive the hash subkey required for subsequent Galois domain hash (GHASH) calculations. ,in, , It is a 128-bit string of all zeros.

[0043] Wherein, the initial vector (Also represented by Nonce) is a random and unique numerical value, with a length of up to 96 bits. Initialization vector It is the initial value for constructing the counter. The foundation. The specific formula can be... “ "Indicates bit concatenation, initial value of the counter" This will be used to generate the encryption key stream later.

[0044] The data to be processed, Text_in, is the main data stream that needs to be authenticated and encrypted or decrypted. In encrypted mode, the data to be processed is plaintext to be encrypted. It can be divided into plaintext blocks of 128 bits. ， ，…， In decryption mode, the data to be processed is the ciphertext block to be decrypted. , , … , .

[0045] Among them, additional authentication data This refers to associated data whose integrity needs to be verified but which does not require encryption. Authentication data is appended during the authentication label generation process. ciphertext sequence The length information will be jointly formatted into several 128-bit blocks. ，…， It participates in GHASH operations.

[0046] In one embodiment, due to the extreme sensitivity to hardware cost and power consumption in resource-constrained scenarios such as the Internet of Things and embedded systems, processing the aforementioned input data and performing complete AES-GCM operations via software would consume a large amount of processor resources, making it difficult to meet real-time requirements. Therefore, this application proposes using a dedicated, ultra-lightweight hardware architecture to efficiently acquire and process this input data. Figure 2 The diagram shown is a schematic of a low-hardware-overhead AES-GCM hardware architecture based on a small bit-width design provided in this application embodiment. This architecture receives and routes all input data through well-defined hardware interfaces and data paths. Specifically, the symmetric key... The Encrypt_Core module, which receives the small-bit-width AES encryption core directly through a dedicated input port, is responsible for executing all symmetric key-based encryption. The encryption transformation; the initialization vector Nonce and a constant signal representing logic '0' are fed into Encrypt_Core through a multiplexer to participate in constructing the initial value of the counter. The related operations; the data to be processed, Text_in, serves as the core data stream, and its path is finely scheduled: on one hand, it is guided to an XOR logic unit via a set of multiplexers, waiting to be XORed with the key stream generated by Encrypt_Core to complete encryption and decryption; on the other hand, under the coordination of the control logic, this data stream is combined with signals such as length information Len, encryption control signal Encrypt, and any additional authentication data, to prepare formatted input blocks for subsequent GHASH calculations. The encryption control signal Encrypt is used to identify the current working mode (encryption or decryption), thereby determining whether the data to be processed, Text_in, is treated as plaintext or ciphertext, and guiding the multiplexer to select the correct data path.

[0047] It should be noted that, Figure 2 The overall architecture shown is the physical basis for achieving the low resource consumption goal of this application. Its most significant feature is the small bit-width data path design that runs through the AES encryption core Encrypt_Core and the Galois field multiplication module GMult. This means that all core computing units use bit widths far below 128 bits (e.g., 1 bit, 2 bits, 4 bits, 8 bits, or 16 bits) for data transfer and computation. This design breaks down the parallel computation that is traditionally completed in a single clock cycle into iterative steps over multiple clock cycles. At the cost of increasing the number of operation clock cycles, it achieves a significant reduction in the size of combinational logic circuits, the number of registers, and interconnection wiring resources, thereby achieving a significant reduction in chip area and power consumption. In addition, all multiplexers in the architecture operate under control signals such as the encryption control signal Encrypt and the length information Len, realizing efficient time-division multiplexing of the same set of hardware computing resources (such as arithmetic units and data paths) in different stages such as encryption, decryption, key expansion, and hash calculation, further compressing the overall hardware overhead.

[0048] In this embodiment of the application, after successfully acquiring all the above input data and loading it into the corresponding hardware module, the system will proceed to the subsequent key stream generation and authentication tag calculation process according to the working mode.

[0049] Step 102: Generate a key stream for encryption through the first processing procedure.

[0050] In this embodiment of the application, the first processing step includes processing according to a symmetric key. and initial vector Perform AES encryption to generate a keystream for encryption or decryption. The keystream generation follows the Counter Mode (CTR) procedure defined in the AES-GCM standard. Specifically, it first utilizes the symmetric key obtained in the preceding steps. and initial vector Construct the initial value of the counter Then, the encryption process is performed on the first... i ( i Calculate for groups of (positive integers greater than or equal to 1): , ,in For the first i A ciphertext block, "This is a bitwise XOR operation. Keystream blocks." XOR with plaintext blocks to produce ciphertext, or XOR with ciphertext blocks to recover plaintext.

[0051] In this embodiment, the AES encryption operation is completed at the hardware level with a bit width significantly lower than 128 bits through multiple iterations, thereby achieving extreme optimization of hardware resources. Traditional AES-GCM hardware accelerators typically employ a 128-bit fully parallel data path, processing the entire 128-bit data block simultaneously in a single encryption operation. While this results in high throughput, it requires a large chip area and consumes significant power. In contrast, this embodiment proposes a small-bit-width, multi-cycle iteration AES encryption core design for resource-constrained devices.

[0052] In one embodiment, such as Figure 3 The diagram shows a hardware architecture schematic of a small-bit-width AES encryption core provided in this application embodiment. This encryption core is responsible for performing AES encryption operations, and its internal data path is designed with small bit widths of 1, 2, 4, or 8 bits. The entire AES encryption process (which may specifically include multiple rounds of iterative byte substitution (SubBytes), row shifting (ShiftRows), column mixing (MixColumns), and round key addition (AddRoundKey) operations) is broken down into multiple clock cycles. By reusing and progressively calculating small-bit-width data segments, a 128-bit block encryption is finally completed. This small-bit-width serial processing method trades time for area, transforming circuits that originally required large-scale parallel logic into compact iterative circuits, thereby significantly reducing the number of logic gates, register usage, and wiring resources.

[0053] In one possible implementation, the AES encryption core further reduces area through time-division multiplexing and hardware sharing. For example, the byte substitution operation in the AES algorithm requires a byte substitution lookup table, which can be called an S-box. In traditional designs, key expansion and data encryption often require separate S-box instances. However, in the embodiments of this application, reference can continue to be made to... Figure 3 The encryption core uses only one shared S-box hardware. In at least one round of multi-cycle iterations, this S-box is time-division multiplexed: in the first time period, it is invoked to perform byte substitution on relevant data in the key expansion path; in the second time period, it is invoked to perform byte substitution on the encrypted state data, wherein the first and second time periods do not overlap in clock cycle arrangement. Thus, by using the same pre-defined byte substitution lookup table to serve the key expansion and data encryption paths in different, non-overlapping time periods during the multi-cycle iterations of AES encryption operations, time-division multiplexing of hardware resources is achieved. This eliminates the resource overhead of equipping two paths with independent byte substitution lookup tables, significantly reducing the memory resource consumption of the AES encryption core.

[0054] In one embodiment, the column obfuscation operation in AES encryption is also redesigned for a smaller bit-width architecture. Column obfuscation is a computationally complex step in the AES algorithm, essentially involving the Galois field. The above performs a fixed matrix multiplication operation on each column of the state matrix, specifically for... Figure 3 The data in data state 1 shown is stored in a column, and the column confusion transformation is completed iteratively using multiple clock cycles. This is achieved through bit width reduction. Matrix multiplication is decomposed into simple XOR and shift operations. Column obfuscation operations may include the following steps: First, a column of encrypted state data to be processed (e.g., 32 bits) is divided into multiple data segments with a bit width of less than 128 bits (e.g., 4 or 8 bits). Then, over multiple consecutive clock cycles, for each data segment, according to a preset AES column obfuscation transformation with fixed matrix coefficients, multiple finite field additions (i.e., bitwise XOR) and multiplication operations (in...) with a bit width of less than 128 bits are performed. The process can be simplified to a finite number of shifts and conditional XOR operations to calculate the partial column obfuscation result corresponding to the data segment. Finally, the partial column obfuscation results corresponding to all data segments are combined to obtain the complete column obfuscation operation result. Thus, by decomposing the matrix multiplication of column obfuscation into serial processing of small data segments, this design avoids the complex 32-bit parallel matrix multiplication circuit in traditional implementations, replacing it with a series of simple, regular small-bit-width arithmetic logic operations, thereby significantly reducing the hardware complexity and area of ​​the column obfuscation module.

[0055] In one embodiment, the encrypted state data needs to undergo a row shift operation before performing column obfuscation. In the hardware architecture of this application embodiment, the row shift operation is implicitly implemented through a clever register access mechanism, without requiring additional dedicated shifter hardware. Specifically, before dividing the columns to be processed in the encrypted state data into multiple data segments with the lowest position, the row shift operation can also be performed from the register storing the encrypted state data (e.g., ...) according to the offset order set by the preset AES row shift rules. Figure 3 The encrypted state data after row shifting is read from data state 0 and data state 1. This means that the storage layout of the state matrix in the register and the address sequence for subsequent data reading have been pre-encoded with the row shift rules, so that the row shift is naturally completed when the data is read out, thus completely eliminating the need for explicit row shifting circuits at the hardware level, further saving area and power consumption.

[0056] In one embodiment, each round of encryption operations performed by the small-bit-width AES encryption core may also include a round key addition step. The round key addition operation generates and updates the round key in a bit-serial manner, XORing it bit-by-bit with the state matrix. That is, similar to operations such as byte substitution and column obfuscation, round key addition does not employ the traditional 128-bit parallel XOR method. Instead, the generation, updating, and XORing of the round key with the state data are performed serially according to a small bit width (e.g., 1, 2, or 4 bits) matching the main data path of the encryption core. Within each small-bit-width processing cycle, the round key state (i.e., ...) is generated, updated, and XORed with the state data. Figure 3 The key state module generates a round key fragment of corresponding bit width and XORs it with a data fragment of corresponding bit width read from the encryption state register. This bit-serial round key addition implementation ensures the bit width consistency of the entire AES encryption core data path, completely eliminating the need for wide bit XOR logic, and is an important component of the overall ultra-low hardware resource consumption.

[0057] To visually demonstrate the timing of the aforementioned small-bit-width AES encryption core, Figure 4 A timing diagram of a small-bit-width AES encryption core with single-round encryption is provided. The timing diagram uses a 1-bit data operation granularity as an example, with the horizontal axis representing clock cycles (cc). The timing diagram clearly shows how key operations such as key S-box replacement, data S-box replacement, and column obfuscation are finely scheduled and arranged over multiple clock cycles. This timing design reflects an efficient pipeline strategy within the module: by arranging different sub-operations in non-overlapping time periods and making full use of each clock cycle, the utilization rate of shared resources (such as S-boxes) is maximized, while minimizing idle waiting time for computation units. This effectively improves the processing efficiency of the encryption core under the constraint of low hardware resource consumption.

[0058] In one embodiment, continue to refer to Figure 4Assuming key loading is complete, the first step is to perform key S-box replacement, processing the key expansion path data for subsequent rounds of key generation. Then, in the 7th clock cycle, [the following steps are performed]. Figure 3 The 7 bits of data stored in data state 1 are concatenated with the 1 bit of data in data state 0 to form a complete data byte, which is then used for data S-box replacement. The entire data replacement process is grouped into 8 clock cycles, with each byte processed over 8 clock cycles. After processing 4 bytes consecutively, the data in data state 1 is filled. Next, the column obfuscation stage begins, employing a serialized calculation method. 4 bits of data are processed per clock cycle, and the column obfuscation operation on the data in data state 1 is completed over 8 consecutive clock cycles. This timing design optimizes the internal computation flow of the AES encryption core through pipelined processing, improving data processing speed and reducing computational latency.

[0059] In this embodiment, through the aforementioned optimization techniques based on small bit-width iteration, resource sharing, and implicit row shifting, the first processing step can generate a keystream conforming to the AES-GCM standard with extremely low hardware overhead, laying the foundation for subsequent encryption, decryption, and authentication calculations. During or after keystream generation, the system will proceed to subsequent steps according to the working mode, namely, performing an XOR operation on the data to be processed to complete encryption or decryption, and simultaneously initiating the authentication tag calculation process.

[0060] Step 103: If the data to be processed is the first plaintext, perform an XOR operation between the first plaintext and the key stream to generate the first ciphertext.

[0061] In this embodiment, step 103 is the core operation for achieving data confidentiality in AES-GCM mode, corresponding to the encryption stage of the counter mode (CTR). When the system is operating in encryption mode, the data to be processed, Text_in, obtained in the aforementioned steps is the first plaintext. The plaintext is then grouped into 128-bit blocks, and the encryption process is defined by the following formula: .

[0062] In this embodiment of the application, the above-mentioned XOR operation is integrated into the hardware implementation. Figure 2 In the low-resource-consumption hardware architecture shown, specifically, the first plaintext Text_in and the keystream are not XORed in parallel with a single 128-bit operation. Instead, they are adapted to the small-width data path, performing a segment-by-segment, streaming serial XOR operation at the same low position as the keystream generation. For example... Figure 2 As shown, the plaintext data stream is guided through a multiplexer to an XOR gate, the other input of which comes from the real-time output of the AES encryption core (i.e., a fragment of the key stream). The Encrypt control signal controls the multiplexer to ensure that, in encrypted mode, Text_in is correctly selected as plaintext to the XOR gate.

[0063] It should be noted that the advantages of the above design can be seen in, for example... Figure 5 The overall AES-GCM computation timing diagram further illustrates this. When the timing progresses to the "loading input text" stage, the processing blocks representing the Encrypt_Core and GMult operations are active simultaneously. More importantly, the input of the input text (Text_in) data and the encryption output of the Encrypt_Core to the current counter are time-aligned. This means that whenever the Encrypt_Core completes the computation of a low-position keystream segment, that segment is immediately XORed with the corresponding plaintext segment that arrives synchronously, producing a ciphertext segment. This streaming processing mechanism has two key benefits: First, it eliminates the delay caused by waiting for the entire 128-bit keystream block to be generated, achieving "output as it's generated" encryption results; second, it significantly reduces the demand for intermediate buffer memory. The system does not need to cache complete plaintext or keystream blocks, but only needs to process small bit-width data segments of the current clock cycle, further saving valuable on-chip storage resources.

[0064] Through the above process, the first plaintext is converted into the first ciphertext segment by segment. The generated ciphertext will be output in two directions: on the one hand, it will be output as the main encryption result (i.e., Figure 2 On the one hand, the data output is processed by the ciphertext generator; on the other hand, it is immediately fed back and used as a key input to the subsequent Galois field multiplication GMult module to initiate the authentication tag calculation process. This pipeline scheduling, which tightly couples ciphertext generation with authentication calculation, is the key to achieving the timing overlap between the first and second processing steps, laying the foundation for maintaining overall performance under low hardware resources.

[0065] Step 104: Generate an authentication label through the second processing procedure.

[0066] The second processing step includes processing additional authentication data. First cipher The length of the additional authentication data and the length of the first ciphertext are calculated using GHASH, and a final authentication tag is generated to achieve data integrity authentication. (See also...) Figure 2 The Galois field multiplication GMult module corresponding to GHASH will Multiplication is performed in a cyclic iterative manner. 128×128-bit Galois field multiplication is achieved by cyclic shifting and XORing with a small bit width, which greatly reduces the size of combinational logic.

[0067] In this embodiment of the application, GHASH calculation first adds the authentication data. ciphertext sequence The length information is concatenated and formatted into several 128-bit blocks. , … , The iterative calculation of GHASH is defined by the following formula: Among them, multiplication in the Galois domain The process is carried out using an irreducible polynomial. As a reduction modulus, the final output of GHASH is... The formula for calculating the certification label is: .

[0068] It should be noted that the Galois field multiplication operations involved in GHASH computation are completed through multiple iterations with a bit width of less than 128 bits, thus achieving ultra-low hardware resource consumption that matches the AES encryption core. Traditional GHASH hardware implementations typically rely on a 128-bit parallel Galois field multiplier, which has a large circuit size and is one of the main factors limiting the hardware area of ​​AES-GCM.

[0069] In one embodiment, generating the authentication tag through a second processing step may specifically include the following steps: First, formatting the additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext into multiple 128-bit data blocks. Then, iteratively processing these data blocks to obtain the Galois field multiplication result. The core of each iteration is a Galois field multiplication operation, which is completed over multiple consecutive clock cycles through multiple accumulation operations of portions with a bit width less than 128 bits. Finally, the final Galois field multiplication result is... With authentication encrypted data blocks Perform an XOR operation to generate an authentication label. Therefore, by decomposing the Galois field multiplication operation in GHASH computation into multiple partial accumulation operations with a bit width of less than 128 bits performed over several consecutive clock cycles, the field multiplier, which traditionally requires large-scale parallel logic implementation, is transformed into a structure iteratively completed by a small number of low-width operation units, greatly reducing the hardware area of ​​the authentication computing unit. This series of operations is implemented in hardware by... Figure 2 The area-optimized Galois field multiplication module GMult is shown.

[0070] In one embodiment, completing a 128-bit Galois field multiplication operation by multiple partial accumulation operations with a bit width less than 128 bits may include the following steps: using the multiplier of the Galois field multiplication operation as the current operand and initializing the partial product; performing a low-bit-width iteration step, which includes: cyclically shifting the current operand and generating a control signal based on the value of the shifted-out bits; in response to the control signal, performing an XOR operation between the multiplicand of the Galois field multiplication operation and a selected portion of the partial product with a bit width less than 128 bits to update the partial product; performing an update operation on the multiplicand based on Galois field rules; and repeating the low-bit-width iteration step until the current operand is processed, and determining the value of the partial product as the result of the current Galois field multiplication operation. Therefore, by employing iterative steps including cyclic shifting, shift-out conditional control, and small-bit-width XOR accumulation to complete each Galois field multiplication, a deterministic and regular timing control flow is achieved. The complete field multiplication function is realized using extremely simple arithmetic logic units, further optimizing the regularity and area efficiency of the circuit structure.

[0071] It should be noted that, for the detailed explanation of the low-width accumulation and operation, Figure 6 A schematic diagram of the area-optimized Galois field multiplication module GMult is provided. This module transforms a complete 128-bit Galois field multiplication into a fully serial, bit-by-bit iterative process. The Galois field multiplication module contains three 128-bit registers: a multiplier register... Multiplicand register and product register Multiplier register The current judgment bit is output through bit-by-bit scanning to determine whether to perform an accumulation operation on the product register in this iteration; the multiplicand register... During iteration, shifting and modulo reduction are performed to provide the multiplicand value required for the current iteration; product register. Store the partial product and include the final multiplication result after all iterations are complete. The mathematical form of field multiplication is: ,in , and through the model Joachim preserves his results within the Galois domain.

[0072] Specifically, the multiplier of this multiplication operation is stored in the multiplier register. Use it as the current operand and initialize the product register. The result is zero. Then, 128 rounds of the same low-bit-width iteration steps are performed. In each iteration: the multiplier register... Perform a circular right shift, and determine the least significant bit (i.e., the judgment bit) by shifting out. A control signal is generated; if the bit is '1', partial accumulation is triggered, at which point the multiplicand of the Galois field multiplication operation (stored in the multiplicand register) is... (middle) and product register A selected low-width portion (e.g., the lower 16 bits) is XORed to update the partial product; simultaneously, the multiplicand register is updated. The multiplicand in the product register undergoes an update operation based on the Galois field rule. It also performs circular shifts. By decomposing a single 128-bit full-width XOR into repeated XOR operations on multiple small bit-width segments (such as 16 bits) over multiple cycles, and using circular shifts to roll the data, this design replaces the bulky parallel XOR tree with extremely small, reusable low-bit XOR units, achieving a significant reduction in combinational logic area. After repeating this iterative step 128 times, the product register... The value in is the result of this Galois field multiplication operation.

[0073] The following example illustrates how, to achieve low hardware resource consumption, the Galois field multiplication module employs a small-bit-width serial accumulation strategy. This strategy divides the original 128-bit parallel XOR accumulation operation into sequential processing of multiple small-bit-width data segments over multiple clock cycles. For example, the 128-bit operation width is divided into 16-bit segments. In each iteration of the Galois field multiplication, data is processed from the multiplier register... Extract its current least significant bit. This is used as a judgment bit. When this judgment bit is 1, the product register... A field addition needs to be performed, that is, with the current multiplicand register. Perform a bitwise XOR operation on the values: To reduce the hardware area required to implement this XOR operation, the 128-bit XOR operation is not performed by a single 128-bit XOR gate, but is broken down into multiple smaller-width XOR units (e.g., 16 bits in the previous example). Through a circular shift mechanism, these smaller-width XOR units process the product register step-by-step in successive iterations. Different segments are processed to cover all 128 bits after multiple cycles, thus completing the full width accumulation with fewer logic resources.

[0074] In one embodiment, in order to keep the multiplicand in the Galois field during iteration... The correct mathematical representation in the text requires adjusting the multiplicand register in each iteration. Perform a shift update operation based on domain rules. Domain multiplication requires completion. This operation is equivalent to... Shift left by one bit. However, when highest position At that time, the left shift operation will result in a polynomial with a degree exceeding 127, therefore it is necessary to use an irreducible polynomial defined by the field. Perform overflow compensation. Specifically, the modulo reduction compensation is as follows: if overflow occurs, then... Among them, compensation items It corresponds to Excluding the highest term The coefficients outside the multiplicand. This ensures that the updated value of the multiplicand still satisfies the structural constraints of the 128-bit field elements. Overflow bits. In hardware, it is used as a control signal to trigger the compensation process. The compensation logic only needs to perform a conditional XOR at a fixed bit position, making the hardware implementation simple and efficient.

[0075] In one embodiment, performing an update operation based on the Galois field rule on the multiplicand may include: shifting the multiplicand left by one bit and simultaneously determining the most significant bit before the shift, wherein the update operation and the XOR operation are performed within the same clock cycle; if the most significant bit is a preset value, XORing the left-shifted multiplicand with a fixed compensation value to complete modulo reduction. Thus, by arranging the update operation based on the Galois field rule and the XOR operation of the small-bit-width portion to be executed synchronously within the same clock cycle, a "zero-latency" embedding of the modulo reduction process is achieved in hardware, eliminating the need for additional pipeline stages or waiting cycles for modulo reduction, optimizing the critical path of computation in each iteration, and significantly improving the clock frequency and overall computational efficiency of the Galois field multiplication module.

[0076] It should be noted that you can continue to refer to this. Figure 6 For the area-optimized GMult module, overflow compensation is integrated into the initial small-width XOR operation in each iteration (each iteration is a 128-bit XOR operation). During this process, the multiplicand register is... The highest bit is used for conditional judgment to determine in real time whether to trigger overflow compensation in this cycle. This compensation operation is related to the multiplicand register. The shift update operations are performed synchronously, ensuring that overflow compensation is immediately applied to the multiplicand value upon completion of each shift, avoiding the introduction of additional delay cycles or redundant calculations. This design significantly improves the computational efficiency of the GMult module while maintaining the mathematical accuracy and low hardware consumption characteristics of Galois field multiplication. In each iteration, the multiplier register... Multiplicand register AND product register The combined cyclic shift operation allows a single, small-width XOR unit to complete full coverage of 128 bits of data within multiple clock cycles. This is achieved with the multiplier register... After the 128 bits were scanned and judged in sequence, the product register... The partial products generated in each round are gradually accumulated, and the final product result is represented. After 128 iterations, the product register... The value satisfies This is the final result of the Galois field multiplication operation. By replacing the traditional 128-bit fully parallel combinational logic with a small-width iterative processing unit, the GMult module achieves a significant reduction in the hardware area of ​​the Galois field multiplier.

[0077] In one embodiment, the execution timing of the first processing step (generating the keystream) and the second processing step (GHASH computation) is scheduled to overlap at least partially to compensate for the increased overall processing latency that may result from using small-bit-width serial computation. Further details can be found in the following text. Figure 5 After the system starts up and completes the hash subkey After the calculation, the GMult module is not idle when the AES encryption core module begins processing the first counter value. Once the first ciphertext block... The output from the XOR gate is immediately fed into the GMult module, initiating the first GHASH iteration computation. Subsequently, as the encrypted stream continues to be generated and subsequent ciphertext blocks are produced, the computation of the GMult module is continuously activated. This deep, module-level pipeline scheduling ensures that encryption and authentication operations are tightly linked and overlapped on the timeline, effectively eliminating waiting windows at various levels from within modules to between modules. Therefore, although both AES encryption and GHASH computation require multiple clock cycles due to their small bit width design, the total completion time of the entire AES-GCM operation is significantly shortened because their execution periods are parallelized to the maximum extent. This maintains ultra-low hardware resource consumption while ensuring the overall processing efficiency and throughput of the system.

[0078] In one embodiment, this application also fully supports the AES-GCM decryption and verification process. Specifically, when the data to be processed is a second ciphertext, the second ciphertext is XORed with the key stream to generate a second plaintext; a first authentication tag is generated through a second processing step, which further includes performing a GHASH calculation based on the additional authentication data, the second ciphertext, the length of the additional authentication data, and the length of the second ciphertext; the first authentication tag is compared and verified with the received second authentication tag, and if the verification matches, the second plaintext is determined to be valid. Therefore, by explicitly specifying in the decryption process that the locally generated first authentication tag is compared and verified with the received second authentication tag, and that the decrypted second plaintext is only determined to be valid if the verification matches, the authentication and decryption semantics required by the AES-GCM standard are fully implemented. This ensures that only data that passes integrity verification is output or used, fundamentally preventing the tampered or forged ciphertext data from being mistakenly accepted, and improving the security and reliability of the entire encrypted communication or storage system.

[0079] It should be noted that the only difference between AES-GCM decryption and encryption is that the ciphertext is first divided into blocks. and the same counter stream Restore plaintext grouping Secondly, encrypted text is required. With additional data Recalculate and generate GHASH: Then verify. The validity of the tag is checked to confirm that the data has not been tampered with. Therefore, the decryption process is structurally consistent with encryption, but semantically adds a tag verification step.

[0080] In the embodiments of this application, reference continues to be made to Figure 2 In the hardware architecture, initially, Used as input value to calculate hash key The Nonce initialization vector is then fed into the GMult module. The Nonce is input to Encrypt_Core for counter-mode encryption, generating a keystream. Symmetric key. Key expansion and encryption operations are used for the AES encryption core. The data to be processed, Text_in, is in plaintext in encryption mode. In decryption mode, it is ciphertext. The output data is obtained by XORing the encryption result with the counter, thus implementing encryption and decryption operations in CTR mode. During the GHASH calculation process, generating the authentication tag requires additional authentication data (…). Figure 2 (The architecture assumes the data is empty) ciphertext Length information Len and hash subkey In decryption mode, the ciphertext Directly involved in GHASH calculations, the input information block, along with the length information Len, is input to the GMult module via a multiplexer. The GHASH calculation unit will process the input information block... The multiplication operations are progressively accumulated to obtain a 128-bit authentication tag. Through a small bit width and serialization design, the architecture effectively reduces hardware resource requirements, making it suitable for embedded systems and resource-constrained applications.

[0081] It should be noted that in the area-optimized GMult module hardware implementation for Galois field multiplication, an innovative mechanism integrating cyclic shift and implicit modular reduction is used for updating the multiplicand register. This mechanism fully utilizes the characteristics of data cyclic flow in serial computing architecture. At the beginning of each iteration cycle for the full bit width, the hardware logic first determines the state of the most significant bit of the data currently stored in the multiplicand register to predict whether the upcoming logical left shift operation will cause overflow. Subsequently, after filling the low-bit data block (whose bit width is equal to the width of the small-bit-width processing unit, such as 2 bits) back onto the physical transmission path of the register's high bits through a cyclic right shift operation, the hardware directly performs a bitwise XOR correction based on an irreducible polynomial (i.e., a modular reduction polynomial) on the data block and the padding data (usually logic '0') generated by the logical left shift. This design cleverly combines the three traditionally sequential steps of logical left shift, data cyclic backfilling, and conditional modular reduction into a single atomic data transmission and transformation operation completed within a single clock cycle.

[0082] For example, a simplified scenario using an 8-bit register and a 2-bit small-width processing unit is illustrated. Assume the initial data sequence in the register (from most significant bit to least significant bit) is bit 76543210, where bit 7 is the most significant bit and its value is '1', which triggers modulo reduction. In the first iteration (processing the two least significant bits 1 and 0), the hardware performs a fusion operation: first, a logical left shift is performed to change the sequence to 6543210X ('X' represents the padding logical '0', and bit 7 is considered an overflow). Then, while physically moving the two original least significant bits (1, 0) and the padding bit X to the beginning of the register, they are immediately XORed with the compensation value defined by the modulo polynomial, based on the condition that the most significant bit 7 is '1', to obtain the corrected bits 1', 0', and X', which are then written. At this point, the sequence in the register becomes 1'0'X'765432. In subsequent clock cycles, the register continues its cyclic right shift operation: after processing bits 3 and 2, the sequence becomes 321'0'X'7654; after processing bits 5 and 4, it becomes 54321'0'X'76; until the final round of processing bits 7 and 6, the sequence becomes 7654321'0'X'. After a complete cyclic shift, the most significant bit 7, which initially overflowed, has been shifted out and discarded. The final data sequence remaining in the register is 654321'0'X'. This is precisely the value that should be obtained after the initial sequence 76543210 undergoes a correct logical left shift (resulting in 6543210X) and modulo reduction of the result.

[0083] Therefore, the hardware design described above utilizes the opportunity of cyclic data backfilling in the first iteration to deeply integrate the three steps of logic shifting, data transport, and modulo reduction compensation. Superficially, the hardware simply moves the low-order data block to the high-order bits, but in reality, it is transporting new data that has already been calculated and corrected in real time. As the clock cycle advances and the data continues to circulate, this data segment, corrected at the beginning of the cycle, gradually "sinks" to the low-order bits of the register. When the iteration cycle ends, the register naturally contains a multiplicand value that has undergone complete logical left shifting and modulo reduction updates, which can be directly used for the next round of calculation. This achieves efficient iterative updates of the multiplicand without introducing additional processing delays or complex control logic.

[0084] The low-resource-consumption AES-GCM authentication and encryption method disclosed in the above embodiments of this application first obtains the input data of the AES-GCM algorithm, wherein the input data includes a symmetric key, an initialization vector, data to be processed, and additional authentication data; then, a key stream for encryption is generated through a first processing procedure, wherein the first processing procedure includes performing AES encryption operation based on the symmetric key and the initialization vector, wherein the AES encryption operation is completed through multiple cycles of iteration with a bit width of less than 128 bits; next, if the data to be processed is a first plaintext, the first plaintext is XORed with the key stream to generate a first ciphertext; finally, an authentication tag is generated through a second processing procedure, wherein the second processing procedure includes performing GHASH calculation based on the additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext, wherein the Galois field multiplication operation included in the GHASH calculation is completed through multiple cycles of iteration with a bit width of less than 128 bits, and the execution timing of the first processing procedure and the second processing procedure is scheduled to at least partially overlap. Therefore, by requiring both AES encryption and Galois field multiplication to be completed through multiple cycles with a bit width of less than 128 bits, and scheduling the execution timing of the first and second processing processes to at least partially overlap, the hardware logic resources required for encryption, decryption, and authentication operations are significantly reduced, while effectively compensating for the potential performance loss caused by small-bit-width serialization processing, thus achieving a good balance between hardware resource consumption and overall processing efficiency.

[0085] Furthermore, at the computational unit level, an innovative design incorporates the Galois field multiplication module GMult, based on small-bit-width iterative computation, and the AES encryption core Encrypt_Core. By employing time-division multiplexing technology, the byte substitution lookup table (S-box) within the AES encryption core is shared between the key expansion and data encryption paths. Combined with a lightweight implementation that decomposes complex operations such as column obfuscation into small-bit-width operations, the logical size of key computational modules is significantly reduced, achieving ultimate hardware area optimization. In addition, to compensate for the inherent performance loss caused by the aforementioned low-area design, a highly efficient pipeline scheduling strategy is specifically designed. Within the AES encryption core, this strategy, through meticulous timing arrangement, sorts and overlaps sub-operations in each round of computation, maximizing the utilization of shared resources such as the S-box and reducing internal idle time. More importantly, at the overall AES-GCM algorithm level, this strategy compactly plans the execution timing of the AES encryption core and the Galois field multiplication module, enabling their computation processes to form a deep pipeline. This design effectively eliminates the multi-level waiting window caused by the internal operation process of the module and the data dependency between modules, thereby significantly shortening the overall processing latency of authentication and encryption operations and improving the system throughput while maintaining ultra-low hardware resource consumption.

[0086] See Figure 7The diagram shows a schematic of a low-resource-consumption AES-GCM authentication and encryption device provided in an embodiment of this application. For ease of explanation, only the parts related to the embodiment of this application are shown.

[0087] A low-resource-consumption AES-GCM authentication and encryption device may specifically include the following modules: The data acquisition module 701 is used to acquire the input data of the AES-GCM algorithm, wherein the input data includes a symmetric key, an initialization vector, data to be processed, and additional authentication data.

[0088] The encryption processing module 702 is used to generate a key stream for encryption through a first processing procedure, wherein the first processing procedure includes performing AES encryption operation based on a symmetric key and an initialization vector, and the AES encryption operation is completed through multiple cycles of iteration with a bit width of less than 128 bits.

[0089] The XOR operation module 703 is used to perform an XOR operation between the first plaintext and the key stream to generate the first ciphertext when the data to be processed is the first plaintext.

[0090] The authentication processing module 704 is used to generate an authentication tag through a second processing procedure, wherein the second processing procedure includes performing a GHASH calculation based on the additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext. The GHASH calculation includes Galois field multiplication operations that are completed through multiple cycles of iteration with a bit width of less than 128 bits. The execution timing of the first processing procedure and the second processing procedure is scheduled to overlap at least partially.

[0091] The low-resource-consumption AES-GCM authentication and encryption device disclosed in the above embodiments of this application first acquires input data for the AES-GCM algorithm, wherein the input data includes a symmetric key, an initialization vector, data to be processed, and additional authentication data; then, a key stream for encryption is generated through a first processing procedure, wherein the first processing procedure includes performing AES encryption operations based on the symmetric key and the initialization vector, wherein the AES encryption operations are completed through multiple cycles of iteration with a bit width of less than 128 bits; next, if the data to be processed is a first plaintext, the first plaintext is XORed with the key stream to generate a first ciphertext; finally, an authentication tag is generated through a second processing procedure, wherein the second processing procedure includes performing GHASH calculation based on the additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext, wherein the Galois field multiplication operation included in the GHASH calculation is completed through multiple cycles of iteration with a bit width of less than 128 bits, and the execution timing of the first processing procedure and the second processing procedure is scheduled to at least partially overlap. Therefore, by requiring both AES encryption and Galois field multiplication to be completed through multiple cycles with a bit width of less than 128 bits, and scheduling the execution timing of the first and second processing processes to at least partially overlap, the hardware logic resources required for encryption, decryption, and authentication operations are significantly reduced, while effectively compensating for the potential performance loss caused by small-bit-width serialization processing, thus achieving a good balance between hardware resource consumption and overall processing efficiency.

[0092] Furthermore, in one possible implementation of this application embodiment, the authentication processing module 704 may specifically include the following units: The formatting unit is used to format the additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext into multiple 128-bit data blocks.

[0093] The Galois field multiplication iteration unit is used to iteratively process multiple 128-bit data blocks to obtain the Galois field multiplication result. Each iteration process includes a Galois field multiplication operation, which includes: accumulating and adding parts with a bit width less than 128 bits multiple times over several consecutive clock cycles to complete a 128-bit Galois field multiplication operation.

[0094] The tag generation unit is used to perform an XOR operation on the result of the Galois field multiplication and the authentication encrypted data block to generate an authentication tag. The authentication encrypted data block is obtained by AES encryption of the initial value of the counter determined by the initialization vector using a symmetric key.

[0095] Therefore, by decomposing the Galois field multiplication operation in GHASH computation into multiple partial accumulation operations with a bit width of less than 128 bits performed in multiple consecutive clock cycles, the field multiplier, which traditionally requires large-scale parallel logic implementation, is transformed into a structure that is iteratively completed by a small number of low-width operation units, greatly reducing the hardware area of ​​the authentication computing unit.

[0096] Furthermore, in another possible implementation of this application embodiment, the above-mentioned Galois field multiplication iteration unit may specifically include the following sub-units: Initialize the sub-unit, which is used to take the multiplier of the Galois field multiplication operation as the current operand and initialize the partial product.

[0097] The iterative execution subunit is used to perform low-bit-width iteration steps, which include: cyclically shifting the current operand and generating a control signal based on the value of the shifted-out bit; in response to the control signal, performing an XOR operation on the multiplicand of the Galois field multiplication operation and a selected portion of the partial product with a bit width less than 128 bits to update the partial product; and performing an update operation on the multiplicand based on the Galois field rules.

[0098] The result determines the sub-unit, which is used to repeatedly execute the low-width iteration steps until the current operand is processed, and determines the value of the partial product as the result of the current Galois field multiplication operation.

[0099] Therefore, by employing iterative steps including cyclic shifting, shift-out conditional control, and small-bit-width XOR accumulation to complete each Galois field multiplication, a deterministic and regular timing control flow is achieved. The complete field multiplication function is realized using extremely simple arithmetic logic units, further optimizing the regularity and area efficiency of the circuit structure.

[0100] Furthermore, in another possible implementation of the embodiments of this application, the above-mentioned iterative execution subunit can be specifically used to: perform a left shift operation on the multiplicand by one bit, and simultaneously determine the most significant bit before the shift, wherein the update operation and the XOR operation are performed within the same clock cycle; when the most significant bit is a preset value, the left-shifted multiplicand is XORed with a fixed compensation value to complete the modulo reduction.

[0101] Therefore, by arranging the update operation based on the Galois field rule and the XOR operation of the small bit width part to be executed synchronously in the same clock cycle, the "zero-latency" embedding of the modulo reduction process is realized in hardware. This eliminates the need to add extra pipeline stages or waiting cycles for modulo reduction, optimizes the computational critical path of each iteration, and significantly improves the clock frequency and overall computational efficiency of the Galois field multiplication module.

[0102] Furthermore, in another possible implementation of this application embodiment, the encryption processing module 702 may specifically include the following units: The key stream generation unit is used to perform AES encryption on a counter sequence determined by an initial vector using a symmetric key to generate a key stream.

[0103] The time-division multiplexing control unit is used to control the AES encryption operation to be completed through multiple cycles of iteration with a bit width of less than 128 bits. The control includes: in at least one round of the multi-cycle iteration, controlling the use of a preset byte replacement lookup table to perform byte replacement on key expansion related data in a first time period, and controlling the use of a byte replacement lookup table to perform byte replacement on encrypted state data in a second time period, wherein the first time period and the second time period do not overlap.

[0104] Therefore, by using the same preset byte substitution lookup table to serve the key expansion and data encryption paths in different and non-overlapping time periods during the multi-cycle iteration of AES encryption operations, time-division multiplexing of hardware resources is achieved, eliminating the resource overhead of equipping two paths with independent byte substitution lookup tables, and significantly reducing the memory resource consumption of the core encryption module.

[0105] Furthermore, in another possible implementation of this application embodiment, the encryption processing module 702 may further include the following units: The column obfuscation unit is used to perform column obfuscation on the current encrypted state data in at least one encryption round of the AES encryption operation.

[0106] The column obfuscation unit is specifically used to: divide the column to be processed in the encrypted state data into multiple data segments with a bit width of less than 128 bits; within multiple consecutive clock cycles, for each data segment, according to the preset AES column obfuscation transformation fixed matrix coefficients, calculate the partial column obfuscation result corresponding to the data segment through multiple finite field addition and multiplication operations with a bit width of less than 128 bits; and combine the partial column obfuscation results corresponding to all data segments to obtain the column obfuscation operation result.

[0107] Therefore, by decomposing the column-mixed matrix multiplication into serial processing of small data segments, this design avoids the complex parallel matrix multiplication circuits in traditional implementations, replacing them with a series of simple, regular small-bit-width arithmetic logic operations, thereby significantly reducing the hardware complexity and area of ​​the column mixing module.

[0108] Furthermore, in another possible implementation of this application embodiment, the encryption processing module 702 further includes: The implicit row shifting unit is used to read the row-shifted encrypted state data from the register storing the encrypted state data according to the offset order set by the preset AES row shifting rules before the column obfuscation operation unit divides the column to be processed in the encrypted state data into multiple data segments.

[0109] Therefore, the storage layout of the state matrix in the register and the address sequence for subsequent data reading have been pre-coded with row shift rules, so that row shift is naturally completed when data is read out, thus completely eliminating the need for explicit row shift circuits at the hardware level, further saving area and power consumption.

[0110] Furthermore, in another possible implementation of this application embodiment, the above-mentioned AES-GCM authentication encryption device may further include the following modules: The XOR operation module is also used to perform an XOR operation between the second ciphertext and the key stream to generate the second plaintext when the data to be processed is the second ciphertext. The decryption processing module is used to generate a first authentication tag through a second processing procedure, wherein the second processing procedure further includes performing GHASH calculation based on the additional authentication data, the second ciphertext, the length of the additional authentication data, and the length of the second ciphertext.

[0111] The comparison verification mode is used to compare and verify the first authentication tag with the received second authentication tag, and if the verification matches, determine that the second plaintext is valid.

[0112] Therefore, by explicitly specifying in the decryption process that the locally generated first authentication tag is compared and verified with the received second authentication tag, and only when the verification matches is the decrypted second plaintext deemed valid, the authentication and decryption semantics required by the AES-GCM standard are fully implemented. This ensures that only data that passes the integrity check will be output or used, fundamentally preventing tampered or forged ciphertext data from being mistakenly accepted, and improving the security and reliability of the entire encrypted communication system or storage system.

[0113] The low-resource-consumption AES-GCM authentication and encryption device disclosed in the above embodiments of this application innovatively designs a Galois field multiplication GMult module and an AES encryption core Encrypt_Core based on small-bit-width iterative computation at the computing unit level. By employing time-division multiplexing technology, the byte substitution lookup table (S-box) inside the AES encryption core is shared between key expansion and data encryption paths. Combined with a lightweight implementation that decomposes complex operations such as column obfuscation into small-bit-width operations, the logical size of key computing modules is significantly reduced, achieving extreme hardware area optimization. In addition, to compensate for the inherent performance loss caused by the above-mentioned low-area design, a highly efficient pipeline scheduling strategy is specifically designed. Within the AES encryption core, this strategy sorts and overlaps sub-operations in each round of computation through fine-grained timing arrangements, maximizing the utilization of shared resources such as the S-box and reducing internal idle time. More importantly, at the overall AES-GCM algorithm level, this strategy compactly plans the execution timing of the AES encryption core and the Galois field multiplication module, enabling the computation process of both to form a deep pipeline. This design effectively eliminates the multi-level waiting window caused by the internal operation process of the module and the data dependency between modules, thereby significantly shortening the overall processing latency of authentication and encryption operations and improving the system throughput while maintaining ultra-low hardware resource consumption.

[0114] The low-resource-consumption AES-GCM authentication and encryption device provided in this application embodiment can be applied in the foregoing method embodiments. For details, please refer to the description of the above method embodiments, which will not be repeated here.

[0115] Figure 8 This is a schematic diagram of the structure of the electronic device provided in an embodiment of this application. For example... Figure 8 As shown, the electronic device 800 of this embodiment includes: at least one processor 810 ( Figure 8 The diagram shows only one processor, a memory 820, and a computer program 821 stored in the memory 820 and executable on the at least one processor 810. When the processor 810 executes the computer program 821, it implements the steps in the above-described low-resource-consumption AES-GCM authentication encryption method embodiment.

[0116] The electronic device 800 can be a desktop computer, laptop, handheld computer, cloud server, or other computing device. This electronic device may include, but is not limited to, a processor 810 and a memory 820. Those skilled in the art will understand that... Figure 8 This is merely an example of electronic device 800 and does not constitute a limitation on electronic device 800. It may include more or fewer components than shown, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0117] The processor 810 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0118] In some embodiments, the memory 820 may be an internal storage unit of the electronic device 800, such as a hard disk or memory of the electronic device 800. In other embodiments, the memory 820 may be an external storage device of the electronic device 800, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the electronic device 800. Furthermore, the memory 820 may include both internal and external storage units of the electronic device 800. The memory 820 is used to store the operating system, applications, boot loader, data, and other programs, such as the program code of the computer program. The memory 820 can also be used to temporarily store data that has been output or will be output.

[0119] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0120] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0121] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0122] In the embodiments provided in this application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0123] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0124] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0125] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0126] The implementation of all or part of the processes in the methods of the above embodiments can also be accomplished by a computer program product. When the computer program product is run on an electronic device, the electronic device can implement the steps in the various method embodiments described above.

[0127] The embodiments described above are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A low-resource-consumption AES-GCM authentication and encryption method, characterized in that, include: Obtain the input data for the AES-GCM algorithm, wherein the input data includes a symmetric key, an initialization vector, data to be processed, and additional authentication data; A key stream for encryption is generated through a first processing step, wherein the first processing step includes performing AES encryption operation based on the symmetric key and the initial vector, the AES encryption operation being completed through multiple cycles with a bit width of less than 128 bits; If the data to be processed is the first plaintext, the first plaintext is XORed with the key stream to generate the first ciphertext; An authentication tag is generated through a second processing procedure, wherein the second processing procedure includes performing a GHASH calculation based on the additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext. The GHASH calculation includes Galois field multiplication operations performed through multiple cycles with a bit width of less than 128 bits. The execution timing of the first processing procedure and the second processing procedure is scheduled to at least partially overlap.

2. The method according to claim 1, characterized in that, The generation of the authentication label through the second processing step includes: The additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext are formatted into multiple 128-bit data blocks; The plurality of 128-bit data blocks are iteratively processed to obtain the Galois field multiplication result. Each iteration process includes a Galois field multiplication operation, which includes: accumulating and adding the 128-bit Galois field multiplication operation through multiple partial accumulation operations with a bit width less than 128 bits in multiple consecutive clock cycles. The authentication tag is generated by XORing the result of the Galois field multiplication with the authentication encrypted data block, wherein the authentication encrypted data block is obtained by AES encryption of the initial value of the counter determined by the initial vector using the symmetric key.

3. The method according to claim 2, characterized in that, The method of performing multiple partial accumulation operations with a bit width less than 128 bits to complete the 128-bit Galois field multiplication includes: Use the multiplier of the Galois field multiplication operation as the current operand, and initialize the partial product; The low-bit-width iteration step includes: cyclically shifting the current operand and generating a control signal based on the value of the shifted-out bit; in response to the control signal, performing an XOR operation on the multiplicand of the Galois field multiplication operation and a selected portion of the partial product with a bit width less than 128 bits to update the partial product; and performing an update operation based on Galois field rules on the multiplicand. Repeat the low-width iteration step until the current operand is processed, and determine the value of the partial product as the result of the current Galois field multiplication operation.

4. The method according to claim 3, characterized in that, The step of performing an update operation on the multiplicand based on Galois domain rules includes: The multiplicand is shifted left by one bit, and the most significant bit before the shift is determined simultaneously. The update operation and the XOR operation are performed within the same clock cycle. When the most significant bit is a preset value, the left-shifted multiplicand is XORed with a fixed compensation value to complete the modulo reduction.

5. The method according to claim 1, characterized in that, The generation of the key stream for encryption through the first processing step includes: Using the symmetric key, perform AES encryption on the counter sequence determined by the initial vector to generate the key stream; The AES encryption operation is completed through multiple iterations with a bit width of less than 128 bits, including: In at least one round of the multi-cycle iteration, a preset byte replacement lookup table is invoked in the first time period to perform byte replacement on the key expansion-related data, and the byte replacement lookup table is invoked in the second time period to perform byte replacement on the encrypted state data, wherein the first time period and the second time period do not overlap.

6. The method according to claim 1, characterized in that, The AES encryption operation performs a column obfuscation operation on the current encrypted state data in at least one encryption round. The column obfuscation operation includes the following steps: The column to be processed in the encrypted state data is divided into multiple data segments with a bit width of less than 128 bits; Within multiple consecutive clock cycles, for each data segment, based on the preset AES column confusion transformation fixed matrix coefficients, the partial column confusion result corresponding to the data segment is calculated through multiple finite field addition and multiplication operations with a bit width of less than 128 bits. The column obfuscation results corresponding to all the data segments are combined to obtain the column obfuscation operation result.

7. The method according to claim 6, characterized in that, The encrypted state data is encrypted state data that has undergone row shifting. Before dividing the column to be processed in the encrypted state data into multiple data segments with a bit width of less than 128 bits, the method further includes: According to the offset order set by the preset AES row shift rule, the row-shifted encrypted state data is read from the register storing the encrypted state data.

8. The method according to any one of claims 1-7, characterized in that, The method further includes: If the data to be processed is the second ciphertext, the second ciphertext is XORed with the key stream to generate the second plaintext; The second processing procedure generates a first authentication tag, wherein the second processing procedure further includes performing GHASH calculation based on the additional authentication data, the second ciphertext, the length of the additional authentication data, and the length of the second ciphertext; The first authentication tag is compared and verified with the received second authentication tag, and if the verification is consistent, the second plaintext is determined to be valid.

9. A low-resource-consumption AES-GCM authentication and encryption device, characterized in that, include: The data acquisition module is used to acquire the input data of the AES-GCM algorithm, wherein the input data includes a symmetric key, an initialization vector, data to be processed, and additional authentication data; An encryption processing module is used to generate a key stream for encryption through a first processing procedure, wherein the first processing procedure includes performing an AES encryption operation based on the symmetric key and the initial vector, and the AES encryption operation is completed through multiple cycles of iteration with a bit width of less than 128 bits. The XOR operation module is used to perform an XOR operation between the first plaintext and the key stream to generate the first ciphertext when the data to be processed is the first plaintext. An authentication processing module is used to generate an authentication tag through a second processing procedure, wherein the second processing procedure includes performing a GHASH calculation based on the additional authentication data, the first ciphertext, the length of the additional authentication data, and the length of the first ciphertext, wherein the GHASH calculation includes Galois field multiplication operations completed through multiple cycles with a bit width of less than 128 bits, and the execution timing of the first processing procedure and the second processing procedure is scheduled to at least partially overlap.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 8.

11. A computer program product, characterized in that, The computer program product includes a computer program that, when run on an electronic device, causes the electronic device to perform the method as described in any one of claims 1 to 8.

Images