An encryption algorithm hardware accelerator architecture and method of operation thereof

Abstract

The application discloses a hardware accelerator architecture of encryption algorithm and a working method thereof. The hardware accelerator architecture comprises an encryption unit, which completely expands N rounds of operation of an encryption algorithm, is realized as N independent and serially connected full-pipeline structures on hardware, each stage contains a combination logic circuit required by the round of operation, and a pipeline register is inserted at an output end of each stage; and a round key expansion unit, which adopts an N-stage full-pipeline structure synchronized with N stages of the main pipeline in the encryption unit, and each stage generates a correct round key in advance or in real time for the corresponding main pipeline. The hardware accelerator architecture adopts a double full-pipeline architecture, realizes a limit throughput rate of outputting one cipher text per clock cycle, greatly improves the throughput rate compared with a traditional iterative architecture, and can meet the demand of high-speed encryption applications such as a gigabit Ethernet.

Description

Technical Field

[0001] This application relates to the field of encryption technology, specifically to an encryption algorithm hardware accelerator architecture and its working method. Background Technology

[0002] Currently, hardware implementations of block cipher algorithms, both domestically and internationally, mainly fall into two categories:

[0003] One approach is software implementation based on general-purpose processors or digital signal processors (DSPs): for example, using C language to implement the SM4 algorithm on a general-purpose CPU. This approach is simple to implement and highly flexible, but limited by the processor's sequential execution architecture, its encryption speed is limited and cannot meet the encryption requirements of high-speed data streams (such as network communication and real-time video). The SM4 algorithm, as a domestically developed symmetric block cipher algorithm, is based on its round function, which consists of a synthetic permutation composed of nonlinear and linear transformations, and an XOR operation with the round key. The algorithm employs a 32-round nonlinear iterative structure, with both the block length and key length being 128 bits.

[0004] Second, there's the hardware implementation based on Field-Programmable Gate Arrays (FPGAs) or Application-Specific Integrated Circuits (ASICs). The most common hardware implementation uses a traditional iterative architecture, which executes the 32 rounds of iterative computation of the SM4 algorithm in a loop on hardware, completing one round of computation per clock cycle. For example, a typical Verilog implementation would use a state machine to encrypt a 128-bit data block within 32 clock cycles. Another approach is the S-box implementation based on Lookup Tables (LUTs). When implementing the core nonlinear transformation of the SM4 algorithm—the S-box—the most direct method is to use a 256-byte Lookup Table (LUT) stored in the FPGA's Block RAM (BRAM) or distributed RAM.

[0005] However, traditional iterative hardware architectures require 32 clock cycles to process a single data block, severely limiting throughput to frequency * (128 / 32) = frequency * 4 bps. For example, at a 100MHz operating frequency, the maximum throughput is only 400Mbps, far from meeting the throughput requirements (greater than 10Gbps) of current high-speed communications (such as 10 Gigabit Ethernet) and high-end encryption applications. Furthermore, in iterative hardware architectures, all combinational logic for a single round of computation (including XOR, S-box lookup, and linear transformation) is chained together on a single path, resulting in significant critical path latency. This not only limits the system's maximum operating frequency but also presents challenges for FPGA placement and routing, making timing convergence difficult.

[0006] Furthermore, implementing S-boxes using lookup tables consumes valuable BRAM resources. If the design requires multiple parallel S-boxes to improve performance, BRAM consumption will increase exponentially, limiting the design's scale and integration. Implementing S-boxes using combinational logic (such as complex gate circuits based on composite field arithmetic), without optimization, results in deep logic levels, which can become critical paths in the entire encrypted data path, limiting the highest clock frequency the system can achieve. Summary of the Invention

[0007] To address the issues of low throughput, high S-box computational resource overhead, or high latency in existing SM4 algorithm hardware implementations, this application proposes a hardware accelerator architecture for encryption algorithms and its operating method. This hardware accelerator architecture adopts a dual full-pipeline architecture, achieving a maximum throughput of one ciphertext output per clock cycle. Compared to the traditional iterative architecture, this significantly improves throughput and can meet the needs of high-speed encryption applications such as 10 Gigabit Ethernet.

[0008] This application is achieved through the following technical solution:

[0009] A hardware accelerator architecture for an encryption algorithm includes:

[0010] The encryption unit fully expands the N rounds of encryption algorithm operations and implements them in hardware as N independent, serially connected fully pipelined structures. Each stage contains the combinational logic circuits required for that round of operation, and a pipelined register is inserted at the output of each stage.

[0011] In addition, a round key expansion unit is provided, which adopts an N-level full pipeline structure that is synchronized with the N-level main pipeline in the encryption unit. Each level generates the correct round key in advance or in real time for the corresponding main pipeline.

[0012] In some implementations, each main waterline in the encryption unit employs an S-box optimized circuit based on composite domain arithmetic.

[0013] The S-box optimization circuit is composed of four cascaded sub-modules: a forward module, an inversion module, a backward module, and a merging module.

[0014] The forward module is located at the front end of the S-box optimization circuit. It first performs the forward affine transformation in the definition of the S-box, and then maps the 8-bit input data from the finite field to the composite field through a pre-computed isomorphic mapping matrix.

[0015] The inversion module receives the 8-bit composite field data output by the forward module, splits it into two 4-bit high and low bit components, and performs an inversion operation on the composite field.

[0016] The backward module receives the 8-bit result output by the inversion module. First, it maps the data from the composite domain back to the finite domain through a pre-calculated isomorphic inverse mapping matrix. Then, it performs the backward affine transformation defined in the S-box to complete the S-box permutation function.

[0017] The merging module pre-multiplies the backward affine transformation matrix output by the backward module with the inherent linear transformation L matrix in the round function to obtain a merged total transformation matrix. The output data of the backward module is then directly passed through the total transformation matrix to obtain the final output result of the T transformation in the round function.

[0018] In some implementations, the isomorphic mapping matrix is ​​pre-calculated using mathematical tools, and the matrix with the minimum Hamming weight and optimal circuit depth is selected.

[0019] In some implementations, the inversion operation is achieved through a pre-computed logical expression, which is composed of simple combinational logic gates.

[0020] In some implementations, an algebraic S-box circuit is used in each stage of the expansion pipeline in the round key expansion unit;

[0021] The algebraic S-box circuit is the same as that in the encryption unit.

[0022] In some implementations, the round key expansion unit employs a cyclic key expansion structure.

[0023] In some implementations, N is 32.

[0024] In some implementations, the hardware accelerator architecture is suitable for the SM4 algorithm or the AES algorithm.

[0025] In some implementations, the hardware accelerator architecture achieves a throughput of approximately 128 bits × clock frequency when processing continuous data streams.

[0026] On the other hand, this application also proposes a working method for a hardware accelerator architecture for an encryption algorithm based on any of the above embodiments, including:

[0027] After the first data block is processed by the first-level main pipeline in the encryption unit, the first round of operation is completed after one clock cycle. The result is stored and sent to the second-level main pipeline. At this time, the second-level main pipeline starts to process the second round of operation of the first database, while the first-level main pipeline simultaneously receives and processes the first round of operation of the second data block. And so on. After an initialization delay of N clock cycles, the full pipeline structure of the encryption unit is filled.

[0028] Subsequently, a new data block will begin encryption every clock cycle, and a fully encrypted data block will be output from the end of the pipeline structure.

[0029] In each clock cycle, the extended pipeline in the round key extension unit generates the correct round key in advance or in real time for the corresponding main pipeline.

[0030] This application proposes a hardware accelerator architecture for encryption algorithms and its operating method. It employs a dual fully pipelining architecture, achieving a throughput approaching 128 bits × clock frequency when processing continuous data streams. For example, at a working frequency of 200MHz, the theoretical throughput can reach 25.6Gbps, representing an improvement of approximately 64 times compared to traditional iterative architectures. Its S-box implementation, optimized through composite domain arithmetic, no longer relies on BRAM but is composed of logic gates, thus freeing up valuable BRAM resources for other functions. Simultaneously, through linear transformation merging optimization, the number of combinational logic stages is reduced, contributing to increased maximum system operating frequency or reduced power consumption. Theoretical analysis shows that compared to the standard lookup table implementation, the optimized S-box logic resource usage can be reduced by more than 60%. Furthermore, while achieving high throughput, this hardware accelerator architecture effectively controls logic resource consumption through cyclic key expansion and algebraic optimization of the S-box, achieving a balance between area and performance. This makes the hardware accelerator architecture more feasible and practical on domestic FPGA platforms. Attached Figure Description

[0031] The accompanying drawings, which are included to provide a further understanding of the embodiments of this application and form part of this application, do not constitute a limitation on the embodiments of this application. In the drawings:

[0032] Figure 1 This is a schematic diagram illustrating the hardware accelerator architecture of the encryption algorithm proposed in this application.

[0033] Figure 2 This is a schematic diagram of the S-box optimization circuit based on composite domain arithmetic proposed in an embodiment of this application. Detailed Implementation

[0034] In the following, the terms “comprising” or “may include” as used in the various embodiments of this application indicate the presence of a function, operation, or element of the invention and do not limit the addition of one or more functions, operations, or elements. Furthermore, as used in the various embodiments of this application, the terms “comprising,” “having,” and their cognates are intended only to indicate a specific feature, number, step, operation, element, component, or combination of the foregoing and should not be construed as primarily excluding the presence of one or more other features, numbers, steps, operations, elements, components, or combinations of the foregoing, or adding one or more combinations of the foregoing.

[0035] In various embodiments of this application, the expression "or" or "at least one of A and / or B" includes any combination or all combinations of the words listed simultaneously. For example, the expression "A or B" or "at least one of A and / or B" may include A, may include B, or may include both A and B.

[0036] The terms used in the various embodiments of this application (such as "first," "second," etc.) may modify various constituent elements in the various embodiments, but do not limit the corresponding constituent elements. For example, the above terms do not limit the order and / or importance of the elements. The above terms are only used for the purpose of distinguishing one element from other elements. For example, a first user device and a second user device refer to different user devices, although both are user devices. For example, without departing from the scope of the various embodiments of this application, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element.

[0037] It should be noted that if a description is made of "connecting" one component to another, then the first component can be directly connected to the second component, and a third component can be "connected" between the first and second components. Conversely, when a component is "directly connected" to another component, it can be understood that there is no third component between the first and second components.

[0038] The terminology used in the various embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the various embodiments of this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which the various embodiments of this application pertain. The terms (such as those defined in a generally used dictionary) are to be interpreted as having the same meaning as in the context of the relevant technical field and are not to be interpreted as having an idealized or overly formal meaning, unless clearly defined in the various embodiments of this application.

[0039] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the embodiments and accompanying drawings. The illustrative embodiments and descriptions of this application are only for explaining this application and are not intended to limit this application.

[0040] like Figure 1 As shown in the figure, this application proposes a hardware accelerator architecture for an encryption algorithm, including a data input interface, an encryption unit, a round key expansion unit, and a data output interface.

[0041] The data input interface is used to input the data to be encrypted into the encryption unit; the data output interface is used to output the ciphertext output by the encryption unit.

[0042] Both the encryption unit and the round key expansion unit adopt an N-stage fully pipelined structure.

[0043] Specifically, the encryption unit fully expands the N rounds of encryption algorithm operations, implementing them in hardware as N independent, serially connected fully pipelined structures (the first-stage main pipeline, the second-stage main pipeline, ..., the Nth-stage main pipeline connected in series). Each stage contains the combinational logic circuits required for that round of operations, including round key encryption, S-box transformation, and linear transformation L, with a pipeline register inserted at the output of each stage. The encryption unit works as follows: when the first data block enters the first-stage main pipeline, the first round of operations is completed after one clock cycle. The result is registered and sent to the second-stage main pipeline. At this point, the second-stage main pipeline can begin processing the second round of operations for the first data block, while the first-stage main pipeline can simultaneously receive and process the first round of operations for the second data block, and so on. After an initialization delay of N clock cycles, the pipeline structure is filled. Subsequently, each clock cycle a new data block begins encryption, and simultaneously an encrypted data block is output from the end of the pipeline structure. The throughput approaches 128 bits × clock frequency.

[0044] The round key expansion unit adopts an expansion pipeline synchronized with the main pipeline in the encryption unit. That is, the key expansion unit consists of a first-level expansion pipeline, a second-level expansion pipeline, ..., an Nth-level expansion pipeline connected in series. Based on the initial key, it generates the correct round key in advance or in real time for the corresponding main pipeline in each clock cycle, ensuring that the pipeline always maintains a fully loaded working state. That is, the first-level expansion pipeline generates the round key in advance or in real time for the first-level main pipeline, the second-level expansion pipeline generates the round key in advance or in real time for the second-level main pipeline, and so on, with the Nth-level expansion pipeline generating the round key in advance or in real time for the Nth-level main pipeline.

[0045] Specifically, the SM4 algorithm uses 32 rounds of computation, i.e., N is 32.

[0046] The hardware accelerator architecture proposed in this application adopts a dual fully pipelined architecture, which greatly improves throughput compared to the existing pipeline stages that generate round keys and then distribute them to the encryption module. It can achieve a maximum throughput of one ciphertext per clock cycle. This hardware accelerator architecture is not only suitable for the SM4 algorithm, but can also be applied to other block cipher algorithms with multi-round iterative structures, such as AES. Its 10 rounds of operation can also adopt a similar fully pipelined design, only requiring a change in the number of pipeline stages.

[0047] Furthermore, in each mainstream waterline of the encryption unit, the embodiments of this application employ an S-box optimization circuit based on composite domain arithmetic to implement nonlinear transformation, such as... Figure 2 As shown, the S-box optimization circuit consists of four cascaded sub-modules: a forward module, an inversion module, a backward module, and a merging module.

[0048] The forward module is located at the very front of the circuit. Its input is the original 8-bit S-box data. Internally, the module performs two consecutive transformation operations: first, it performs the forward affine transformation defined in the encryption algorithm's S-box definition; then, it maps the 8-bit input data from the finite field to the composite field using a pre-computed 8×8 isomorphic mapping matrix. This isomorphic mapping matrix can be pre-computed using mathematical tools such as MATLAB, and the matrix with the minimum Hamming weight and optimal circuit depth is selected to reduce the complexity of subsequent combinational logic.

[0049] The inversion module receives the 8-bit composite field data output from the previous stage (i.e., the mapping module), splits it into two 4-bit high and low bit components, and then calculates the composite field GF((2 4 The inversion operation is performed on the finite field GF(2). Since the composite field is relatively small (only 4 bits), the inversion operation can be implemented using pre-computed logical expressions, consisting of simple combinational logic gates (AND, OR, XOR, NOT gates), compared to directly performing the inversion on the finite field GF(2). 8 The complex polynomial operations required for inversion on the original ) are significantly reduced in this module, resulting in a substantial reduction in the number of logic gates and a significant reduction in critical path delay.

[0050] The backward module receives the 8-bit result from the inverse module and performs the reverse transformation operation as the forward module: first, it transforms the data from the composite field GF((2) using another pre-computed 8×8 isomorphic inverse mapping matrix. 4 )²) mapping back to the finite field GF(2 8 Then, the backward affine transformation defined in the S-box of the encryption algorithm is performed to complete the full S-box permutation function.

[0051] The merging module pre-multiplies the backward affine transformation matrix output by the backward module with the inherent linear transformation L matrix in the round function, resulting in a merged total transformation matrix. In the hardware implementation, the output data of the S-box is directly linearly transformed through this merging matrix to obtain the final output of the T-transform in the round function. This module design eliminates the intermediate registers between the S-box and L-transform in traditional implementations, reducing the number of combinational logic stages and further lowering the overall critical path latency. The four modules are connected in series, with the output of the previous stage directly serving as the input of the next stage. The entire S-box optimization circuit is implemented using combinational logic, eliminating the need for additional pipeline registers and ensuring that the joint operation of the S-box transformation and linear transformation is completed within a single clock cycle. This S-box optimization circuit is applicable not only to the SM4 algorithm but also to encryption algorithms such as AES that are also based on finite field operations.

[0052] The S-box optimization circuit based on the above-mentioned composite domain arithmetic optimization and linear transformation merging in the embodiments of this application has the following beneficial effects: (1) It does not rely on block memory (BRAM), freeing up valuable on-chip storage resources; (2) The number of logic gates is reduced by more than 60% compared with the traditional lookup table implementation; (3) It reduces the critical path delay, which helps to improve the highest operating frequency of the system; (4) The circuit structure is regular, which is convenient for porting between different FPGA platforms.

[0053] Furthermore, in the round key expansion unit of this application embodiment, each stage of the expansion pipeline employs an algebraic S-box circuit. Compared to the S-box implemented using a lookup table in existing key expansion methods, this can further save BRAM resources and achieve a more unified resource utilization strategy. This algebraic S-box circuit is the same as that in the encryption unit, that is, the algebraic S-box circuit mainly consists of a cascaded forward module, an inversion module, and a backward module.

[0054] Furthermore, the round key expansion unit in this application embodiment adopts a cyclic key expansion structure (optimized to 4 rounds of cyclic expansion).

[0055] Furthermore, embodiments of this application verify the performance of the hardware accelerator architecture proposed in the above embodiments through simulation. Specifically, this includes:

[0056] Reference Model Construction: A gold reference model for the SM4 algorithm was implemented using MATLAB, generating encryption and decryption test vector sets. In the Modelsim simulation environment, module-level and system-level functional simulations were performed on the Verilog RTL code. The RTL simulation results were compared byte-by-byte with the MATLAB reference model output to verify functional correctness.

[0057] Pipeline verification: Input a continuous data stream stimulus, observe the simulation waveform, and verify whether there is a correct ciphertext output in each clock cycle after an initialization delay of 32 clock cycles.

[0058] Furthermore, in this embodiment, the EDA tools provided by the domestic FPGA platform are used to synthesize, place and route the hardware accelerator architecture of the SM4 algorithm, and the main performance indicators are shown in Table 1.

[0059] Table 1

[0060]

[0061] Based on the above test results, it can be seen that the hardware accelerator architecture proposed in this application significantly improves throughput: after adopting a dual 32-stage fully pipelined architecture, the throughput reaches 26.88Gbps, which is about 67 times higher than the traditional iterative architecture, meeting the needs of high-speed encryption applications such as 10 Gigabit Ethernet. The hardware accelerator architecture proposed in this application optimizes resource utilization: through composite domain arithmetic optimization, the S-box implementation no longer relies on BRAM, freeing up valuable block storage resources for other functions. Simultaneously, linear transformation merging optimization reduces the number of combinational logic stages, effectively controlling LUT resource usage. The hardware accelerator architecture proposed in this application has strong platform adaptability: the optimization method it adopts does not rely on primitives from specific FPGA vendors, has strong synthesization capabilities, and is easy to port to various domestic FPGA platforms, providing technical support for building an independent and controllable information security infrastructure.

[0062] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this application. It should be understood that the above description is only a specific embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A hardware accelerator architecture for an encryption algorithm, characterized in that, include: The encryption unit fully expands the N rounds of encryption algorithm operations and implements them in hardware as N independent, serially connected fully pipelined structures. Each stage contains the combinational logic circuits required for that round of operation, and a pipelined register is inserted at the output of each stage. In addition, a round key expansion unit is provided, which adopts an N-level full pipeline structure that is synchronized with the N-level main pipeline in the encryption unit. Each level generates the correct round key in advance or in real time for the corresponding main pipeline.

2. The hardware accelerator architecture for an encryption algorithm according to claim 1, characterized in that, Each main waterline in the encryption unit adopts an S-box optimization circuit based on composite domain arithmetic. The S-box optimization circuit is composed of four cascaded sub-modules: a forward module, an inversion module, a backward module, and a merging module. The forward module is located at the front end of the S-box optimization circuit. It first performs the forward affine transformation in the definition of the S-box, and then maps the 8-bit input data from the finite field to the composite field through a pre-computed isomorphic mapping matrix. The inversion module receives the 8-bit composite field data output by the forward module, splits it into two 4-bit high and low bit components, and performs an inversion operation on the composite field. The backward module receives the 8-bit result output by the inversion module. First, it maps the data from the composite domain back to the finite domain through a pre-calculated isomorphic inverse mapping matrix. Then, it performs the backward affine transformation defined in the S-box to complete the S-box permutation function. The merging module pre-multiplies the backward affine transformation matrix output by the backward module with the inherent linear transformation L matrix in the round function to obtain a merged total transformation matrix. The output data of the backward module is then directly passed through the total transformation matrix to obtain the final output result of the T transformation in the round function.

3. The hardware accelerator architecture for an encryption algorithm according to claim 2, characterized in that, The isomorphic mapping matrix is ​​pre-calculated using mathematical tools, and the matrix with the minimum Hamming weight and optimal circuit depth is selected.

4. The hardware accelerator architecture for an encryption algorithm according to claim 2, characterized in that, The inversion operation is implemented through a pre-computed logical expression, which consists of simple combinational logic gates.

5. A hardware accelerator architecture for an encryption algorithm according to any one of claims 1-4, characterized in that, Each stage of the expansion pipeline in the round key expansion unit employs an algebraic S-box circuit. The algebraic S-box circuit is the same as that in the encryption unit.

6. A hardware accelerator architecture for an encryption algorithm according to any one of claims 1-4, characterized in that, The round key expansion unit adopts a cyclic key expansion structure.

7. The hardware accelerator architecture for an encryption algorithm according to claim 5, characterized in that, The value of N is 32.

8. The hardware accelerator architecture for an encryption algorithm according to claim 5, characterized in that, The hardware accelerator architecture is suitable for either the SM4 or AES algorithms.

9. The hardware accelerator architecture for an encryption algorithm according to claim 5, characterized in that, The hardware accelerator architecture achieves a throughput of approximately 128 bits × clock frequency when processing continuous data streams.

10. A method for operating a hardware accelerator architecture for an encryption algorithm according to any one of claims 1-9, characterized in that, include: After the first data block is processed by the first-level main pipeline in the encryption unit, the first round of operation is completed after one clock cycle. The result is stored and sent to the second-level main pipeline. At this time, the second-level main pipeline starts to process the second round of operation of the first database, while the first-level main pipeline simultaneously receives and processes the first round of operation of the second data block. And so on. After an initialization delay of N clock cycles, the full pipeline structure of the encryption unit is filled. Subsequently, a new data block will begin encryption every clock cycle, and a fully encrypted data block will be output from the end of the pipeline structure. In each clock cycle, the extended pipeline in the round key extension unit generates the correct round key in advance or in real time for the corresponding main pipeline.

Images