A method for implementing SM4 algorithm mask on a DSP chip to resist power analysis

Abstract

The application relates to a SM4 algorithm mask implementation method for resisting power consumption analysis on a DSP chip, which comprises the following steps: obtaining plaintext data to be encrypted and an initial round key; generating a first random mask equal to the length of the plaintext data, and performing a first mask operation on the plaintext data by using the first random mask to obtain first mask state data; for the multi-round iteration encryption structure of the SM4 algorithm, in each round of encryption operation, a second random mask is generated based on the current round key; the first mask state data and the second random mask are input into an arithmetic logic unit of the DSP chip to execute a round function F which is subjected to mask conversion, wherein the round function F comprises a nonlinear transformation T and a linear transformation L; in the nonlinear transformation T, a pre-constructed and stored S-box lookup table which is subjected to mask processing is called, and the input data and the output data of the S-box lookup table which is subjected to mask processing are both covered by masks; the DSP implementation SM4 mask of the application is resistant to power consumption, is safe and efficient, and has better hardware adaptability.

Description

Technical Field

[0001] This invention relates to the field of implementation methods, and more specifically to a method for implementing the SM4 algorithm mask for power consumption analysis on a DSP chip. Background Technology

[0002] As a block cipher algorithm in commercial cryptography standards, the SM4 algorithm is widely used in various information security encryption scenarios. DSP chips, with their efficient arithmetic operation capabilities and parallel processing characteristics, have become an important carrier for hardware-side encryption operations using the SM4 algorithm. However, during the SM4 algorithm encryption process, the power consumption fluctuations of DSP chips during operation can easily generate a collectable power consumption curve. Attackers can use power consumption analysis attacks to extract data features from the curve and crack core information such as round keys, posing a serious threat to the encryption security of the SM4 algorithm. Therefore, designing an efficient and adaptable power consumption analysis mask implementation scheme for the SM4 algorithm on DSP chips has become an urgent need in the industry. Existing anti-power masking implementations for the SM4 algorithm still have many shortcomings. Current mask generation methods often employ pseudo-random numbers or fixed mask patterns, resulting in insufficient randomness and susceptibility to mask reuse. Some schemes lack a design linking the mask to the SM4 algorithm's round keys, failing to provide dynamic protection and thus offering poor resistance to power analysis attacks. Furthermore, existing schemes do not fully integrate the masking operation process with the hardware architecture characteristics of DSP chips, relying primarily on software-level masking. This fails to leverage the native basic operations and parallel processing capabilities of the DSP chip's arithmetic logic unit, leading to high overhead, low execution efficiency, and insufficient hardware resource utilization. Finally, for the S-box, the core of the SM4 algorithm's nonlinear transformation, current masking methods often employ serial lookup designs and do not perform full masking of the S-box's inputs and outputs. The existing hardware implementation schemes suffer from several drawbacks. First, they are prone to power leakage points. Second, some schemes lack precise mask compensation mechanisms, which can easily lead to incorrect encryption results due to mask bias. Third, the mask transformation design of the round function is imperfect and does not dynamically adjust the mask for the multi-round iteration characteristics of the SM4 algorithm. The mask protection for intermediate state data during the iteration process is inconsistent and can easily expose data characteristics. Fourth, the existing hardware implementation schemes do not have a dedicated functional unit system adapted to DSP chips. The mask generation, mask operation, S-box lookup, and linear transformation are not well connected, resulting in high data interaction overhead. It is difficult to simultaneously ensure encryption security, operation efficiency, and hardware adaptability, and cannot meet the requirements of SM4 algorithm engineering applications on DSP chips. Therefore, a power-resistant SM4 algorithm mask implementation method on DSP chips is proposed. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a method for implementing an SM4 algorithm mask for power consumption analysis on a DSP chip, comprising the following steps: Obtain the plaintext data to be encrypted and the initial round key; Generate a first random mask with the same length as the plaintext data, and use the first random mask to perform a first mask operation on the plaintext data to obtain the first mask state data; For the multi-round iterative encryption structure of the SM4 algorithm, a second random mask is generated based on the current round key in each round of encryption operation; The first mask state data and the second random mask are input into the arithmetic logic unit of the DSP chip, and the round function F after mask transformation is executed. The round function F includes nonlinear transformation T and linear transformation L. In the nonlinear transformation T, the pre-constructed and stored masked S-box lookup table is called. The input and output data of the masked S-box lookup table are both covered by the mask. Obtain the second random mask and the preset mask compensation factor for the current round, perform demasking compensation operation on the output result of the masked S-box lookup table, and generate the S-box output mask state for the current round. Perform a linear transformation L on the output mask state of the S-box to obtain the output mask state of the round function; The output mask state of the round function is XORed with the round key of the next round, and the result of the XOR operation is further masked using a third random mask to generate the input mask state data for the next round of encryption operation. After all rounds of iteration are completed, the final ciphertext mask state data is globally demasked to output the final ciphertext.

[0004] Furthermore, generating a first random mask with a length equal to that of the plaintext data specifically includes: Call the true random number generator built into the DSP chip to obtain the basic random seed; The basic random seed is input into a linear feedback shift register for iterative expansion to generate a first random mask M1 with the same length as the plaintext data. The first mask is obtained using the following formula: ; Where P represents plaintext data, M1 represents the first random mask, and Mstate0 represents the first mask state data. This indicates a bitwise XOR operation.

[0005] Furthermore, a second random mask is generated based on the current round key, specifically including: Split the 128-bit round key Kr of the current round into four 32-bit words. ; Nonlinear compression is performed on four 32-bit words to obtain the nonlinear compression result. : ; in, This represents a 32-bit modulo addition operation. The nonlinear compression result Nr is XORed with the preset round constant Cr to obtain the dynamic masking factor Dr: ; The dynamic masking factor Dr is concatenated with the high 96 bits of the first random mask M1 to generate a 128-bit second random mask for the current round. : ; in, This indicates a bit concatenation operation, where M1[127:32] represents bits 32 to 127 of the first random mask M1.

[0006] Furthermore, the execution of the masked round function F specifically includes: Obtain the current round input mask state data X=(A,B,C,D), where A, B, C, and D are all 32-bit words and each carries a corresponding part of the first random mask M1. ; Use the second random mask Split into four 8-bit bytes ; The first mask is updated for B, C, and D in the round input to generate the updated status word. : ; ; ; The updated XOR the current round key Kr with the intermediate data Y to obtain the intermediate data Y: ; Obtain the preset fixed input mask γ, and the mask transformation constant KΔ pre-calculated based on the first random mask M1, where ; Calculate the current round mask adjustment factor Δr: ; The intermediate data Y is masked to obtain the input data carrying a fixed input mask γ. : ; Will As input to the nonlinear transformation T.

[0007] Furthermore, a masked S-box lookup table is pre-constructed and stored, specifically including: Choose a fixed 8-bit input mask γ and four fixed 8-bit output masks. ; For each byte position i∈{0,1,2,3}, construct the corresponding masked S-box lookup table. For each input value x∈[0,255] of the original S-box of the SM4 algorithm, the following condition is met: ; Where S(x) is the original S-box output; The 256 mask output values ​​of each lookup table are sorted by index. The sequence is stored in the memory of the DSP chip, forming four independent masked S-box lookup tables.

[0008] Furthermore, the output of the masked S-box lookup table is subjected to demasking compensation operations, specifically including: Obtain the input data of the nonlinear transformation T ,Will Split into four 8-bit bytes ; respectively Using an index, perform parallel lookups of four masked S-boxes. This yields four 8-bit mask output values. : ; Get the four pre-stored output masks ; Demasking compensation is performed on each masked output value to obtain the true output of the S-box carrying a second random mask: ; in, For the second random mask The 8-bit value corresponding to the byte position after disassembly; Will Combined into a 32-bit S-box output mask status word : .

[0009] Furthermore, the result of the XOR operation is further masked, specifically including: The DSP chip's random number generator is invoked to generate a 128-bit third random mask. ; Output mask state of round function Round key for the next round Perform an XOR operation to obtain the intermediate result U: ; Obtain the A component, B component, and C component from the current round's input mask state data; Calculate the input mask state data for the next round. : ; ; ; ; in, This represents the lowest 32 bits of the third random mask. This represents the second lowest 32 bits. This indicates the second highest 32 bits. This indicates a maximum of 32 bits.

[0010] An SM4 algorithm mask encryption processing unit applied to a DSP chip, comprising: The data bus interface is used to receive plaintext data P and the initial round key K0; The mask generation circuit includes a true random number generator and a linear feedback shift register, used to generate a first random mask M1, and a second random mask based on the round key Kr through nonlinear compression and bit concatenation operations. ; The masking unit is used to perform an XOR operation between the plaintext data and the first random mask to obtain the first mask state data. ; The parallel S-box lookup unit contains four parallel masked S-box lookup table memories. Each masked S-box lookup table memory stores a constructed masked S-box lookup table, which is used to perform masked S-box lookup operations on four bytes simultaneously. The mask compensation unit is used to receive the output of the parallel S-box lookup unit and the second random mask. The compensated S-box output is calculated according to the following formula: ; Where si is the lookup table output and βi is the preset output mask. The corresponding bytes for the second random mask; The linear transformation unit is used to perform the linear transformation L of the SM4 algorithm on the 32-bit word output by the mask compensation unit to obtain the round function output mask state; The remasking unit is used to receive the output mask state of the round function, the components A, B, and C of the current round input mask state, and the third random mask. The next round of input mask state is calculated according to the following formula: ; ; ; ; in, This indicates the output mask state of the round function. Indicates the round key for the next round; The iterative control unit is used to control the iterative process of multiple rounds of encryption and calls the demasking unit to output the final ciphertext after the last round of iteration.

[0011] The present invention has the following advantages over the prior art: By utilizing the built-in true random number generator of the DSP chip in conjunction with a linear feedback shift register to generate a first random mask, and then generating a second random mask based on the round key through nonlinear compression and bit concatenation, a third random mask is also generated for further masking. This multi-dimensional random mask covers the entire encryption process. Simultaneously, a dedicated mask S-box lookup table, where both input and output are masked, is constructed and coupled with demasking compensation operations, effectively resisting power analysis attacks and significantly improving the encryption security performance of the SM4 algorithm on DSP chips. This invention adapts to the DSP chip hardware architecture, splitting the second random mask into 8-bit bytes for masking the round input status word. It pre-calculates mask transformation constants and adjustment factors to achieve mask transformation of the round function, and sets up four independent mask S-box lookup tables to achieve parallel lookup operations. This fully utilizes the operational characteristics of the DSP chip's arithmetic logic unit, improving the execution efficiency of encryption operations. Efficiency: This invention dynamically generates a second random mask based on the round key, concatenates it with the high 96 bits of the first random mask, and correlates mask generation with the encryption round depth. Simultaneously, a third random mask is used to re-mask the XOR result and dynamically update the input mask state data for the next round, avoiding security vulnerabilities caused by mask reuse and further enhancing encryption security. This invention sets up dedicated hardware units such as a data bus interface, mask generation circuit, and parallel S-box lookup unit on the DSP chip. Each unit works collaboratively to complete mask generation, mask operation, S-box lookup, mask compensation, linear transformation, and other operations. The iterative control unit coordinates the multi-round encryption iteration process and performs global demasking at the end, making the entire SM4 algorithm mask implementation scheme hardware-implementable, with a standardized execution process, high compatibility with DSP chips, and balancing encryption security, efficiency, and hardware feasibility. Attached Figure Description

[0012] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0013] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0014] like Figure 1 As shown, a method for implementing the SM4 algorithm mask for power consumption analysis on a DSP chip includes the following steps: Obtain the plaintext data to be encrypted and the initial round key; Generate a first random mask with the same length as the plaintext data, and use the first random mask to perform a first mask operation on the plaintext data to obtain the first mask state data; For the multi-round iterative encryption structure of the SM4 algorithm, a second random mask is generated based on the current round key in each round of encryption operation; The first mask state data and the second random mask are input into the arithmetic logic unit of the DSP chip, and the round function F after mask transformation is executed. The round function F includes nonlinear transformation T and linear transformation L. In the nonlinear transformation T, the pre-constructed and stored masked S-box lookup table is called. The input and output data of the masked S-box lookup table are both covered by the mask. Obtain the second random mask and the preset mask compensation factor for the current round, perform demasking compensation operation on the output result of the masked S-box lookup table, and generate the S-box output mask state for the current round. Perform a linear transformation L on the output mask state of the S-box to obtain the output mask state of the round function; The output mask state of the round function is XORed with the round key of the next round, and the result of the XOR operation is further masked using a third random mask to generate the input mask state data for the next round of encryption operation. After all rounds of iteration are completed, the final ciphertext mask state data is globally demasked to output the final ciphertext.

[0015] Generate a first random mask with a length equal to that of the plaintext data, specifically including: Call the true random number generator built into the DSP chip to obtain the basic random seed; The basic random seed is input into a linear feedback shift register for iterative expansion to generate a first random mask M1 with the same length as the plaintext data. The first mask is obtained using the following formula: ; Where P represents plaintext data, M1 represents the first random mask, and Mstate0 represents the first mask state data. This represents a bitwise XOR operation; By utilizing the DSP chip's built-in true random number generator to obtain the basic random seed, no external random number generation hardware module is needed. This adapts to the DSP chip's native hardware architecture, reducing hardware implementation costs and integration complexity. Furthermore, the strong randomness of the true random seed fundamentally avoids the security vulnerabilities of pseudo-random number masks, enhancing the mask's fundamental security. Iterative expansion of the basic random seed using a linear feedback shift register efficiently generates a first random mask that precisely matches the plaintext data length. This perfectly adapts to the 128-bit data processing width requirement of the SM4 algorithm, eliminating bit width redundancy or missing bit issues. Moreover, the linear feedback shift register is a logic unit easily implemented on the DSP chip, facilitating iterative expansion... It boasts high computational efficiency and short processing time. The first mask operation is performed using bitwise XOR, a fundamental native operation of the DSP chip's arithmetic logic unit. This eliminates the need for additional complex computational logic, resulting in fast execution speed and low computational complexity. It can quickly complete the initial masking of plaintext, laying an efficient foundation for subsequent multi-round encryption masking operations. At the same time, the bitwise XOR operation has good reversibility, ensuring that the original ciphertext can be accurately restored during global demasking after encryption without causing data bit distortion. The entire process of first random mask generation and mask operation is completed using the DSP chip's own hardware resources, without additional software computation overhead, further improving the overall execution efficiency of the SM4 algorithm's encryption process.

[0016] Suppose that the plaintext data P to be encrypted by the SM4 algorithm is in 128-bit hexadecimal form, P=0x123456789ABCDEF0123456789ABCDEF0. This plaintext is the standard 128-bit processing width of the SM4 algorithm, which perfectly matches the length of the first random mask M1 to be generated.

[0017] The true random number generator built into the DSP chip is invoked to obtain a 32-bit basic random seed S=0x98765432. This seed is generated by the native hardware of the DSP chip without the participation of any external modules, and has strong randomness and high acquisition efficiency. The basic random seed S is input into a 32-bit linear feedback shift register (LFSR) for iterative expansion. The iteration rule involves left-shifting the 32-bit seed by 8 bits and then XORing it with the original basic random seed. This process is repeated for four stages. The 32-bit results from the four iterations are then concatenated bit by bit in the iteration order to generate a 128-bit first random mask. The iterative process is as follows: First-level iteration: ; Second-level iteration: ; Third-level iteration: ; Fourth level iteration: ; Bit concatenation generates a 128-bit M1: ; 3. Perform the first mask operation, according to the formula. Perform a 128-bit bitwise XOR operation, XORing P and M1 into 32-bit segments sequentially, and then concatenate the segment results to obtain the first mask state data. The segmented XOR and concatenation process is as follows: Segment 1: 0x12345678 ⊕ 0x98765432 = 0x8A42024A; Segment 2: 0x9ABCDEF0⊕0x8E226632=0x128EBB22; Segment 3: 0x12345678 ⊕ 0xBA106632 = 0xAC24304A; Segment 4: 0x9ABCDEF0⊕0x88106632=0x12ACB8C2; splicing generation : .

[0018] In the above process, the iterative expansion and bitwise XOR operation of the linear feedback shift register are both natively completed by the DSP chip's arithmetic logic unit, without any additional software or hardware overhead, and the 128-bit mask state data... It can be directly used as input for subsequent SM4 algorithm rounds of encryption, and due to the reversibility of bitwise XOR, the final ciphertext mask state data can be XORed with M1 again to complete the global demasking and restore the original ciphertext.

[0019] A second random mask is generated based on the current round key, specifically including: Split the 128-bit round key Kr of the current round into four 32-bit words. ; Nonlinear compression is performed on four 32-bit words to obtain the nonlinear compression result. : ; in, This represents a 32-bit modulo addition operation. The nonlinear compression result Nr is XORed with the preset round constant Cr to obtain the dynamic masking factor Dr: ; The dynamic masking factor Dr is concatenated with the high 96 bits of the first random mask M1 to generate a 128-bit second random mask for the current round. : ; in, This indicates a bit concatenation operation, where M1[127:32] represents bits 32 to 127 of the first random mask M1; A second random mask is dynamically generated based on the current round key, deeply associating the mask with the round key to avoid security vulnerabilities caused by masks without key association, significantly improving resistance to power analysis attacks. Simultaneously, the round key is split and non-linearly compressed using 32-bit modulo addition and bitwise XOR. These operations are native basic operations of the DSP chip's arithmetic logic unit, offering high computational efficiency and imparting key-related randomness to the mask factor, balancing security and execution efficiency. A preset round constant is introduced into the dynamic mask factor generation, further enhancing the mask's randomness and preventing mask duplication due to similar key characteristics in different rounds, thus strengthening the mask diversity for multi-round encryption. The dynamic mask factor is then bit-concatenated with the high 96 bits of the first random mask to generate a 128-bit second random mask. The second random mask is generated by fusing two types of masks, allowing it to possess both key correlation and the strong randomness inherited from the first random mask. This dual enhancement of mask security level is achieved. Bit concatenation is a basic operation that is easily implemented by DSP chips, with no additional computational overhead. The bit width of the concatenated mask precisely matches the 128-bit processing requirement of the SM4 algorithm, perfectly adapting to the mask update operation of subsequent round functions. The entire second random mask generation process is completed by the native computing unit of the DSP chip, without the need for external hardware. It seamlessly connects with the first random mask generation process, ensuring the overall continuity of the encryption mask operation. At the same time, the generated second random mask provides precisely matched mask data for the mask update of the subsequent round input status word, laying a reliable foundation for the mask conversion of the round function.

[0020] Continuing with the previous 128-bit first random mask (Divided into 32-bit segments) Where M1[127:32] is the 32nd to 127th bits of M1, i.e., the high 96 bits: 0x987654328E226632BA106632), let the 128-bit round key of the current round r be... (SM4 algorithm standard round key), preset 32-bit round constant (SM4 algorithm standard round constant), generate the second random mask : 128-bit round key It is split into four 32-bit words, arranged from highest to lowest bit width. ; Nonlinear compression is performed on four 32-bit words, and the calculation is performed. ,in 32-bit mode Addition operation, calculated step by step: ; ; ; Calculate the dynamic mask factor Substituting the values, we get: ; Perform a bit concatenation operation between the dynamic mask factor Dr and the high 96 bits of M1 [127:32]. (for bit splicing), according to the formula Generate a 128-bit second random mask, and calculate: .

[0021] The final 128-bit second random mask It can be directly split and used for mask update operations of subsequent round input status words B, C, and D. The entire generation process of 32-bit modulo addition, bitwise XOR, and bit concatenation is natively completed by the DSP chip arithmetic logic unit without additional computational overhead. Moreover, the generated mask is strongly correlated with the round key and the first random mask, and has high randomness and high security.

[0022] Execute the masked round function F, which specifically includes: Obtain the current round input mask state data X=(A,B,C,D), where A, B, C, and D are all 32-bit words and each carries a corresponding part of the first random mask M1. ; Use the second random mask Split into four 8-bit bytes ; The first mask is updated for B, C, and D in the round input to generate the updated status word. : ; ; ; The updated XOR the current round key Kr with the intermediate data Y to obtain the intermediate data Y: ; Obtain the preset fixed input mask γ, and the mask transformation constant KΔ pre-calculated based on the first random mask M1, where ; Calculate the current round mask adjustment factor Δr: ; The intermediate data Y is masked to obtain the input data carrying a fixed input mask γ. : ; Will As input to the nonlinear transformation T; A mask conversion process for the round function F is designed to suit the operational characteristics of the arithmetic logic unit of the DSP chip. The second random mask is split into 8-bit bytes for targeted mask updates of the round input status words B, C, and D. Bit concatenation and bitwise XOR are native basic operations of the DSP chip, simple to operate and highly efficient with no additional computational overhead. A fixed input mask γ is preset, and the mask conversion constant KΔ is pre-calculated based on the first random mask, avoiding complex real-time calculations during round function operations and significantly improving mask conversion efficiency. The intermediate data Y is precisely masked by calculating the mask adjustment factor Δr, effectively compensating for deviations caused by mask updates, ensuring that the adjusted Y' stably carries the fixed input mask γ, perfectly adapting to the input of the pre-constructed mask S-box lookup table. The requirements are as follows: ensure the consistency of the mask input for the nonlinear transform T; mask the input state word and intermediate data throughout the round function operation to eliminate power leakage points caused by data feature exposure during the operation, thereby strengthening the ability to resist power analysis attacks; integrate the round key into the generation process of the intermediate data Y, making the mask operation of the round function deeply correlated with the round key, further improving encryption security; seamlessly connect the first and second random mask generation results in each step to ensure the continuity and data consistency of the entire SM4 algorithm mask encryption process, providing accurate and compliant mask input data for the subsequent nonlinear transform T; at the same time, the logic design for mask update and adjustment is simple and compatible with the parallel computing characteristics of DSP chips, and can be completed quickly by relying on hardware.

[0023] Continuing with the aforementioned unified parameters: First random mask Its corresponding 32-bit status word component: ; Current round's 128-bit round key: ; Second random mask ; Preset 8-bit fixed input mask Extended to 32 bits, it is 0x5A5A5A5A (adapted to 32-bit status word operations).

[0024] The current round input mask state data X=(A,B,C,D) is set, and the specific values ​​of each 32-bit word are as follows: The round function F operation performs the mask transformation: 128 bits Divide it into four 8-bit bytes, and take the first four 8-bit bytes as follows: ; For B, C, and D, perform the first mask update by concatenating the individual 8-bit bytes four times into a 32-bit word, then performing a bitwise XOR operation to calculate... : ; ; ; The updated and Perform a bitwise XOR operation to calculate the intermediate data Y: ; Pre-compute mask conversion constants According to the formula calculate( (32-bit extended value) First calculate: ; Calculate again ; Calculate the current round mask adjustment factor According to the formula calculate: First calculate the part inside the parentheses: ; Calculate again ; Adjust the mask of the intermediate data Y and calculate the mask carrying the fixed input. Input data : ; The final result It can be directly used as input data for the nonlinear transformation T. The entire operation consists of native bitwise XOR and bitwise concatenation operations of the DSP chip's arithmetic logic unit, with no additional computational overhead. Stable carrying of fixed input mask It fully adapts to the input requirements of the subsequent mask S-box lookup table.

[0025] Pre-construct and store a masked S-box lookup table, specifically including: Choose a fixed 8-bit input mask γ and four fixed 8-bit output masks. ; For each byte position i∈{0,1,2,3}, construct the corresponding masked S-box lookup table. For each input value x∈[0,255] of the original S-box of the SM4 algorithm, the following condition is met: ; Where S(x) is the original S-box output; The 256 mask output values ​​of each lookup table are sorted by index. The sequence is stored in the memory of the DSP chip, forming four independent masked S-box lookup tables; By selecting a fixed 8-bit input mask γ and four fixed 8-bit output masks β Construct masked S-box lookup tables to cover the inputs and outputs of the S-box of the SM4 algorithm's nonlinear transformation T with a mask, completely eliminating power leakage points caused by the exposure of the original S-box due to its fixed input and output characteristics, and significantly enhancing the resistance to power analysis attacks. Construct four independent masked S-box lookup tables for the four byte positions. It perfectly adapts to the parallel computing characteristics of DSP chips, enabling simultaneous parallel lookup operations on four 8-bit bytes. Compared to serial lookup, it significantly improves the execution efficiency of nonlinear transformations. The masked S-box lookup table is constructed based on the original SM4 S-box and satisfies... The mapping relationship, while ensuring mask protection, strictly adheres to the original operation rules of the SM4 algorithm, without changing the algorithm's encryption logic, ensuring the correctness of the encryption result. The 256 mask output values ​​of each mask S-box are indexed... The order is pre-stored in the DSP chip's memory, avoiding the complex calculations of constructing the S-box in real time during encryption, reducing computational overhead, and allowing the DSP chip to directly access the data by index, improving search efficiency. The constructed mask S-box input mask γ and the adjusted data The fixed input mask γ carried is completely consistent, achieving seamless connection with the round function mask conversion process, ensuring data consistency and process continuity of the entire encryption mask operation. The four independent mask S boxes each correspond to one byte position, with clear division of labor, avoiding mask interference between bytes, and improving the accuracy of mask protection. The mask S box is designed as an 8-bit byte-level lookup table, which is compatible with the byte operation and storage characteristics of the DSP chip, reducing the difficulty of hardware access and operation adaptation.

[0026] Continuing with the previous unified parameters, a preset 8-bit fixed input mask is used. Select four fixed 8-bit output masks: Based on the SM4 algorithm standard primitive S-box The output is an 8-bit hexadecimal value, representing the byte position. Construct masked S-box lookup tables respectively All lookup tables satisfy the core mapping formula: And sort the 256 8-bit mask output values ​​of each lookup table by index. The data are stored sequentially in an independent memory area of ​​the DSP chip, and the specific implementation process is as follows: Define the original S-box baseline values: Select three typical input values ​​from the original SM4 S-box. Its standard output is: ; Calculate the indices and outputs of the masked S-boxes according to the mapping formula: For each typical x value, calculate the indices of the four masked S-boxes respectively. and corresponding output values The calculation is as follows: against : ; ; ; ; ; against : ; ; ; ; ; against : ; ; ; ; ; Full construction and storage: Following the above rules, for x∈[0,255], calculate the 256 indices and corresponding output values ​​of each mask S-box sequentially, and then... The 256 8-bit values ​​are stored in memory area 1 of the DSP chip in the order of index 0x00 to 0xFF. Stored in memory region 2, Stored in memory region 3, Stored in memory region 4, forming four independent parallel S-box lookup table memories; Find the fit verification: the obtained nonlinear transformation input It was split into four 8-bit bytes. These four bytes can be used directly as indexes to... Parallel lookup requires no additional processing and is perfectly compatible with the parallel computing characteristics of DSP chips.

[0027] The above-mentioned mask S-box is constructed offline and pre-computed. During the encryption process, the DSP chip only needs to perform an index lookup operation without any additional computational overhead. Moreover, all inputs and outputs are covered by the mask, completely eliminating the risk of power leakage of the original S-box.

[0028] The output of the masked S-box lookup table is subjected to demasking compensation operation, specifically including: Obtain the input data of the nonlinear transformation T ,Will Split into four 8-bit bytes ; respectively Using an index, perform parallel lookups of four masked S-boxes. This yields four 8-bit mask output values. : ; Get the four pre-stored output masks ; Demasking compensation is performed on each masked output value to obtain the true output of the S-box carrying a second random mask: ; in, For the second random mask The 8-bit value corresponding to the byte position after disassembly; Will Combined into a 32-bit S-box output mask status word : ; Perform targeted mask compensation operations on the output data after the S-box lookup to accurately eliminate the output mask β. The introduced deviations ensure that the output of the nonlinear transformation T strictly conforms to the native operational logic of the SM4 algorithm, preserving the security of the mask protection without changing the core encryption rules of the algorithm; the parallel search results of the four independent mask S boxes are concatenated into 32-bit data, perfectly adapting to the 32-bit word operation architecture of the DSP chip, without the additional overhead of byte reassembly; the linear transformation τ adopts the standard circular shift and bitwise XOR operations of the SM4 algorithm, which are both native basic operations of the DSP chip's arithmetic logic unit, ensuring high execution efficiency and guaranteeing the compliance of the encryption logic; by pre-calculating the demasking compensation factor Δτ, the fixed input mask γ and output mask β are eliminated. The dual impact of the nonlinear transformation T ensures that the final output retains only the valid data from the round function operation, avoiding errors in the encryption result caused by mask residue. The final output of the round function F is obtained by bitwise XORing the output of the nonlinear transformation T with the round input state word A, seamlessly connecting to the 32-round iteration process of the SM4 algorithm. Furthermore, intermediate data is masked throughout the process, eliminating power leakage points in the linear transformation process and further enhancing resistance to power analysis attacks. The mask compensation factor calculation rules are consistent with those of the fixed masks γ and β. Deep correlation ensures data consistency and logical coherence throughout the mask encryption process; all computational steps are designed based on the parallel computing characteristics of the DSP chip, which greatly improves the overall execution efficiency of 32 rounds of iterative encryption.

[0029] Continuing with the previous unified parameters: 8-bit fixed input mask (32-bit extended to 0x5A5A5A5A); four 8-bit fixed output masks (32 bits concatenated as 0x78563412); Nonlinear transformation input (Split into four 8-bit bytes:) ); Round input status word A=0x11223344; SM4 algorithm standard primitive S-box S(x) (x∈[0,255], output is an 8-bit hexadecimal value).

[0030] The final output is calculated by performing the nonlinear transformation T and the round function F: Parallel search for mask S-box: Each is used as an index in the corresponding mask S-box. Search for the output value in the middle (core rule: ): Search Therefore ; Search : Therefore ; Search : Therefore ; Search : ; Bitwise concatenation lookup result: Concatenate the four 8-bit lookup results according to their byte positions to form a 32-bit data Z, using the formula: The calculation yields: Z = 0x3B992485; Calculate the masking compensation factor Δτ: according to the formula Calculation (32-bit operation): ; Perform mask compensation operation: compensate for Z to obtain The formula is The calculation yields: ; Perform the SM4 standard linear transformation τ: The formula is as follows (All are 32-bit circular shifts), step-by-step calculation: ; ; ; ; Bitwise XOR: ; The final output of the round function F is calculated using the following formula: Substituting the values, we get: .

[0031] The final result It can be directly used as the input state word for the next iteration of the SM4 algorithm. All calculations are performed by the native logic of the DSP chip, with no additional overhead, and the encryption result conforms to the SM4 algorithm rules. Furthermore, the full masking eliminates the risk of power leakage.

[0032] The result of the XOR operation is then masked again, specifically including: The DSP chip's random number generator is invoked to generate a 128-bit third random mask. ; Output mask state of round function XORing it with the round key of the next round yields the intermediate result U: ; Obtain the A component, B component, and C component from the current round's input mask state data; Calculate the input mask state data for the next round. : ; ; ; ; in, This represents the lowest 32 bits of the third random mask. This represents the second lowest 32 bits. This indicates the second highest 32 bits. Indicates the highest 32 bits; In the 32-round iteration of the SM4 algorithm, a third random mask is introduced to achieve re-masking processing. A 32-bit base seed is generated by calling the built-in true random number generator of the DSP chip and expanded into a 128-bit third random mask via a linear feedback shift register. This maintains the efficient mask generation logic, requires no additional hardware overhead, and provides strong randomness, avoiding security vulnerabilities caused by mask reuse. The round function output is XORed with the third random mask to complete the re-masking operation. During the 32 rounds of iteration, intermediate state data is continuously masked, completely eliminating power leakage points caused by the exposure of state data characteristics during iteration, further enhancing resistance to power analysis attacks. The next round's input mask state data is dynamically updated based on the re-masked result, ensuring the mask state of each round is consistent. The mask is deeply correlated with the previous round and has no repetition, improving the dynamism and security of the mask protection. The generation rules of the third random mask are consistent with the first and second random masks, and are completed by relying on the native computing unit of the DSP chip, ensuring the hardware adaptability and computational efficiency of the entire encryption process. The dynamically updated mask state data seamlessly connects to the next round function operation, maintaining the logical continuity and data consistency of 32 rounds of iteration. Moreover, the update operation only involves basic bitwise XOR and data shifting, without complex computational overhead. The re-masking process ensures that the intermediate data of each round of iteration has independent random mask protection, greatly reducing the possibility of extracting effective data features from power analysis attacks, while not changing the core logic of the 32 rounds of SM4 algorithm iteration, ensuring the correctness of the encryption result.

[0033] Continuing with the aforementioned unified parameters: the final output of the current round function F The current round input mask status data X=(A,B,C,D), where A=0x11223344, B=0x55667788, C=0x99AABBCC, and D=0xDDEEFF00; The DSP chip has a built-in true random number generator that produces a 32-bit basic random seed. (Seeds independent of the first and second random masks, ensuring randomness); a 32-bit seed is left-shifted by 8 bits and XORed with the original base seed, generating a 128-bit third random mask M3 through 4-level iterations. Then, re-masking and the next round of mask state updates are performed. Generate a 128-bit third random mask M3: First-level iteration: ; Second-level iteration: ; Third-level iteration: ; Fourth level iteration: ; Bit splicing to generate a 128-bit M3: ; Splitting the third random mask and performing a re-masking operation: Split M3 into four 32-bit words: ; Output of the round function Perform the remasking operation, the formula is: The calculation yields: ; Dynamically update the input mask state data for the next round. : The standard iteration rule of the SM4 algorithm is the state of the next round. After combining and re-masking, it is updated to: Step-by-step calculation: Next round A (original B⊕M3B): 0x55667788⊕0xEE2366CD=0xB5451145; Next round B (original C⊕M3C): 0x99AABBCC⊕0x44ED67CD=0xDD47D801; Next round C (original D⊕M3D): 0xDDEEFF00⊕0x896E67CD=0x548198CD; Next round D (after masking) ): 0x75231104; Final input mask state data for the next round: .

[0034] In the above process, the third random mask is generated independently and is regenerated in each iteration, with no mask reuse. The mask operation and state update only involve the bitwise XOR operation native to the DSP chip, which is highly efficient. At the same time, the state data of the next round carries the new random mask throughout, completely avoiding the risk of power leakage during the iteration process.

[0035] An SM4 algorithm mask encryption processing unit applied to a DSP chip, comprising: The data bus interface is used to receive plaintext data P and the initial round key K0; The mask generation circuit includes a true random number generator and a linear feedback shift register, used to generate a first random mask M1, and a second random mask based on the round key Kr through nonlinear compression and bit concatenation operations. ; The masking unit is used to perform an XOR operation between the plaintext data and the first random mask to obtain the first mask state data. ; The parallel S-box lookup unit contains four parallel masked S-box lookup table memories. Each masked S-box lookup table memory stores information based on the masked S-box lookup table, which is used to perform masked S-box lookup operations on four bytes simultaneously. The mask compensation unit is used to receive the output of the parallel S-box lookup unit and the second random mask. The compensated S-box output is calculated according to the following formula: ; Where si is the lookup table output and βi is the preset output mask. The corresponding bytes for the second random mask; The linear transformation unit is used to perform the linear transformation L of the SM4 algorithm on the 32-bit word output by the mask compensation unit to obtain the round function output mask state; The remasking unit is used to receive the output mask state of the round function, the components A, B, and C of the current round input mask state, and the third random mask. The next round of input mask state is calculated according to the following formula: ; ; ; ; in, This indicates the output mask state of the round function. Indicates the round key for the next round; The iterative control unit is used to control the iterative process of multiple rounds of encryption and calls the demasking unit to output the final ciphertext after the last round of iteration. By building a dedicated functional unit system highly compatible with the DSP chip hardware architecture, the entire process of SM4 algorithm masking is implemented in hardware, eliminating the overhead of pure software computation and significantly improving the overall encryption execution efficiency. Each functional unit has a clear division of labor and works collaboratively to achieve integrated execution of data transmission, mask generation, mask computation, S-box lookup, compensation transformation, re-masking, and iterative control, ensuring the continuity of the encryption process. The data bus interface is adapted to the DSP chip's bus transmission protocol, enabling standardized, high-speed access to plaintext and the initial round key without transmission compatibility issues. The mask generation circuit integrates a true random number generator and a linear feedback shift register, enabling the generation of the first and second random masks in one integrated manner. It is highly compatible with the previous mask generation logic, eliminating the need for external hardware modules, thus reducing hardware integration costs and achieving high mask generation efficiency. The mask operation unit is dedicated to various bitwise XOR mask operations, adapting to the native operation characteristics of the DSP chip's arithmetic logic unit, resulting in low latency and fast execution speed. The parallel S-box lookup unit integrates four independent mask S-box lookup table memories, enabling four-byte parallel lookups. This precise adaptation to S-box operations completely solves the efficiency problem of serial lookups. The bottleneck is addressed by a dedicated masking compensation unit that performs demasking compensation operations, accurately compensating the output of the masked S-box to ensure the correctness of the nonlinear transformation results. The linear transformation unit is dedicated to the standard linear transformation L of the SM4 algorithm, natively performing cyclic shifts and bitwise XOR operations without additional computational logic design. The remasking unit specifically handles the remasking of the third random mask and updates the input mask state for the next round, ensuring logical continuity across multiple iterations. The iteration control unit automatically coordinates the multi-round encryption iteration process, completing round switching and calling the demasking unit to perform global demasking after the last iteration, avoiding manual intervention and improving the automation level of the encryption process. The entire hardware unit system provides full masking protection for the encrypted data during execution. Each unit's computational operations have no power leakage points exposed by data characteristics, further strengthening the overall resistance to power analysis attacks. Furthermore, all hardware units are designed based on the native hardware characteristics of the DSP chip, resulting in high integration. High-speed data transmission between units is achieved within the chip, significantly reducing data interaction overhead. Simultaneously, the computational logic of each unit strictly adheres to the core rules of the SM4 algorithm, ensuring the accuracy of the encryption results while achieving masking protection.

[0036] The core parameters for the continuation cycle are unified, and the next round key of the SM4 algorithm standard is supplemented. The DSP chip is pre-defined as having independent logic operation modules for each hardware unit. Data exchange between units is accomplished via the chip's internal high-speed data bus. Each unit strictly executes its corresponding operation rules. The demonstration showcases the collaborative execution process of each hardware unit during a single round of encryption, with all operations performed natively in hardware without software intervention. Data bus interface: Following the standard bus protocol of the DSP chip, it receives 128 bits of plaintext to be encrypted, P=0x123456789ABCDEF0123456789ABCDEF0, and a 128-bit initial round key. The two types of data are transmitted at high speed to the mask generation circuit and the mask operation unit, with no packet loss and no delay in data transmission; The mask generation circuit integrates a true random number generator and a 32-bit linear feedback shift register. First, the true random number generator is called to obtain a 32-bit basic random seed S=0x98765432. Then, through iterative expansion, a 128-bit first random mask is generated. The M1 is then transmitted to the masking unit; the current round key Kr is then received, and nonlinear compression, round constant XOR, and bit concatenation are performed according to the previous rules to generate a 128-bit second random mask. The data is transmitted to the mask calculation unit and the mask compensation unit. Finally, a true random number generator is called to obtain an independent 32-bit base seed. A 128-bit third random mask is generated through iterative expansion using the same rules. Transmitted to the remasking unit; Masking unit: Receives plaintext P transmitted from the data bus interface and M1 transmitted from the masking generation circuit, performs the first masking operation according to the formula... Calculated This data is transmitted as the current round input mask state data X=(A=0x11223344,B=0x55667788,C=0x99AABBCC,D=0xDDEEFF00) to the linear transformation unit (round function F execution module). Receiving After updating the masks for B, C, and D, we obtain... The updated data is then transmitted to the parallel S-box lookup unit. Parallel S-box lookup unit: Contains four independent masked S-box lookup table memories, each storing... ( ), receive the mask-adjusted data transmitted by the mask operation unit It was split into four 8-bit bytes. The output value is obtained simultaneously through parallel lookup in four independent memory locations. And transmit the four 8-bit output values ​​synchronously to the mask compensation unit; Mask compensation unit: Receives the output of the parallel S-box lookup unit Transmitted with the mask generation circuit (After splitting) At the same time, the fixed output mask stored on the chip is retrieved. According to the compensation formula Parallel computation of compensation values: ; ; ; ; The four 8-bit compensation values ​​are then concatenated into a 32-bit S-box output mask status word. The data is transmitted to the linear transformation unit. Linear transformation unit: receives the data transmitted by the mask compensation unit. Strictly adhering to the standard linear transformation L of the SM4 algorithm, the output mask state of the round function is calculated through native 32-bit circular shift and bitwise XOR operations. It is then transmitted to the remasking unit and simultaneously transmitted to the iterative control unit for round data recording. Remasking unit: Receives data transmitted from the linear transformation unit. The transmission of the mask generation circuit And the current round input mask state components A, B, and C synchronized by the iterative control unit, firstly... With the next round key XOR yields intermediate results Then split Four 32-bit fields , , , Calculate the input mask state data for the next round according to the formula. : ;

[0037] ; ; Finally obtained and transmit it to the iterative control unit; Iterative control unit: Receives the next round of input mask state data transmitted by the remasking unit. First, it is determined that the current round is round 1, which does not meet the 32-round iteration requirement of the SM4 algorithm. Then... and the next round key Synchronize to all hardware units and initiate the second round of encryption computation; if 32 iterations are completed, the unit will retrieve the first random mask stored in the mask generation circuit. Perform a global demasking operation on the final ciphertext mask state data. It outputs the final 128-bit ciphertext through the data bus interface, and the entire process is automated without human intervention.

[0038] All the above-mentioned unit operations are executed by the native hardware logic of the DSP chip. Data transmission between units is carried out through high-speed bus interaction within the chip, without additional computation and transmission overhead. Furthermore, the data is masked throughout the process, with no power leakage points that expose any data features. This ensures the correctness of the SM4 algorithm encryption, achieves hardware protection against power analysis attacks, and significantly improves the efficiency of encryption operations.

[0039] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for implementing the SM4 algorithm mask for power consumption analysis on a DSP chip, characterized in that, Includes the following steps: Obtain the plaintext data to be encrypted and the initial round key; Generate a first random mask with the same length as the plaintext data, and use the first random mask to perform a first mask operation on the plaintext data to obtain the first mask state data; For the multi-round iterative encryption structure of the SM4 algorithm, a second random mask is generated based on the current round key in each round of encryption operation; The first mask state data and the second random mask are input into the arithmetic logic unit of the DSP chip, and the round function F after mask transformation is executed. The round function F includes nonlinear transformation T and linear transformation L. In the nonlinear transformation T, the pre-constructed and stored masked S-box lookup table is called. The input and output data of the masked S-box lookup table are both covered by the mask. Obtain the second random mask and the preset mask compensation factor for the current round, perform demasking compensation operation on the output result of the masked S-box lookup table, and generate the S-box output mask state for the current round. Perform a linear transformation L on the output mask state of the S-box to obtain the output mask state of the round function; The output mask state of the round function is XORed with the round key of the next round, and the result of the XOR operation is further masked using a third random mask to generate the input mask state data for the next round of encryption operation. After all rounds of iteration are completed, the final ciphertext mask state data is globally demasked to output the final ciphertext.

2. The SM4 algorithm mask implementation method for power consumption analysis on a DSP chip according to claim 1, characterized in that: Generate a first random mask with a length equal to that of the plaintext data, specifically including: Call the true random number generator built into the DSP chip to obtain the basic random seed; The basic random seed is input into a linear feedback shift register and iteratively expanded to generate a first random mask M1 with the same length as the plaintext data.

3. A method for implementing the SM4 algorithm mask for power consumption analysis on a DSP chip according to claim 2, characterized in that: A second random mask is generated based on the current round key, specifically including: Split the 128-bit round key Kr of the current round into four 32-bit words. ; Nonlinear compression is performed on four 32-bit words to obtain the nonlinear compression result. : ； in, This represents a 32-bit modulo addition operation. The nonlinear compression result Nr is XORed with the preset round constant Cr to obtain the dynamic masking factor Dr. The dynamic masking factor Dr is concatenated with the high 96 bits of the first random mask M1 to generate a 128-bit second random mask for the current round. .

4. A method for implementing the SM4 algorithm mask for power consumption analysis on a DSP chip according to claim 3, characterized in that: Execute the masked round function F, which specifically includes: Obtain the current round input mask state data X=(A,B,C,D), where A, B, C, and D are all 32-bit words and each carries a corresponding part of the first random mask M1. ; Use the second random mask Split into four 8-bit bytes ; The first mask is updated for B, C, and D in the round input to generate the updated status word. ; The updated XOR the current round key Kr with the intermediate data Y to obtain the intermediate data Y; Obtain the preset fixed input mask γ, and the mask transformation constant KΔ pre-calculated based on the first random mask M1, where ; Calculate the current round mask adjustment factor Δr; The intermediate data Y is masked to obtain the input data carrying a fixed input mask γ. ; Will As input to the nonlinear transformation T.

5. A method for implementing the SM4 algorithm mask for power consumption analysis on a DSP chip according to claim 4, characterized in that: Pre-construct and store a masked S-box lookup table, specifically including: Choose a fixed 8-bit input mask γ and four fixed 8-bit output masks. ; For each byte position i∈{0,1,2,3}, construct the corresponding masked S-box lookup table. For each input value x∈[0,255] of the original S-box of the SM4 algorithm, the following condition is met: ； Where S(x) is the original S-box output; The 256 mask output values ​​of each lookup table are sorted by index. The sequence is stored in the memory of the DSP chip, forming four independent masked S-box lookup tables.

6. A method for implementing the SM4 algorithm mask for power consumption analysis on a DSP chip according to claim 5, characterized in that: The output of the masked S-box lookup table is subjected to demasking compensation operation, specifically including: Obtain the input data of the nonlinear transformation T ,Will Split into four 8-bit bytes ; respectively Using an index, perform parallel lookups of four masked S-boxes. This yields four 8-bit mask output values. : ； Get the four pre-stored output masks ; Demasking compensation is performed on each masked output value to obtain the true output of the S-box carrying a second random mask: ； in, For the second random mask The 8-bit value corresponding to the byte position after disassembly; Will Combined into a 32-bit S-box output mask status word .

7. A method for implementing the SM4 algorithm mask for power consumption analysis on a DSP chip according to claim 6, characterized in that: The result of the XOR operation is then masked again, specifically including: The DSP chip's random number generator is invoked to generate a 128-bit third random mask. ; Output mask state of round function Round key for the next round Perform an XOR operation to obtain the intermediate result U; Obtain the A component, B component, and C component from the current round's input mask state data; Calculate the input mask state data for the next round. .

8. An SM4 algorithm mask encryption processing unit applied to a DSP chip, wherein the unit is used in the implementation method of any one of claims 1-7, characterized in that: include: The data bus interface is used to receive plaintext data P and the initial round key K0; The mask generation circuit includes a true random number generator and a linear feedback shift register, used to generate a first random mask M1, and a second random mask based on the round key Kr through nonlinear compression and bit concatenation operations. ; The masking unit is used to perform an XOR operation between the plaintext data and the first random mask to obtain the first mask state data. ; The parallel S-box lookup unit contains four parallel masked S-box lookup table memories. Each masked S-box lookup table memory stores information based on the masked S-box lookup table, which is used to perform masked S-box lookup operations on four bytes simultaneously. The mask compensation unit is used to receive the output of the parallel S-box lookup unit and the second random mask. Calculate the compensated S-box output; The linear transformation unit is used to perform the linear transformation L of the SM4 algorithm on the 32-bit word output by the mask compensation unit to obtain the round function output mask state; The remasking unit is used to receive the output mask state of the round function, the components A, B, and C of the current round input mask state, and the third random mask. Calculate the next round of input mask state according to the following formula; The iterative control unit is used to control the iterative process of multiple rounds of encryption and calls the demasking unit to output the final ciphertext after the last round of iteration.

Images