A hardware circuit supporting SM3 encryption function

Abstract

The application discloses a kind of hardware circuits supporting SM3 encryption function, it is related to information security cryptography field, including register configuration component, initialization and update component and SM3 hash calculation component being interconnected two by two and integrated in chip top layer;Register configuration component includes message register, iv value setting register, state register, hash result register, SM3 control register;Register configuration component is connected with CPU by CPU_IF interface, and CPU realizes the read-write operation to each register by CPU_IF interface;Initialization and update component are used to receive the encrypted message data of message register and the iv value of iv value setting register, and the received iv value is packaged and forwarded to SM3 hash calculation component as initial iv value and encrypted message data;SM3 hash calculation component is used to calculate hash value according to message data and iv value, and after size end conversion, hash result is returned to hash result register.The application enhances the overall security and computing speed of chip system.

Description

Technical Field

[0001] This invention relates to the field of information security cryptography technology, specifically to a hardware circuit that supports SM3 encryption. Background Technology

[0002] SM3 is a standard commercial cryptographic algorithm released in 2010 and is one of the core members of the domestic cryptographic (national cryptographic) algorithm family. Its core function is to take an input message of arbitrary length and generate a fixed-length (256 bits, or 32 bytes) seemingly random output, called a "message digest" or "hash value", through a series of complex compression and transformations.

[0003] SM3, as a fundamental cryptographic primitive, is widely used in situations requiring data integrity verification and message authentication. However, most current SM3 algorithms are implemented in software, resulting in low implementation efficiency. There is a lack of a hardware-software co-operation SM3 scheme implemented through hardware circuits to improve computation speed and security. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a hardware circuit that supports SM3 encryption to improve computing speed and security.

[0005] The objective of this invention is achieved through the following technical solution: A hardware circuit supporting SM3 encryption includes a register configuration component, an initialization and update component, and an SM3 hash calculation component integrated on the top layer of the chip and interconnected in pairs; The register configuration component includes a message register, an IV value setting register, a status register, a hash result register, and an SM3 control register. The register configuration component is connected to the CPU via the CPU_IF interface, and the CPU performs read and write operations on the corresponding registers of the register configuration component through the CPU_IF interface. The message register is used to temporarily store message data written from the CPU, the status register is used to store the busy status value of the SM3 hash calculation component, the IV value setting register is used to temporarily store the set IV value written by the CPU, and the SM3 control register is used to temporarily store the written SM3 request information. The initialization and update component is used to receive the message data to be encrypted from the message register and the IV value of the IV value setting register, and to package the received IV value as the initial IV value and the message data to be encrypted and forward it to the SM3 hash calculation component. The SM3 hash calculation component is used to calculate the hash value based on the received message data and the IV value, and after endianness conversion, the hash result is sent back to the hash result register.

[0006] Furthermore, it also includes a TRNG_IF interface for connecting the initialization and update component with an external random number module. The initialization and update component obtains a random number from the external random number module through the TRNG_IF interface and uses the obtained random number as the initial IV value.

[0007] Furthermore, it also includes a DMA control component integrated at the top level of the chip. The DMA control component is connected to external on-chip cache or DRAM storage through the DMA_IF interface. Inside the chip, the DMA control component is connected to the register configuration component, the initialization and update component, and the SM3 hash calculation component. The register configuration component also includes a DMA read / write pointer register. The DMA control component is used to read DMA command message data from external on-chip cache or DRAM storage via the DMA_IF interface, parse and concatenate the read message data and write it to the DMA read / write pointer register, and generate SM3 request information and write it to the SM3 control register; the SM3 hash calculation component receives the initial IV value and message data, performs hash calculation and sends the hash result to the DMA control component; the DMA control component is also used to receive the hash result sent by the SM3 hash calculation component and write the hash result to external on-chip cache or DRAM storage via the DMA_IF interface.

[0008] Furthermore, after receiving the hash result sent by the SM3 hash calculation component, the DMA control component selects, according to the current mode, to write the hash result to the on-chip cache or DRAM storage via the DMA_IF interface, or to update the hash result register of the register configuration component.

[0009] Furthermore, it also includes a key verification component integrated at the top layer of the chip. The key verification component is connected to an external non-volatile memory hardware module through the OTP_IF interface. Inside the chip, the key verification component is connected to the register configuration component and the SM3 hash calculation component. The key verification component is used to read each key in the non-volatile storage hardware module through the OTP_IF interface and send the read key to the SM3 hash calculation component. After receiving the hash value output by the SM3 hash calculation component, it initiates a programming request to write the hash value of the key to the specified area of ​​the non-volatile storage hardware module.

[0010] Furthermore, the register configuration component also includes a key verification register; When the hash value verification of the key in the non-volatile storage hardware module is triggered through the register, the key verification component is also used to read the key and the first verification value from the non-volatile storage hardware module respectively, compare the second verification value calculated by the SM3 hash calculation component based on the key with the first verification value read from the non-volatile storage hardware module, obtain the verification result, update the verification result to the key verification register, and automatically clear the verification process information after the update is completed.

[0011] Furthermore, the non-volatile storage hardware module includes OTP, eFuse, eFlash, PUF, or phase memory.

[0012] The beneficial effects of this invention are: The SM3 hardware circuit provided by this invention implements the SM3 hash function through two different operation methods: CPU configuration register and DMA command, in order to apply different scenarios. Through interaction with the random number module and the non-volatile memory hardware module, the circuit has more optional functions for secure operation and key management, thereby enhancing the overall security of the chip system. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of a hardware circuit that supports SM3 encryption. Detailed Implementation

[0014] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] See Figure 1 The present invention provides a technical solution: Example

[0016] A hardware circuit that supports SM3 encryption, such as Figure 1 As shown, it includes the register configuration component cfg_reg, the initialization and update component msg_iv_ctl, and the SM3 hash calculation component alg_ctl, which are integrated on the top layer of the chip and interconnected in pairs. The register configuration component includes a message register, an IV value setting register, a status register, a hash result register, and an SM3 control register. The register configuration component is connected to the CPU via the CPU_IF interface, and the CPU performs read and write operations on the corresponding registers of the register configuration component through the CPU_IF interface. The message register is used to temporarily store message data written from the CPU, the status register is used to store the busy status value of the SM3 hash calculation component, the IV value setting register is used to temporarily store the set IV value written by the CPU, and the SM3 control register is used to temporarily store the written SM3 request information. The initialization and update component is used to receive the message data to be encrypted from the message register and the IV value of the IV value setting register, and to package the received IV value as the initial IV value and the message data to be encrypted and forward it to the SM3 hash calculation component. The SM3 hash calculation component is used to calculate the hash value based on the received message data and the IV value, and after endianness conversion, the hash result is sent back to the hash result register.

[0017] In this embodiment, the operation process of SM3 hashing through the CPU configuration register is as follows: the CPU configures the IV value setting register, message register, and SM3 control register; the CPU configures the SM3 hash start register, and determines whether the status register value is 0. If it is, the SM3 hash calculation is completed. After the SM3 hash calculation is completed, the hash value is written to the hash result register. The CPU obtains the hash value by reading the hash result register.

[0018] Example

[0019] The hardware circuit supporting SM3 encryption is based on Embodiment 1, such as... Figure 1 As shown, it also includes a TRNG_IF interface for connecting the initialization and update component with an external random number module. The initialization and update component obtains a random number from the external random number module through the TRNG_IF interface and uses the obtained random number as the initial IV value.

[0020] Example

[0021] The hardware circuit supporting SM3 encryption is based on Embodiment 1 or Embodiment 2, such as... Figure 1 As shown, it also includes a DMA control component dma_ctl integrated at the top layer of the chip. The DMA control component is connected to external on-chip cache or DRAM storage through the DMA_IF interface. Inside the chip, the DMA control component is connected to the register configuration component, the initialization and update component, and the SM3 hash calculation component. The register configuration component also includes a DMA read / write pointer register. The DMA control component is used to read DMA command message data from external on-chip cache or DRAM storage via the DMA_IF interface, parse and concatenate the read message data and write it to the DMA read / write pointer register, and generate SM3 request information and write it to the SM3 control register; the SM3 hash calculation component receives the initial IV value and message data, performs hash calculation and sends the hash result to the DMA control component; the DMA control component is also used to receive the hash result sent by the SM3 hash calculation component and write the hash result to external on-chip cache or DRAM storage via the DMA_IF interface.

[0022] After receiving the hash result sent by the SM3 hash calculation component, the DMA control component selects, according to the current mode, whether to write the hash result to the on-chip cache or DRAM storage via the DMA_IF interface, or to update the hash result register of the register configuration component.

[0023] The SM3 hardware circuit in this embodiment supports message input via CPU configuration registers and message transfer via DMA commands. When the message length is small or performance requirements are not high, message transfer can be performed via CPU configuration registers. When the message length is large or performance requirements are high, message transfer is performed via DMA.

[0024] Example

[0025] The hardware circuit supporting SM3 encryption is based on Embodiment 1, Embodiment 2, or Embodiment 3, such as... Figure 1 As shown, it also includes a key verification component key_chk integrated at the top layer of the chip. The key verification component is connected to an external non-volatile memory hardware module through the OTP_IF interface. Inside the chip, the key verification component is connected to the register configuration component and the SM3 hash calculation component. The key verification component is used to read each key in the non-volatile storage hardware module through the OTP_IF interface and send the read key to the SM3 hash calculation component. After receiving the hash value output by the SM3 hash calculation component, it initiates a programming request to write the hash value of the key to the specified area of ​​the non-volatile storage hardware module.

[0026] Furthermore, the register configuration component also includes a key verification register; When the hash value verification of the key in the non-volatile storage hardware module is triggered through the register, the key verification component is also used to read the key and the first verification value from the non-volatile storage hardware module respectively, compare the second verification value calculated by the SM3 hash calculation component based on the key with the first verification value read from the non-volatile storage hardware module, obtain the verification result, update the verification result to the key verification register, and automatically clear the verification process information after the update is completed.

[0027] Optionally, the non-volatile storage hardware module includes OTP, eFuse, eFlash, PUF, or phase memory.

[0028] In this embodiment, the SM3 hardware circuit interacts with the non-volatile storage hardware module to generate and burn the key verification value and verify the key integrity.

[0029] To accommodate different application scenarios, the SM3 hardware circuit of this invention implements the SM3 hash function through two different operation methods: CPU configuration register and DMA command. Through interaction with the random number module and the non-volatile memory hardware module, the circuit has more optional functions for secure operation and key management, thereby enhancing the overall security of the chip system.

[0030] The above description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the concept described herein through the above teachings or related technologies or knowledge. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A hardware circuit supporting SM3 encryption, characterized in that: This includes register configuration components, initialization and update components, and SM3 hash calculation components integrated at the top layer of the chip and interconnected in pairs; The register configuration component includes a message register, an IV value setting register, a status register, a hash result register, and an SM3 control register. The register configuration component is connected to the CPU via the CPU_IF interface, and the CPU performs read and write operations on the corresponding registers of the register configuration component through the CPU_IF interface. The message register is used to temporarily store message data written from the CPU, the status register is used to store the busy status value of the SM3 hash calculation component, the IV value setting register is used to temporarily store the set IV value written by the CPU, and the SM3 control register is used to temporarily store the written SM3 request information. The initialization and update component is used to receive the message data to be encrypted from the message register and the IV value of the IV value setting register, and to package the received IV value as the initial IV value and the message data to be encrypted and forward it to the SM3 hash calculation component. The SM3 hash calculation component is used to calculate the hash value based on the received message data and the IV value, and after endianness conversion, the hash result is sent back to the hash result register. It also includes a DMA control component integrated at the top layer of the chip. The DMA control component is connected to external on-chip cache or DRAM storage through the DMA_IF interface. Inside the chip, the DMA control component is connected to the register configuration component, the initialization and update component, and the SM3 hash calculation component. The register configuration component also includes a DMA read / write pointer register. The DMA control component reads DMA command message data from external on-chip cache or DRAM storage via the DMA_IF interface, parses and concatenates the read message data, writes it to the DMA read / write pointer register, and generates SM3 request information which is written to the SM3 control register. The SM3 hash calculation component receives the initial IV value and message data, performs hash calculation, and sends the hash result to the DMA control component. The DMA control component also receives the hash result sent by the SM3 hash calculation component and writes the hash result to external on-chip cache or DRAM storage via the DMA_IF interface. It also includes a key verification component integrated at the top layer of the chip. The key verification component is connected to an external non-volatile memory hardware module through the OTP_IF interface. Inside the chip, the key verification component is connected to the register configuration component and the SM3 hash calculation component. The key verification component is used to read each key in the non-volatile storage hardware module through the OTP_IF interface and send the read key to the SM3 hash calculation component. After receiving the hash value output by the SM3 hash calculation component, it initiates a programming request to write the hash value of the key to the specified area of ​​the non-volatile storage hardware module.

2. The hardware circuit supporting SM3 encryption function according to claim 1, characterized in that: It also includes a TRNG_IF interface for connecting the initialization and update component with an external random number module. The initialization and update component obtains a random number from the external random number module through the TRNG_IF interface and uses the obtained random number as the initial IV value.

3. The hardware circuit supporting SM3 encryption function according to claim 1, characterized in that: After receiving the hash result sent by the SM3 hash calculation component, the DMA control component selects, according to the current mode, whether to write the hash result to the on-chip cache or DRAM storage via the DMA_IF interface, or to update the hash result register of the register configuration component.

4. The hardware circuit supporting SM3 encryption function according to claim 1, characterized in that: The register configuration component also includes a key verification register; When the hash value verification of the key in the non-volatile storage hardware module is triggered through the register, the key verification component is also used to read the key and the first verification value from the non-volatile storage hardware module respectively, compare the second verification value calculated by the SM3 hash calculation component based on the key with the first verification value read from the non-volatile storage hardware module, obtain the verification result, update the verification result to the key verification register, and automatically clear the verification process information after the update is completed.

5. The hardware circuit supporting SM3 encryption function according to claim 1, characterized in that: The non-volatile storage hardware module includes OTP, eFuse, eFlash, PUF, or phase memory.

Images