AES (Advanced Encryption Standard) encryption method for side channel attack resistance of low-orbit satellite constellation

Abstract

The invention belongs to the field of satellite communication and password engineering, and particularly relates to an AES (Advanced Encryption Standard) encryption method for side channel attack resistance of a low-orbit satellite constellation, which comprises the following steps of: receiving plaintext data by a sending end, grouping the plaintext data to obtain a plurality of groups, sequentially carrying out AES encryption processing based on pipeline encryption design on each group to obtain encrypted data, and sending the encrypted data to the sending end; sending the encrypted data to a receiving end; the AES encryption processing based on the assembly line encryption design comprises N levels of reference assembly lines which are sequentially connected in series, and F levels of additional assembly lines are inserted behind the N levels of reference assembly lines; each stage of assembly line executes a conversion operation of a corresponding round of AES encryption; the F-level additional pipeline is controlled and activated by a first pseudo-random number generator PRNG1; according to the method, time domain and amplitude domain double-randomization AES encryption processing is adopted, so that key power consumption leakage is randomized on the time scale and the amplitude scale, and high-safety, high-performance and low-overhead comprehensive optimization is realized.

Description

Technical Field

[0001] This invention belongs to the fields of satellite communication and cryptography engineering, and specifically relates to an AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations. Background Technology

[0002] Satellite communication systems, characterized by wide-area coverage, high reliability, and strong resilience, play a crucial role in scenarios such as Earth observation, satellite internet, and deep space exploration. Within onboard routers, to ensure the confidentiality of service data and the security of link control information, data encryption and decryption are often performed at the following stages: On inter-satellite links, user data payloads transmitted across satellites are encrypted using AES to prevent eavesdropping by other satellites or ground stations; on satellite-to-ground links, control signaling and service packets between the satellite and ground gateway are encrypted and decrypted to prevent unauthorized ground stations from spoofing access; and within the onboard switching matrix, data passing through specific virtual networks or high-security virtual links is transparently encrypted.

[0003] In the aforementioned scenarios, AES (Advanced Encryption Standard) has become the most commonly used symmetric encryption algorithm in spaceborne routers due to its publicly available algorithm, high security, efficient hardware implementation, and support for multiple key lengths (128 / 192 / 256 bits). However, during hardware AES operation, its internal registers and combinational logic can generate measurable power consumption fluctuations during data flipping. Differential power analysis (DPA) collects a large number of power consumption trajectories to establish a statistical correlation between "predicted power consumption" and "measured power consumption," verifying the guessed intermediate values ​​and thus recovering the subkey.

[0004] Existing anti-DPA technologies mainly include:

[0005] Masking techniques: By using a random mask to split the intermediate value into multiple shares, first-order leakage can theoretically be eliminated. However, higher-order masks require multiple shares and a large number of random numbers, resulting in high logical overhead and complex implementation, making them particularly unsuitable for already very deep and high-frequency pipelined AES engines.

[0006] Hiding techniques, such as random clock jitter, inserting random NOPs, and randomizing the execution order, disrupt the timing of computations on the timeline or inject noise into the energy. These methods often disrupt the "fixed-delay" pipeline structure, increasing the difficulty of system-level protocol design and timing convergence.

[0007] Applying the above technologies directly to the reconfigurable AES engine of spaceborne routing will encounter the following problems:

[0008] Disruption of fixed latency characteristics: The scheduling and caching strategies of onboard routes are often based on a fixed pipeline delay design, and complex random timing disturbances will disrupt the end-to-end latency budget.

[0009] Large area and power consumption overhead: Spaceborne equipment is strictly limited by power consumption and heat dissipation capacity. Introducing a large number of additional logic or noisy circuits will significantly increase resource consumption and power consumption.

[0010] Poor coupling with multi-key-length reconfigurable architectures: Many DPA-resistant designs are only designed for fixed key lengths and rounds, making it difficult to maintain a consistent implementation when the engine needs to switch frequently between AES-128 / 192 / 256.

[0011] Therefore, it is necessary to propose a method for implementing AES on FPGA that is DPA resistant, specifically designed for spaceborne routing and satellite communication scenarios, while taking into account high throughput and reconfigurability, and low resource overhead. Summary of the Invention

[0012] To address the aforementioned problems in the prior art, this invention employs an AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations. The method includes: a transmitting end receiving plaintext data, dividing the plaintext data into multiple groups, sequentially performing AES encryption processing based on a pipelined encryption design on each group to obtain encrypted data, and sending the encrypted data to a receiving end; the AES encryption processing based on the pipelined encryption design includes N sequentially connected baseline pipelines, with an F-level supplementary pipeline inserted after the N-level baseline pipelines; each pipeline stage performs the transformation operation corresponding to the AES encryption round; the F-level supplementary pipeline is activated by a first pseudo-random number generator PRNG1.

[0013] Beneficial effects:

[0014] 1. This invention employs AES encryption with dual randomization in both the time and amplitude domains, under the premise of fixed end-to-end latency, thereby randomizing key power consumption leakage on both the time and amplitude scales, achieving comprehensive optimization of high security, high performance, and low overhead. 2. The time domain randomization of this invention, by inserting an additional pipeline F after an N-stage sequentially cascaded baseline pipeline, allows the effective pipeline depth to switch between N and N+F, improving the encryption effect. 3. The amplitude domain randomization of this invention sets a direct path and a linear redundancy path before the SubBytes operation of each pipeline stage. The direct path inputs the output of the previous pipeline into the SubBytes step, while the linear redundancy path performs linear redundancy operations on the output of the previous pipeline and inputs the result of the linear redundancy operation into the SubBytes step. The linear redundancy path does not introduce the high overhead of S-box copying or higher-order masks, making it suitable for spaceborne power consumption and area constraints. Attached Figure Description

[0015] Figure 1 A flowchart of AES encryption processing based on pipelined encryption design provided in an embodiment of the present invention;

[0016] Figure 2 This is a diagram of the external interface of the AES encryption engine provided in an embodiment of the present invention;

[0017] Figure 3 This is a structural block diagram of the AES encryption system provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] like Figure 1 As shown, this invention employs an AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations, comprising: a transmitting end receiving plaintext data, dividing the plaintext data into multiple groups, performing AES encryption processing based on a pipelined encryption design on each group to obtain encrypted data, and sending the encrypted data to a receiving end; the transmitting end and the receiving end are low-Earth orbit satellites or ground systems; the AES encryption processing based on a pipelined encryption design decomposes the multi-round transformation of AES encryption processing into multi-stage pipelines, including N-stage reference pipelines connected in series, with an F-stage additional pipeline inserted after the N-stage reference pipelines; each pipeline stage performs the transformation operation corresponding to the AES encryption round; the F-stage additional pipeline is activated by a first pseudo-random number generator PRNG1.

[0020] The first pseudo-random number generator, PRNG1, uses a 64-bit linear feedback shift register (LFSR), whose feedback polynomial... .

[0021] The first pseudo-random number generator PRNG1 outputs control bit b1. When control bit b1=1, the F-level additional pipeline is activated; when control bit b1=0, the F-level additional pipeline is not activated. The control bit b1 output by the first pseudo-random number generator PRNG1 can be refreshed in the manner of "updating once every Q packets processed". Here, Q is a preset refresh period configured by the security level. Decreasing Q can enhance time decorrelation but increase control flip overhead.

[0022] In one embodiment, to ensure that the fixed onboard latency is not disturbed by mode switching, the sampling and activation of the PRNG1 control bits preferably adopts a "packet boundary commit" mechanism: if PRNG1 is refreshed during the processing of the k-th packet, generating the next control bit b1_next, the control bit b1_next is latched as the current control bit b1_cur only after the k-th packet is encrypted and output, at the beginning of the next packet. This avoids data-related spikes and inconsistencies caused by path switching within the same packet.

[0023] Each time the first pseudo-random number generator PRNG1 is refreshed, the control bit b1 switches between N and N+F with a probability p of 1 and a probability (1-p) of 0, so that the effective depth of the pipeline is switched between N and N+F. Then, when the attacker uses fixed alignment sampling points, his sample set is a mixture of the two alignment states.

[0024] Assuming the attacker uses fixed sampling points for alignment, for common linear correlation attacks, the magnitude of the first-order correlation coefficient can be approximated by... Scaling, Preferred Selection To achieve the maximum decorrelation effect; p can also be used as a configurable parameter to bias to a more stable path when the timing margin is insufficient on a specific platform.

[0025] The depth N of the baseline pipeline is an integer constant independent of the group k. In implementation, N can be set using the following methods: 1. By determining the number of stages in the synthesized RTL / gate-level architecture counter register or by timing simulation; 2. After reset, fix the control bit b1 of the first pseudo-random number generator PRNG1 output to 0, input a frame of tagged test packets, and perform AES encryption on the test packets using a pipelined encryption design. A counter records the start time of the AES encryption process for the test packets. When AES encryption is completed The difference is used as depth N for subsequent compensation calculations.

[0026] Each pipeline stage includes the following processing steps: byte substitution (SubBytes), row shifting (ShiftRows), column mixing (MixColumns), and round key addition (AddRoundKey).

[0027] SubBytes: Each byte in the grouped state array is replaced non-linearly using AES S-Box. The S-Box is constructed based on GF(28) multiplicative inverse + affine transformation and is the core source of the algorithm's non-linearity.

[0028] Row shifting: Shift the state matrix of the group by 1, 2, and 3 bytes to the left respectively, and shuffle the byte order in the row.

[0029] MixColumns: Performs GF(2) on each column of the grouped state matrix. 8 Matrix multiplication allows changes in a single byte to affect the entire column, achieving deep diffusion.

[0030] AddRoundKey: XOR the state matrix of the group with the round key byte by byte to inject key information.

[0031] Before the SubBytes step of each pipeline stage, a through path and a linear redundancy path are set. The through path inputs the output of the previous pipeline stage into the SubBytes step, and the linear redundancy path performs linear redundancy calculation on the output of the previous pipeline stage and inputs the result of the linear redundancy calculation into the SubBytes step. The selection of the through path and the linear redundancy path is controlled by the second pseudo-random number generator PRNG2.

[0032] The second pseudo-random number generator PRNG2 outputs control bit b2. When control bit b2=1, a linear redundant path is selected; when control bit b2=0, a direct path is selected. Control bit b2 is the same as control bit b1 and can be refreshed once every Q groups are processed. Each refresh is performed with a probability p of 1 and a probability (1-p) of 0. Q is the preset refresh period.

[0033] The output of the pipeline is a grouped state matrix. The linear redundancy path performs linear redundancy operations on the output of the previous pipeline, including:

[0034] The 128-bit state matrix output from the previous pipeline is divided into 8 groups of 16-bit sub-blocks. ;

[0035] The process of filling the state matrix with groups is as follows: Let the 16 bytes of the group be... Fill in the 4×4 state matrix. The rules are:

[0036]

[0037] Where r and c are the row and column indices, respectively;

[0038] That is, fill the state matrix column by column: column 0 is The first column is And so on.

[0039] The state matrix is ​​divided into 8 sub-blocks as follows: Each column of the state matrix consists of two adjacent bytes forming a 16-bit sub-block.

[0040]

[0041] in, Indicates splicing.

[0042] Equivalently, this can be expressed using matrix elements (each column is divided into two 16-bit segments):

[0043] ,

[0044] ,

[0045] ,

[0046] ,

[0047] For each sub-block Perform linear redundancy (cyclic shift) to obtain each sub-block. Redundant results :

[0048]

[0049] in, For XOR operation, This means taking the modulo 8 of (i+1) to ensure that the calculation result always falls within the range of 0 to 7, thus achieving circular indexing.

[0050] For all sub-blocks Redundant results Perform a cyclic rearrangement to obtain the result of linear redundancy operations on the grouped state matrices of the output from the previous pipeline. .

[0051] For all sub-blocks Redundant results Performing cyclic rearrangement involves: cyclically shifting the physical mapping relationship of sub-blocks according to a preset offset, that is, mapping the 0th sub-block of the output data to the input data. (i.e., after redundant calculation) ), mapping the first sub-block to the input data (i.e., after redundant calculation) By repeating this process, the spatial location permutation of the entire set of data is completed, resulting in the linear redundancy operation. .

[0052] The linear redundant path performs redundant processing on the input grouping, undergoing a large number of XOR and rearrangement operations, producing additional flips and changing the power consumption near the S-BOX. The purpose of this is to introduce random noise in the amplitude domain (power consumption level), disrupting the correlation between predicted power consumption and measured power consumption, thereby resisting differential power analysis (DPA) attacks.

[0053] The AES encryption process, which employs a pipelined encryption design, includes three modes: low-power mode P0, on-orbit normal mode P1, and high-risk mode P2.

[0054] P0 mode: The first pseudo-random number generator PRNG1 and the second pseudo-random number generator PRNG2 are turned off to reduce additional toggling and control overhead and ensure the continuous operation of the whole machine.

[0055] P1 mode: The first pseudo-random number generator PRNG1 is enabled in every stage of the pipeline, while the second pseudo-random number generator PRNG2 is enabled only in the first and second stages of the pipeline, balancing power consumption and throughput.

[0056] P2 mode: The first pseudo-random number generator PRNG1 and the second pseudo-random number generator PRNG2 are enabled in each stage of the pipeline to prioritize maximizing the decorrelation effect between predicted power consumption and measured power consumption.

[0057] Preferably, in P1 mode, the refresh period Q is 100; in P2 mode, the refresh period Q is 50.

[0058] The number of additional production lines, F, is:

[0059]

[0060] in, The mode is P0, where F_mode=0; P1, where F_mode=1 or 2; and P2, where F_mode is 2 or greater than 2.

[0061] Low-power mode P0, on-orbit normal mode P1, and high-risk mode P2 are dynamically selected based on the safety state register, link load, power budget, and temperature / voltage monitoring results.

[0062] Under normal circumstances, the default selection is the on-orbit normal mode P1;

[0063] Conditions for forced entry into high-risk mode P2 (any one of these conditions must be met to enter P2): ground connection test or long-term playback; maintenance / debugging window open; key loading, key replacement or key rotation phase; detection of debug port unlocking or diagnostic task loading; ground command requiring entry into highest protection.

[0064] Conditions for forcibly entering low-power mode (entering P0 if any one of them is met): Power supply enters emergency power saving / low voltage alarm; chip or board temperature exceeds the upper limit threshold T_high; clock frequency reduction or insufficient timing margin alarm; or platform task requires to maintain survival with the lowest power consumption.

[0065] For each packet, after AES encryption based on pipelined encryption design, latency compensation is performed on the encryption result. The latency compensation process includes:

[0066] Get the depth selection of the current group Calculate differential compensation delay ;in, Set the preset fixed end-to-end delay; obtain the depth selection of the current packet. This includes: when control bit b1=1, it is N+F; when control bit b1=0, it is N.

[0067] Differential compensation delay Encapsulated as a delayed label for the current group And according to the delay label Perform delay compensation on the encrypted data of the current packet;

[0068] The compensation unit can be selected from two structures based on the implementation constraints:

[0069] like If the ciphertext of the current group is output directly, then... When F < S, the ciphertext of the current block is written to the F-level register chain, and the ciphertext is output at the end of the F-level register chain; the F-level register chain undergoes a time-lapse process, causing the ciphertext to be output after a delay of F time steps; if Furthermore, when F>S, it can lead to excessive register chain area overhead, or the system may face downstream backpressure (i.e., the downstream routing module pulls the ready_out signal low due to a full buffer). In such cases, the ciphertext of the current packet and its delay tag will be sent to the appropriate location. Write to the FIFO, and set the delay tag at the head of the FIFO queue. Load the data into a delay counter for countdown; when the delay counter reaches zero (i.e., delay compensation is completed) and the downstream receiver is ready (ready_out=1), pop the ciphertext at the head of the FIFO queue, thereby achieving a highly flexible output that balances flow control and timing alignment; where S is a preset threshold, preferably S=8.

[0070] This invention employs an AES encryption system for resisting side-channel attacks in low-Earth orbit satellite constellations, comprising: a CPU and an AES encryption engine;

[0071] The CPU is used to detect the environment and configure the AES encryption engine;

[0072] Configuring the AES encryption engine includes configuring the AES engine mode and parameters F and Q.

[0073] Environmental monitoring includes:

[0074] The default selection is the on-orbit normal mode P1;

[0075] Conditions for forced entry into high-risk mode P2 (any one of these conditions must be met to enter P2): ground connection test or long-term playback; maintenance / debugging window open; key loading, key replacement or key rotation phase; detection of debug port unlocking or diagnostic task loading; ground command requiring entry into highest protection.

[0076] Conditions for forcibly entering low-power mode (entering P0 if any one of them is met): Power supply enters emergency power saving / low voltage alarm; chip or board temperature exceeds the upper limit threshold T_high; clock frequency reduction or insufficient timing margin alarm; or platform task requires to maintain survival with the lowest power consumption.

[0077] like Figure 1 As shown, to facilitate integration into onboard routing / switching equipment, this embodiment provides an example of the onboard interface for the AES encryption engine. This interface can employ either a streaming valid / ready handshake or a fixed-beat frame synchronization interface.

[0078] The external data interfaces include: input data interface data_in, input valid interface valid_in, input ready interface ready_in, output data interface data_out, output valid interface valid_out, output ready interface ready_out, and delay interface L_fix (fixed end-to-end delay for input).

[0079] The key and mode interfaces include: key input interface key_in, key loading valid signal interface key_en, security state register interface sec_state, and mode selection register interface mode_cfg; the sec_state interface configures the mode of the AES engine, and the mode_cfg interface configures the parameters F and Q of the AES engine.

[0080] The AES encryption engine includes: a first control circuit, a second control circuit, a key expansion module, a first pseudo-random number generator PRNG1, a second pseudo-random number generator PRNG2, an AES encryption processing module, and a delay compensation unit.

[0081] The first control circuit and the second control circuit are connected to the key expansion module and are used to control the key expansion module to select the appropriate key expansion type.

[0082] like Figure 2As shown, the key expansion module includes AES-128, AES-192 and AES-256, which are used to generate 128-bit keys, 192-bit keys and 256-bit round keys in each round of transformation operation, respectively.

[0083] The first pseudo-random number generator PRNG1 is connected to the AES encryption processing module and is used to control and activate the F-level additional pipeline in the AES encryption processing module.

[0084] The first pseudo-random number generator PRNG1 is connected to the delay compensation unit and is used to control the activation of the delay compensation unit.

[0085] The second pseudo-random number generator PRNG2 is connected to the AES encryption processing module and is used to control the AES encryption processing module to select the direct path and the linear redundant path.

[0086] The AES encryption processing module is used to perform the AES encryption processing based on the pipelined encryption design described above according to the selected key expansion type, so as to obtain encrypted data.

[0087] The delay compensation unit is used to output encrypted data after delay compensation. The delay compensation unit maintains a constant end-to-end delay, ensuring that the encryption / decryption unit does not disrupt the buffering, queuing, and scheduling strategies of the onboard switching matrix. The delay compensation unit selects between a register chain delay compensation method and a FIFO delay compensation method based on parameter F.

[0088] The key expansion path (key expansion module, first control circuit, second control circuit) is structurally decoupled from the AES encryption processing module: key expansion can be completed in advance during business idle or warm-up phases and is available via key_ready; when a key_load event is detected (e.g., key change or key rotation), the control logic suspends new packet entry at the packet boundary, completes key loading and expansion, and then resumes processing to ensure randomization control and key consistency.

[0089] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations, characterized in that, include: The sending end receives plaintext data, divides the plaintext data into multiple groups, performs AES encryption based on pipeline encryption design on each group in sequence to obtain encrypted data, and sends the encrypted data to the receiving end. The AES encryption process based on pipelined encryption design includes N levels of base pipelines connected in series, and an F-level additional pipeline is inserted after the N-level base pipelines. Each pipeline stage performs the transformation operation corresponding to the AES encryption round; the F-stage additional pipeline is activated by the first pseudo-random number generator PRNG1.

2. The AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations according to claim 1, characterized in that, The first pseudo-random number generator PRNG1 outputs control bit b1. When control bit b1=1, the F-stage additional pipeline is activated; when control bit b1=0, the F-stage additional pipeline is not activated. Control bit b1 can be refreshed once every Q packets processed; where Q is the preset refresh period.

3. The AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations according to claim 2, characterized in that, Each time control bit b1 is refreshed, it is set to 1 with probability p and 0 with probability (1-p); where probability p is... .

4. The AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations according to claim 1, characterized in that, Before the SubBytes step of each pipeline stage, a through path and a linear redundancy path are set. The through path inputs the output of the previous pipeline stage into the SubBytes step, and the linear redundancy path performs linear redundancy calculation on the output of the previous pipeline stage and inputs the result of the linear redundancy calculation into the SubBytes step. The selection of the through path and the linear redundancy path is controlled by the second pseudo-random number generator PRNG2. Among them, SubBytes is byte substitution.

5. The AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations according to claim 4, characterized in that, The second pseudo-random number generator PRNG2 outputs control bit b2. When control bit b2=1, a linear redundant path is selected; when control bit b2=0, a direct path is selected. Control bit b2 can be refreshed once every Q groups processed, where Q is the preset refresh period.

6. The AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations according to claim 4, characterized in that, The linear redundancy path performs linear redundancy operations on the output of the previous pipeline, which includes dividing the output of the previous pipeline into 8 sub-blocks. For each sub-block Perform linear redundancy to obtain each sub-block Redundant results For 8 sub-blocks Redundant results Perform cyclic rearrangement to obtain the result after linear redundancy calculation; where, Indicates to Take the modulus 8.

7. The AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations according to claim 4, characterized in that, AES encryption processing based on pipelined encryption design includes three modes: low power mode P0, on-orbit normal mode P1, and high risk mode P2. Low-power mode P0: Turns off the first pseudo-random number generator PRNG1 and the second pseudo-random number generator PRNG2; In-orbit normal mode P1: The first pseudo-random number generator PRNG1 is enabled, and the second pseudo-random number generator PRNG2 is only enabled in pipelines of stages 1 and 2. High-risk mode P2: Enable the first pseudo-random number generator PRNG1, and enable the second pseudo-random number generator PRNG2 in each stage of the pipeline.

8. The AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations according to claim 7, characterized in that, In the normal on-orbit mode P1, the refresh period Q of the first pseudo-random number generator PRNG1 and the second pseudo-random number generator PRNG2 is 100; in the high-risk mode P2, the refresh period Q of the first pseudo-random number generator PRNG1 and the second pseudo-random number generator PRNG2 is 50.

9. The AES encryption method for resisting side-channel attacks in low-Earth orbit satellite constellations according to claim 1, characterized in that, For each group, after performing AES encryption based on pipeline encryption design, latency compensation is applied to the encryption result. The latency compensation process includes: obtaining the depth selection of the current packet. Calculate differential compensation delay ;in, The preset fixed end-to-end delay will be used to compensate for the differential delay. Encapsulated as a delayed label for the current group According to the delay label Delay compensation is applied to the encryption result of the current group.

10. An AES encryption system for resisting side-channel attacks in low-Earth orbit satellite constellations, characterized in that, include: CPU and AES encryption engine; CPU, used to configure the AES encryption engine; The AES encryption engine includes: a first control circuit, a second control circuit, a key expansion module, a first pseudo-random number generator PRNG1, a second pseudo-random number generator PRNG2, an AES encryption processing module, and a delay compensation unit. The first control circuit and the second control circuit are connected to the key expansion module and are used to control the key expansion module to select the appropriate key expansion type. The first pseudo-random number generator PRNG1 is connected to the AES encryption processing module and is used to control and activate the F-level additional pipeline in the AES encryption processing module. The first pseudo-random number generator PRNG1 is connected to the delay compensation unit and is used to control the activation of the delay compensation unit. The second pseudo-random number generator PRNG2 is connected to the AES encryption processing module and is used to control the AES encryption processing module to select the direct path and the linear redundant path. The AES encryption processing module is used to perform the AES encryption processing based on the pipeline encryption design as described in any one of claims 1 to 9 to obtain encrypted data. The delay compensation unit is used to perform delay compensation.

Images