Error detection apparatus for data encryption

Abstract

The present invention relates to an error detection device for data encryption. The device comprises: an encoding circuit; and an error checking circuit. The encoding circuit is arranged to implement an encryption algorithm, wherein the encryption algorithm comprises a plurality of rounds and in each round a round key is used to encode a plaintext or an intermediate encryption result. The error checking circuit is arranged to predict a redundancy data corresponding to the plaintext or the intermediate encryption result; and to issue an error signal to a processing unit when the intermediate encryption result and the redundancy data do not match at a specified intermediate point in the encryption process. By the above arrangement of the error checking circuit, the error detection can be accomplished by a circuit with less area than the encoding circuit.

Description

[0001] This application is a divisional application of Chinese invention patent application entitled "Error Detection Device for Data Encryption", filed on September 30, 2022, with application number 2022112074797. Technical Field

[0002] This invention relates to data encryption, and in particular, to an error detection device for data encryption. Background Technology

[0003] Since current storage devices (e.g., NAND flash memory) are commonly used to store system program code, application code, drivers, and user privacy data, data security is a critical issue. Advanced Encryption Standard (AES) is a block cipher standard currently adopted by the US federal government and has been widely validated and adopted. However, AES can be maliciously attacked during operation, causing the AES encoder to produce incorrect calculation results. Alternatively, defects in the chip manufacturing process may cause the AES encoder to produce unexpected calculation results after running for a period of time. Or, the storage device may be exposed to harsh environments, causing some components in the AES encoder to fail and produce unexpected calculation results. Incorrect encryption processes will render the original user data unrecoverable, resulting in significant losses. Therefore, this invention proposes a data encryption error detection device and method to prevent the writing of incorrectly encrypted data to the storage device. Summary of the Invention

[0004] In view of this, how to alleviate or eliminate the deficiencies in the aforementioned related areas is a problem that needs to be solved.

[0005] This invention relates to an error detection device for data encryption, comprising: an encoding circuit; and an error checking circuit. The encoding circuit is configured to implement an encryption algorithm, wherein the encryption algorithm comprises multiple rounds, and in each round, a round key is used to encode plaintext or an intermediate encryption result. The error checking circuit is configured to predict redundant data corresponding to the plaintext or intermediate encryption result; and when a mismatch is found between the intermediate encryption result and the redundant data at a designated intermediate point in the encryption process, it issues an error signal to a processing unit.

[0006] The present invention also relates to an error detection device for data encryption, comprising: a search circuit; and a substitution verification circuit. The search circuit is configured to convert a first value corresponding to a plaintext or intermediate encryption result of one byte into a second value according to a lookup table. The substitution verification circuit is configured to determine whether an error occurs during the conversion of the first value into the second value using a formula corresponding to the lookup table, and to issue an error signal when an error is detected.

[0007] One of the advantages of the above embodiments is that, by setting up the error checking circuit described above, error detection can be accomplished using a circuit with a smaller area than the encoding circuit.

[0008] Other advantages of the present invention will be explained in more detail below in conjunction with the accompanying drawings. Attached Figure Description

[0009] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application.

[0010] Figure 1 This is a system architecture diagram of an electronic device according to an embodiment of the present invention.

[0011] Figure 2 This is a schematic diagram of a flash memory module according to an embodiment of the present invention.

[0012] Figure 3 This is a high-order schematic diagram of an algorithm that uses a 128-bit key for 10 rounds.

[0013] Figure 4 This is a block diagram of an Advanced Encryption Standard (AES) encoder based on some implementation methods.

[0014] Figure 5 This is a block diagram of an AES encoder according to an embodiment of the present invention.

[0015] Figure 6 This is a schematic diagram of the body, the body parity check bit and the cross-body parity check 9 bits according to an embodiment of the present invention.

[0016] Figure 7 This is a schematic diagram of the little key, the parity check bits within the little key, and the 9-bit parity check across the little key according to an embodiment of the present invention.

[0017] Figure 8 This is a block diagram of an AES encoder according to an embodiment of the present invention.

[0018] Figure 9 This is a block diagram of an AES data processing circuit according to an embodiment of the present invention.

[0019] Figure 10 This is a block diagram of a parity prediction circuit according to an embodiment of the present invention.

[0020] Figure 11 This is a block diagram of the in vivo parity bit prediction circuit according to an embodiment of the present invention.

[0021] Figure 12 This is a block diagram of the in vivo parity bit generation circuit according to an embodiment of the present invention.

[0022] Figure 13 This is a block diagram of a cross-body parity check 9-bit prediction circuit according to an embodiment of the present invention.

[0023] Figure 14 This is a block diagram of an enhanced alternative byte circuit according to an embodiment of the present invention.

[0024] Figure 15 This is a block diagram of an enhanced lookup table circuit according to an embodiment of the present invention.

[0025] Figure 16 This is a block diagram of an alternative verification circuit according to an embodiment of the present invention.

[0026] Figure 17 This is a block diagram of an AES key scheduling circuit according to an embodiment of the present invention.

[0027] Figure 18 This is a block diagram of a key word processing circuit according to an embodiment of the present invention.

[0028] Figure 19 This is a block diagram of an alternative keyword circuit according to an embodiment of the present invention.

[0029] Figure 20 This is a schematic diagram of a constant-discarding circuit according to an embodiment of the present invention.

[0030] Figure 21 This is a block diagram of a key word processing circuit according to an embodiment of the present invention.

[0031] Explanation of reference numerals in the attached figures: 10 Electronic devices 110 Host 130 Flash Controller 131 Host Interface 132 bus 134 processing units 136 Random Access Memory 137 Advanced Encryption Standard Encoder 138 Direct Memory Access Controller 139 Flash Memory Interface 150 flash memory modules 151 interface 153#0~153#15 NAND flash memory cells Channels CH#0 to CH#3 CE#0~CE#3 Start Signal R#0 Initial Round Intermediate rounds of R#1~R#9 R#10 Final Round S310#1~S310#10 Replacement Byte Steps S320#1~S320#10 Displacement Steps S330#1~S330#9 Mixed Column Steps S340#1~S340#10 plus round key steps S350 Extended Key Steps w[0,3] Basic Key The expanded keys w[4,7], w[36,39], and w[40,43] 400 AES encoder 410, 430 AES encoding circuits 450 comparator 500 AES encoder 510 AES Encoding Circuit 530 Error Detection Circuit 550 Redundant Data Generation Circuit 570 Redundant Key Generation Circuit S0~S 15 body P0~P 15 In-body parity bits Q0~Q3 cross-body parity check 9 bits k0~k 31 small key R0~R 31 Parity bits within the small key V0~V7 cross-key parity check 9 bits 810 AES data processing circuit 813 Encoding Circuit 815 Coding Error Checking Circuit 830 AES Key Scheduling Circuit 833 Key Generation Circuit 835 Key Error Checking Circuit 850 or door 870 controller 912 Data Register 914 Parity Check Register 920 Enhanced Alternate Byte Circuit 930 displacement line circuit 940 Hybrid Column Circuit 950 plus round key circuit 960 Parity Check Circuit 970 Parity Prediction Circuit 980 multiplexer 1010 In-body Parity Bit Prediction Circuit 1030 Cross-body Parity Check 9-bit Prediction Circuit 1110 Internal Parity Bit Generation Circuit 1120 Displacement Line Prediction Circuit 1130 Hybrid Column Prediction Circuit 1140 Multiplexer 1150 plus round key prediction circuit 1160 displacement line circuit 1210 Multiplexer 1230 Internal mutually exclusive OR gate 1310 Cross-body parity byte generation circuit 1330 Cross-key parity byte segmentation circuit 1350 Cross-body Parity Byte Prediction Circuit 1370 Cross-body Parity Check 1-bit Prediction Circuit 1390 Cross-body Parity Check 9-bit Merging Circuit 1410 Cross-body parity check byte segmentation circuit Enhanced lookup table circuit 1430#0~1430#15 1450 Cross-body Parity Byte Merging Circuit 1510 Search Circuit 1530 Alternate Verification Circuit 1610 Calculation Circuit 1630 Multiplier 1650 comparator 1710 and 1750 key splitting circuits Registers 1712 and 1714 1720, 1730 Keyword Processing Circuit Mutually exclusive OR gates 1725, 1727, 1729 1742 and 1744 key parity check code generation circuits Registers 1752, 1754, 1782, and 1784 1762, 1764 Key Parity Check Circuit 1772 and 1774 Key Parity Prediction Circuits 1810 Keyword Segmentation Circuit 1820 Rotating Keyword Circuit 1830 Replacement Keyword Circuit 1840 Discarded Constant Circuit 1850 Keyword Merging Circuit 1860 Keyword Parity Generation Circuit 1870 Keyword Parity Prediction Circuit 1880 Keyword Cross-Parity Prediction Circuit 1890 Keyword Parity Check 9-bit Merging Circuit Enhanced lookup table circuit (1930#0~1930#3) 2010 Mutual Exclusion OR Gate 2110 Keyword Segmentation Circuit 2130 Replacement Keyword Circuit 2150 Keyword Merging Circuit 2160 Keyword Parity Check Generation Circuit 2180 Keyword Cross-Parity Prediction Circuit 2190 Keyword Parity Check 9-bit Merging Circuit Detailed Implementation The embodiments of the present invention will be described below with reference to the accompanying drawings. In these drawings, the same reference numerals denote the same or similar components or method flows.

[0032] It must be understood that the use of terms such as "comprising" or "including" in this specification is intended to indicate the presence of specific technical features, values, method steps, work processes, elements and / or components, but does not preclude the addition of more technical features, values, method steps, work processes, elements, components, or any combination thereof.

[0033] In this invention, terms such as "first," "second," and "third" are used to modify components in the claims and are not used to indicate a priority order, a prior relationship, or that one component precedes another, or the chronological order of the execution of method steps. They are only used to distinguish components with the same name.

[0034] It's important to understand that when a component is described as "connected" or "coupled" to another component, it can be a direct connection or coupling to other components, and there may be intermediate components. Conversely, when a component is described as "directly connected" or "directly coupled" to another component, there are no intermediate components. Other terms used to describe the relationship between components can be interpreted in a similar way, such as "between" versus "directly between," or "adjacent" versus "directly adjacent," and so on.

[0035] refer to Figure 1Electronic device 10 includes a host side 110, a flash memory controller 130, and a flash memory module 150, which can be collectively referred to as the device side. Electronic device 10 can be implemented in electronic products such as personal computers, laptop PCs, tablet computers, mobile phones, digital cameras, digital camcorders, smart TVs, smart refrigerators, and automotive electronic systems. The host interface 131 of the host side 110 and the flash memory controller 130 can communicate with each other using communication protocols such as Universal Serial Bus (USB), Advanced Technology Attachment (ATA), Serial Advanced Technology Attachment (SATA), Peripheral Component Interconnect Express (PCI-E), Universal Flash Storage (UFS), and Embedded Multi-Media Card (eMMC). The flash interface 139 of the flash controller 130 and the flash module 150 can communicate with each other using a Double Data Rate (DDR) communication protocol, such as Open NAND Flash Interface (ONFI), DDR Toggle, or other communication protocols. The flash controller 130 includes a processing unit 134, which can be implemented in various ways, such as using general-purpose hardware (e.g., a single processor, a multiprocessor with parallel processing capabilities, a graphics processor, or other processors with computing power), and provides the functions described later when executing software and / or firmware instructions. The processing unit 134 receives host commands, such as read commands, write commands, discard commands, and erase commands, through the host interface 131, and schedules and executes these commands.The flash memory controller 130 also includes random access memory (RAM) 136, which can be implemented as dynamic random access memory (DRAM), static random access memory (SRAM), or a combination of both, to configure space as a data buffer, storing host data read from host 110 and about to be written to flash memory module 150, and host data read from flash memory module 150 and about to be output to host 110. RAM 136 can also store data required during execution, such as variables, data tables, host-to-flash (H2F) tables, flash-to-host (F2H) tables, etc. The flash memory interface 139 includes a NAND flash controller (NFC) to provide functions required for accessing flash memory module 150, such as a command sequencer and low-density parity check (LDPC).

[0036] The flash memory controller 130 is configurable with a shared bus architecture 132 to couple components together for transmitting data, addresses, control signals, etc. These components include: a host interface 131, a processing unit 134, RAM 136, an Advanced Encryption Standard (AES) encoder 137, a Direct Memory Access (DMA) controller 138, and a flash memory interface 139. The DMA controller 138 can migrate data between components via the bus architecture 132 according to instructions from the processing unit 134. For example, it can move data from a specific data buffer in RAM 136 to a specific register in the AES encoder 137, and vice versa.

[0037] Flash module 150 provides a large storage space, typically hundreds of gigabytes (GB) or even multiple terabytes (TB), for storing large amounts of user data, such as high-resolution images and videos. Flash module 150 includes control circuitry and a memory array. The memory cells in the memory array can be configured after erasure as Single Level Cells (SLCs), Multiple Level Cells (MLCs), Triple Level Cells (TLCs), Quad-Level Cells (QLCs), or any combination thereof. Processing unit 134 writes user data to a specified address (destination address) in flash module 150 and reads user data from a specified address (source address) in flash module 150 via flash interface 139. Flash interface 139 uses multiple electronic signals to coordinate data and command transmission between flash controller 130 and flash module 150, including data lines, clock signals, and control signals. Data lines can be used to transmit commands, addresses, read data, and write data; control signal lines can be used to transmit control signals such as Chip Enable (CE), Address Latch Enable (ALE), Command Latch Enable (CLE), and Write Enable (WE).

[0038] refer to Figure 2The interface 151 in the flash memory module 150 may include four input / output channels (I / O channels) CH#0 to CH#3, each channel connecting four NAND flash memory cells. For example, channel CH#0 connects NAND flash memory cells 153#0, 153#4, 153#8, and 153#12, and so on. Each NAND flash memory cell may be packaged as an independent die. The flash memory interface 139 can send one of the start signals CE#0 to CE#3 through the interface 151 to start NAND flash memory cells 153#0 to 153#3, 153#4 to 153#7, 153#8 to 153#11, or 153#12 to 153#15. Then, user data is read from the started NAND flash memory cell or written to the started NAND flash memory cell in parallel. Those skilled in the art can modify the design of the flash memory module 150 according to the system requirements, configuring more or fewer channels in the flash memory module 150, and / or connecting more or fewer NAND flash memory cells to each channel, and the present invention is not limited thereto.

[0039] The AES encoder 137 implements a variant of the Rijndael algorithm, using fixed 128-bit blocks and a base key of 128, 192, or 256 bits. The AES encoder 137 operates on bytes of a 4×4 column-major ordered array, each byte called a state. Most AES computations are performed within a specific finite field. For example, 16 states S0, S1 to S2. 15 It can be represented by the following two-dimensional array:

[0040] The key size used in AES encryption determines the number of transformation rounds used to convert the input information (called plaintext) into the final output (called ciphertext). For example, a 128-bit key uses 10 rounds (n=10), a 192-bit key uses 12 rounds (n=12), and a 256-bit key uses 14 rounds (n=14). Each round contains several processing steps (or operations), including one step that depends on the encryption key itself. (See reference) Figure 3The diagram shows a high-order representation of the algorithm using a 128-bit key over 10 rounds. The algorithm uses step S350 (also known as AES key scheduling) to expand the key required for multiple rounds based on the 128-bit root key w[0,3]. The initial round includes step S340#0, which adds the round key by combining the corresponding byte from the root key w[0,3] with each entity using a bitwise XOR operation. The next nine rounds each include steps S310#i (substitute bytes), S320#i (shift rows), S330#i (mix columns), and S340#i (add the round key), where i is any positive integer between 1 and 9. Step S310#i is a non-linear substitution step that replaces the value of each entity with another value according to a lookup table (also known as a Rijndael S-box), which is constructed using the following formula: SB i =Affine((i) -1 ) SB i The output of `i` represents the result of `i`, where `Affine()` represents the Affine transformation function, and `i` is a positive integer from 0 to 127. Step S320#i is a swapping step, cyclically shifting each of the following three rows to the left or right by a specified number of steps. Step S330#i performs a linear mixing operation on columns, merging the four entities in each column. Step S340#i adds the round key, merging each entity with the corresponding bytes in the base key `w[i*4, i*4+3]` using a bit-by-bit XOR operation. The final round (i.e., the 10th round) contains steps S310#10, S320#10, and S340#10, which function similarly to steps S310#i, S320#i, and S340#i, respectively. Although Figure 3 Only the algorithm using a 128-bit key with 10 rounds is described. Those skilled in the art who understand the technical details of the algorithms using a 192-bit key with 12 rounds and a 256-bit key with 14 rounds can obtain them from the standard documents published by the National Institute of Standards and Technology (NIST).

[0041] Because errors can occur during AES encryption under conditions such as malicious attacks, chip defects, and harsh environments, potentially causing irrecoverable damage to user data. (Reference) Figure 4In some embodiments of the AES encoder 400, two identical AES encoding circuits 410 and 430 are included to implement the algorithm described above. The AES encoder 400 further includes a comparator 450, which receives the ciphertext C#1 of each subject from the AES encoding circuit 410 and the ciphertext C#2 of each subject from the AES encoding circuit 430, and compares whether they are the same. If they are the same, the comparator 450 outputs the ciphertext C#1 and a message indicating successful encryption. If they are different, the comparator 450 outputs a message indicating encryption failure, which notifies the firmware running in the processing unit that an error management procedure needs to be executed. However, the area of ​​the AES encoder 400 in the above embodiment is larger than the area of ​​the two AES encoding circuits, resulting in increased manufacturing costs.

[0042] To make the area of ​​the AES encoder smaller than the area of ​​two AES encoding circuits, from one perspective, refer to Figure 5 This invention proposes that, in addition to the AES encoding circuit 510 for implementing the algorithm described above, the AES encoder 500 also includes an error detection circuit 530, which has a smaller area than a complete AES encoding circuit 510, to detect whether errors have occurred during the encryption process. During the encryption process of each individual, the error detection circuit 530 uses less information than the 16 individuals and their respective round keys to determine whether an error has occurred throughout the encryption process. If no errors are determined, the error detection circuit 530 can output encryption success information. If an error is determined, the error detection circuit 530 outputs encryption failure information to notify the firmware running in the processing unit that an error management program needs to be executed.

[0043] The redundant data generation circuit 550 can be attached to 16 entities to allow the error detection circuit 530 to determine whether an error has occurred during the encryption process. This redundant data is a prediction result based on values ​​from the 16 entities, intermediate encryption results, or the AES encryption algorithm. (Reference) Figure 6 In some embodiments, the Redundant-data Generation Circuitry 550 can predict an in-state parity bit and append the in-state parity bit (as the 8th bit) after the body (bits 0-7). It should be noted that those skilled in the art should not interpret this appending operation as meaning that the 8-bit body and the 1-bit in-state parity bit are actually stored in a contiguous 9-bit space; different but equivalent data structures are permissible. For example, the Redundant-data Generation Circuitry 550 can predict the in-state parity bit P0 of body S0, predict the in-state parity bit P1 of body S1, and so on. The matching between the body and the corresponding in-state parity bit can be represented using the following example formula:

[0044] P i S represents the value of the parity check bit in the body of the i-th individual. i,j Let represent the value of the j-th bit in the i-th individual, where i is a positive integer from 0 to 15. When both sides of the formula are equal, it means that the i-th individual and its parity bit are matched. Otherwise, it means they are not matched. The redundancy data generation circuit 550 can predict an Across-state Parity 9-bit corresponding to the value of a body in each column and its parity bit within that body. For example, the redundancy data generation circuit 550 can predict the Across-state Parity 9-bit Q0 corresponding to body S0 and its parity bit P0, body S1 and its parity bit P1, body S2 and its parity bit P2, and body S3 and its parity bit P3, and so on. Matches between multiple bodies in each column and their parity bits and corresponding Across-state Parity 9-bits can be represented using the following example formula:

[0045] Q 0,j Q represents the value of the j-th bit of the 0th cross-body parity check 9-bit. 1,j Q represents the value of the j-th bit of the first cross-body parity check 9-bit. 2,j Q represents the value of the j-th bit of the second cross-body parity check (9 bits). 3,j S represents the value of the j-th bit of the 9-bit parity check of the third cross-body parity check. i,j This represents the value of the j-th bit in the i-th individual, where j is any integer from 0 to 8. The i-th cross-entity parity 9-bit is considered a match if each bit in the i-th cross-entity parity 9-bit is equal to the sum of the corresponding bits in the i-th column (or the result of a mutual exclusion OR operation). Otherwise, it indicates a mismatch.

[0046] In one respect, the AES encoding circuit 510 and the redundancy data generation circuit 550 operate independently and in parallel, without exchanging data or information between them. The redundancy data generation circuit 550 uses a redundancy data update algorithm to generate predicted redundancy data, which is derived from the AES encryption algorithm. This ensures that the intermediate encryption results generated by the AES encoding circuit 510 and the redundancy data predicted by the redundancy data generation circuit 550 maintain a specified mathematical relationship at each specific intermediate point in the plaintext encryption process, provided no errors occur.

[0047] The Redundant-key Generation Circuitry 570 appends redundant data to each base key or round key to allow the Error Detection Circuitry 530 to determine whether errors occurred during key generation. This redundant data is a prediction based on the values ​​in the base key or round key and the AES key scheduling algorithm. (Reference) Figure 7 Taking a 256-bit base key as an example, the redundant key generation circuit 570 can first divide the base key into 32 bytes (each byte can be called a subkey) and organize them into an 8-column, 4-row matrix. The redundant key generation circuit 570 can predict the in-subkey parity bit and append it (as the 8th bit) to the subkey (bits 0-7). It is important to note that those skilled in the art should not interpret this appending operation as meaning that the 8-bit subkey and the 1-bit subkey parity bit are actually stored in a continuous 9-bit space; different but equivalent data structures are allowed. For example, the redundant key generation circuit 570 can predict the subkey parity bit R0 of subkey k0, predict the subkey parity bit R1 of subkey k1, and so on. The matching between the subkey and the subkey parity bit can be represented by the following example formula:

[0048] R i k represents the value of the parity bit within the i-th subkey. i,j Let represent the value of the j-th bit in the i-th subkey, where i is a positive integer from 0 to 15. When both sides of the formula are equal, it means the i-th subkey and its parity bit match. Otherwise, it means they do not match. The redundant key generation circuit 570 can predict an Across-subkey parity 9-bit corresponding to the value of the subkey in each column and its parity bit. For example, the redundant key generation circuit 570 can predict the Across-subkey parity 9-bit V0 corresponding to subkey k0 and its parity bit R0, subkey k1 and its parity bit R1, subkey k2 and its parity bit R2, and subkey k3 and its parity bit R3, and so on. Matches between multiple subkeys and their parity bits and corresponding Across-subkey parity 9-bits in each column can be represented using the following example formula:

[0049] V 0,j V represents the value of the j-th bit of the 0th cross-key parity 9-bit bit. 1,jV represents the value of the j-th bit of the first cross-key parity check (9 bits). 2,j V represents the value of the j-th bit of the second cross-key parity check (9 bits). 3,j V represents the value of the j-th bit of the 9-bit parity check of the third cross-key. 4,j V represents the value of the j-th bit of the 4th cross-key parity check (9 bits). 5,j V represents the value of the j-th bit of the 5th cross-key parity check (9 bits). 6,j V represents the value of the j-th bit of the 6th cross-key parity 9-bit sequence. 7,j k represents the value of the j-th bit of the 7th cross-key parity 9-bit sequence. i,j This represents the value of the j-th bit in the i-th subkey, where j is any integer from 0 to 8. A subkey in the i-th cross-subkey parity 9-bit pair is considered to match the i-th column's subkey and its parity bits if each bit equals the sum of the corresponding bits in the i-th column (or the result of a mutual exclusion OR operation). Otherwise, it indicates a mismatch.

[0050] In one respect, the AES encoding circuit 510 and the redundant key generation circuit 570 operate independently and in parallel, without exchanging data or information between them. The redundant key generation circuit 570 uses a redundant key update algorithm to generate predicted redundant data, which is derived from the AES key scheduling in the AES encryption algorithm. This ensures that the round key generated by the AES encoding circuit 510 and the redundant data predicted by the redundant key generation circuit 570 can maintain the specified mathematical relationship at each specific intermediate point in the round key generation process, without errors.

[0051] Although Figure 5 The AES encoding circuit 510, error detection circuit 530, redundant data generation circuit 550, and redundant key generation circuit 570 are represented by different blocks, but this is only for the purpose of making it easier for the reader to understand. Those skilled in the art can integrate the AES encoding circuit 510, error detection circuit 530, redundant data generation circuit 550, and redundant key generation circuit 570 together in an appropriate manner in actual implementation, and the present invention is not limited thereto.

[0052] From another perspective, reference Figure 8 This invention proposes to include an AES data processing circuitry 810 and an AES key scheduling circuitry 830 in the AES encoder 137. The AES key scheduling circuitry 830 includes a key generation circuitry 833, used to perform tasks such as... Figure 3 The extended key step S350 is shown. The controller 870 sends a control signal to the AES key scheduling circuit 830 to drive the AES key scheduling circuit 830 to perform the key extension based on the base key K0 or the previous round key K. i Generate a new round key and output the round key K for the specified round. i The corresponding redundant data (e.g., parity bits R within the minor key and 9-bit parity across minor keys V) are fed to the AES data processing circuit 810. The AES key scheduling circuit 830 includes a key error checking circuit 835 configured to calculate the redundant data corresponding to each round key; and to issue an error signal ERR_KEY=1 if any round key and its corresponding redundant data do not match at a specified intermediate point in the key expansion process. The round key can be divided into 16 minor keys and organized as a 4×4 byte array, with each minor key being 1 byte; the redundant data includes parity bits within the minor key corresponding to each minor key and 9-bit parity across minor keys corresponding to each column. The key error checking circuit 835 issues an error signal ERR_KEY=1 if it finds at a specified intermediate point in the key expansion process that any minor key does not match the corresponding minor key's parity bits, or if it finds that the minor key corresponding to any column, plus 4 corresponding minor key parity bits, does not match the corresponding 9-bit parity across minor keys.

[0053] The AES data processing circuit 810 includes an encoding circuit 813, configured to achieve, for example Figure 3The AES algorithm shown includes the substitution byte step S310, row shifting step S320, column mixing step S330, and round key addition step S340. The AES algorithm comprises multiple rounds, each used to encode the plaintext or intermediate encryption result using the round key. The controller 870 sends control signals to the AES data processing circuit 810 to drive the AES data processing circuit 810 to arrange the execution order of the above steps according to the round settings of the AES algorithm. The AES data processing circuit 810 includes an encoding error checking circuit 815, configured to calculate redundant data corresponding to the plaintext or intermediate encryption result; if a mismatch is found between the intermediate encryption result and the redundant data at a specified intermediate point in the encryption process, an encoding error signal ERR_ENC=1 is issued. The plaintext can be divided into 16 parts and organized as a 4×4 array, each part being 1 byte. The redundant data includes parity bits within each part and 9 cross-part parity bits corresponding to each column in the plaintext. When the encoding error checking circuit 815 detects at a specified time point in the encryption process that the intermediate encryption result of any body does not match the parity bit of the corresponding body, or detects that the intermediate encryption result corresponding to any column of the plaintext plus 4 parity bits of the corresponding body does not match the corresponding cross-body parity 9 bits, it issues an encoding error signal ERR_ENC=1.

[0054] OR gate 850 is coupled to the output of encoding error checking circuit 815 and key error checking circuit 835. When encoding error checking circuit 815 outputs encoding error signal ERR_ENC=1 and / or key error checking circuit 835 outputs key error signal ERR_KEY=1, OR gate 850 outputs AES error signal ERR_AES=1 to processing unit 134.

[0055] refer to Figure 9 The block diagram shown is of the AES data processing circuit 810. The data register 912 stores the 16-byte (128-bit) intermediate or final result generated during the AES encryption process, while the parity registers 914 store the body parity bits and the cross-body parity 9 bits corresponding to the 16-byte intermediate or final result generated during the AES encryption process. The shift-row circuitry 930 is used to perform... Figure 3 The displacement row step S320 is shown, and its structure is well known to those skilled in the art, and will not be described in detail for the sake of simplicity. The Mix-column Circuitry 940 is used to perform the following... Figure 3The steps of the hybrid column shown in step S330, and whose structure is well known to those skilled in the art, will not be described in detail for the sake of simplicity. Add-round-key circuitry 950 is used to perform the following... Figure 3 The step S340 of adding the round key is shown, and its structure is well known to those skilled in the art, and will not be described in detail for the sake of brevity.

[0056] The controller 870 can send a selection signal R_sel to the multiplexer 980 and the parity prediction circuitry 970 in each round to control the data flow through the designated circuit. The multiplexer 980 includes three inputs I0, I1, and I2 and one output O. Input I0 is coupled to the input pin of the AES encoder 137 to receive 16 bytes of plaintext; input I1 is coupled to the output of the hybrid column circuit 940 to receive 16 bytes of computation result; input I2 is coupled to the output of the shift row circuit 930 to receive 16 bytes of computation result; and output O is coupled to the input of the round-adding key circuit 950. Specifically, in the initial round, the controller 870 can use the control signal R_sel to control the multiplexer 980 to connect input I0 to output O, so that the 16 bytes of plaintext S received from the input pin of the AES encoder 137 can be fed into the round-adding key circuit 950. In intermediate rounds (e.g., rounds 1 through 13 using a 256-bit key), controller 870 can use control signal R_sel to control multiplexer 980 to connect input I1 to output O, allowing the output of hybrid column circuit 940 to be fed into round key circuit 950. In the final round (e.g., round 14 using a 256-bit key), controller 870 can use control signal R_sel to control multiplexer 980 to connect input I2 to output O, allowing the output of shift row circuit 930 to be fed into round key circuit 950. Furthermore, in the initial round, controller 870 can use control signal R_sel to control parity prediction circuit 970, allowing the 16-byte plaintext S received from the input pin of AES encoder 137 to be fed into parity prediction circuit 970 to generate body parity bits P and cross-body parity 9 bits Q corresponding to the plaintext. In the intermediate and final rounds, the controller 870 can use the control signal R_sel to control the parity prediction circuit 970, allowing the output of the enhanced alternative byte circuit 920 to be fed into the parity prediction circuit 970 to generate the body parity bit P and the cross-body parity 9 bit Q corresponding to the intermediate encryption result.

[0057] refer to Figure 10The block diagram shown is of the parity prediction circuit 970. The parity prediction circuit 970 includes an in-state parity-bit prediction circuitry 1010 and an across-state parity-9-bit prediction circuitry 1030. The in-state parity-bit prediction circuitry 1010 selects either the input plaintext S (corresponding to the initial round) or the intermediate encryption result S' (corresponding to the intermediate or final round) based on the control signal R_sel, and generates the in-state parity bit P based on the plaintext S / intermediate encryption result S' and the parity bit R within the small key. The across-state parity-9-bit prediction circuitry 1030 selects either the input plaintext S (corresponding to the initial round) or the intermediate encryption result S' (corresponding to the intermediate or final round) based on the control signal R_sel, and generates the across-state parity-9-bit Q based on the plaintext S / intermediate encryption result S' and the across-state parity-9-bit V across the small key.

[0058] refer to Figure 11The block diagram shown is of the in-body parity bit prediction circuit 1010. The controller 870 can issue a selection signal R_sel to the multiplexer 1140 and the in-body parity bit generation circuit 1110 in each round to control the data flow through the specified circuit. The multiplexer 1140 includes three inputs I0, I1, and I2 and one output O. Input I0 is coupled to the output of the in-body parity bit generation circuit 1110 to receive the 16-bit in-body parity code corresponding to the plaintext; input I1 is coupled to the output of the mixed column prediction circuit 1130 to receive the 16-bit result; input I2 is coupled to the output of the shifted row prediction circuit 1120 to receive the 16-bit result; and output O is coupled to the input of the plus-round key prediction circuit 1150. In detail, in the initial round, the controller 870 can use the control signal R_sel to drive the internal parity bit generation circuit 1110 to receive 16 bytes of plaintext from the input pin of the AES encoder 137, and the control multiplexer 1140 connects the input terminal I0 to the output terminal O, so that the 16-bit internal parity code corresponding to the plaintext S received from the output of the internal parity bit generation circuit 1110 can be fed into the round-adding key prediction circuit 1150. In the intermediate rounds (e.g., rounds 1 to 13 using a 256-bit key), the controller 870 can use the control signal R_sel to drive the internal parity bit generation circuit 1110 to obtain 16 bytes of intermediate encryption result S' from the data register 912, and the control multiplexer 1140 connects the input terminal I1 to the output terminal O, so that the 16-bit internal parity code corresponding to the intermediate encryption result S' received from the output of the mixed column prediction circuit 1130 can be fed into the round-adding key prediction circuit 1150. In the final round (e.g., the 14th round using a 256-bit key), the controller 870 can use the control signal R_sel to drive the body parity bit generation circuit 1110 to obtain a 16-byte intermediate encryption result S' from the data register 912, and the control multiplexer 1140 connects the input I2 to the output O, so that the 16-bit body parity code corresponding to the intermediate encryption result S' received from the output of the shifted row prediction circuit 1120 can be fed into the plus round key prediction circuit 1150.

[0059] refer to Figure 12The block diagram shown is of the in-body parity bit generation circuit 1110. The controller 870 can issue a selection signal R_sel to the multiplexer 1210 in each round to control the data flow through the specified circuit. The multiplexer 1210 includes two inputs I0 and I1 and one output O. Specifically, in the initial round, the controller 870 can use the control signal R_sel to control the multiplexer 1210 to connect input I0 to output O, so that the 16 bytes of plaintext S received from the input pin of the AES encoder 137 can be fed into the in-body mutex OR gate 1230. In intermediate and final rounds (e.g., rounds 1 through 14 using a 256-bit key), the controller 870 can use the control signal R_sel to control the multiplexer 1210 to connect input I1 to output O, so that the 16 bytes of intermediate encrypted result S' obtained from the data register 912 can be fed into the in-body mutex OR gate 1230. The internal mutex OR gate 1230 contains multiple mutex OR gates, arranged to generate, based on the received 16-byte plaintext S or the intermediate encrypted result S', such as Figure 6 The in vivo parity bits P0 to P1 are shown. 15 .

[0060] Reference Figure 11 The plaintext S or the intermediate encrypted result S' is organized as a 4×4 array. The row shifting circuit 1160 is used to cyclically shift each of the following three rows to the left by a specified number of steps. For example, the plaintext S is represented as follows:

[0061] The row displacement circuit 1160 is used to cyclically shift the first row to the left by one volume, the second row to the left by two volumes, and the third row to the left by three volumes. The displacement results are shown below:

[0062] The parity byte corresponding to the plaintext S or the intermediate encrypted result S' is organized into a 4×4 bit array. The shift row prediction circuit 1120 is used to cyclically shift each of the following three rows to the left by a specified number of steps. For example, the parity bit representation corresponding to the plaintext S is as follows:

[0063] The row shift prediction circuit 1120 is used to cyclically shift the first row to the left by one bit, the second row to the left by two bits, and the third row to the left by three bits. The shift results are shown below:

[0064] The hybrid column prediction circuit 1130, coupled with the outputs of the shift row prediction circuit 1120 and the shift row circuit 1160, uses 16 formulas known to those skilled in the art to sum the values ​​of a specified portion of a 4×4 byte array of the shifted plaintext S or intermediate encrypted result S' and a 4×4 bit array of the shifted body parity bits, to produce a specified value in the matrix of hybrid body parity bits.

[0065] The round key prediction circuit 1150 calculates the encrypted result of the parity bits in the body using the following formula: P (out) i =P (in) i +R i P (out) i P represents the parity check bit of the i-th individual in the output. (in) i R represents the parity check bit of the i-th individual in the input. i This represents the parity check bit within the i-th subkey, where i is any integer from 0 to 15. Note that P in this case... (in) i and P (out) i The position in the matrix that corresponds to the position refers to the position in the matrix output by the hybrid column prediction circuit 1130, not the position in the matrix output by the body parity bit generation circuit 1110.

[0066] refer to Figure 13 The block diagram shown is of the cross-parity 9-bit prediction circuit 1030. The controller 870 can issue a selection signal R_sel to the cross-parity byte generation circuit 1310 in each round to control the data stream input to the cross-parity byte generation circuit 1310. Specifically, in the initial round, the controller 870 can use the control signal R_sel to drive the cross-parity byte generation circuit 1310 to receive 16 bytes of plaintext from the input pin of the AES encoder 137, causing the cross-parity byte generation circuit 1310 to generate cross-parity bytes based on the 16 bytes of plaintext S. In an intermediate round (e.g., rounds 1 through 13 using a 256-bit key) or a final round (e.g., round 14 using a 256-bit key), the controller 870 can use the control signal R_sel to drive the cross-body parity byte generation circuit 1310 to obtain a 16-byte intermediate encryption result S' from the data register 912, so that the cross-body parity byte generation circuit 1310 generates a cross-body parity byte based on the 16 bytes of the intermediate encryption result S'.

[0067] The cross-body parity byte generation circuit 1310 includes multiple mutually exclusive OR gates, arranged in the initial round to perform the following based on the received 16 bytes of plaintext S: Figure 6 The cross-body parity byte shown (excluding the 8th bit corresponding to the in-body parity bit) Q 0,0..7 To Q 3,0..7 In the intermediate or final round, the received 16-byte intermediate encryption result S' is arranged, and the cross-body parity byte (excluding the 8th bit corresponding to the body parity bit) Q is calculated using the following formula. 0,0..7 To Q 3,0..7 :

[0068] Q 0,j To Q 3,j S' represents the value of the j-th bit of the 0th to 3rd cross-body parity byte, respectively. 0,j To S' 15,j These represent the values ​​of the j-th bits in the intermediate encryption results from the 0th to the 15th bit.

[0069] The Across-subkey Parity-byte Split Circuitry 1330 removes the 8th bit of each of the 9 cross-subkey parity-byte bits to form a cross-subkey parity-byte, and feeds the cross-subkey parity-byte into the cross-subkey parity-byte prediction circuitry 1350.

[0070] The cross-body parity byte prediction circuit 1350 uses the following formula to calculate the prediction result for each cross-body parity byte:

[0071] Q (out) 0,j Q represents the value of the j-th bit of the 0th parity byte in the output. (out) 1,j Q represents the value of the j-th bit of the first cross-body parity byte in the output. (out) 2,j Q represents the value of the j-th bit of the second cross-body parity byte in the output. (out) 3,j Q represents the value of the j-th bit of the third cross-body parity byte in the output. (in) i,j V represents the value of the j-th bit of the i-th cross-body parity byte in the input. i,j This represents the value of the j-th bit in the i-th cross-key parity byte.

[0072] The 1370 cross-body parity 1-bit prediction circuit uses the following formula to calculate the prediction result of the 8th bit of each cross-body parity 9-bit circuit:

[0073] Q 0,8 The value of Q represents the 8th bit of the 9-bit parity check in column 0. 1,8 The value of Q represents the 8th bit of the 9-bit parity check of the first column. 2,8 The value of Q represents the 8th bit of the 9-bit parity check in the second column. 3,8 P represents the value of the 8th bit of the 9-bit parity check in the 3rd column. i,8 This represents the value of the parity check bit (i.e., the 8th bit) corresponding to the i-th individual.

[0074] The Across-state Parity-9-bit Concatenation Circuit 1390 appends the corresponding 8th bit output from the Across-state Parity 1-bit Concatenation Circuit 1370 to each cross-state parity byte output from the Across-state Parity Byte Prediction Circuit 1350 to form a complete Across-state Parity 9-bit.

[0075] Reference Figure 9 The parity check circuitry 960 checks whether an error occurred in the execution result of the previous round. The parity check circuitry 960 obtains the intermediate encryption result S' from the data register 912 and the body parity bit P and cross-body parity 9-bit Q corresponding to the intermediate encryption result S' from the parity code register 914. The parity check circuitry 960 determines whether the intermediate encryption result S' and the body parity bit P match. If they do not match, it sends a linear error signal err_L=1 to the processing unit 134, causing the processing unit 134 to execute any management procedures in response to AES encryption errors. The parity check circuitry 960 also determines whether the intermediate encryption result S', the intermediate body parity bit P, and the cross-body parity 9-bit Q match. If they do not match, it sends a linear error signal err_L=1 to the processing unit 134.

[0076] The Enhanced Substitute-byte Circuitry 920, in addition to completing the byte substitution step S310 in the algorithm, also checks whether the result of this step is correct. (Reference) Figure 14The block diagram shown is of the enhanced byte substitution circuit 920. The cross-byte parity check segmentation circuit 1410 obtains the 128-bit intermediate result S' from the data register 912, segments it into 16 bytes, and feeds these 16 bytes into the enhanced lookup table circuits 1430#0 to 1430#15 respectively. Each of the enhanced lookup table circuits 1430#0 to 1430#15 completes the byte substitution step S310 and determines whether the operation is correct. If any of the enhanced lookup table circuits 1430#0 to 1430#15 finds an error, it outputs a non-linear error signal err_nl_i = 1, where i is a positive integer from 0 to 15. Whenever any enhanced lookup table circuit outputs a non-linear error signal err_nl_i, the enhanced byte substitution circuit 920 outputs a non-linear error signal err_nL = 1 to the processing unit 134, causing the processing unit 134 to execute any management procedures in response to AES encryption errors. The cross-byte parity check merging circuit 1450 collects the lookup results from the enhanced lookup table circuits 1430#0 to 1430#15 and outputs the converted 128 bits to the shift row circuit 930.

[0077] refer to Figure 15 The block diagram shown is for the enhanced lookup table circuit 1430#i, where i is a positive integer from 0 to 15. The search circuit 1510 retrieves the input byte S' according to the lookup table described above. (in) Convert to 1 byte S' (out) The substitution check circuitry 1530 receives the converted byte S' from the search circuitry 1510. (out) And use the formula corresponding to the lookup table to determine S' (in) Convert to S' (out) The process checks whether an error occurred. If an error is detected, the replacement verification circuit 1530 outputs a non-linear error signal err_nl_i=1.

[0078] refer to Figure 16 The block diagram of the substitution verification circuit 1530 is shown. The calculation circuit 1610 obtains the converted byte S' from the search circuit 1510. (out) i Calculate Affine(S' (out) i ) -1 Affine() -1 This represents the inverse function of the Affine transformation, and the result is output to multiplier 1630 and comparator 1650. Multiplier 1630 will convert S' (in) Ride on Affine (S' (out) i ) -1To produce S' (mul) The comparator 1650 implements the following logical expression to produce a judgment result: err_nl_i=0, if (S' (mul) i ==1) && (S' (in) i !=0)&&(Affine(S' (out) i ) -1 !=0) err_nl_i=0, if (S' (mul) i ==0)&&(S' (in) i ==0)&&(Affine(S' (out) i ) -1 ==0) err_nl_i=1, otherwise When err_nl_i equals 1, it indicates that a nonlinear error signal has occurred.

[0079] Data register 912, search circuit 1510, row shifting circuit 930, mixed column circuit 940, multiplexer 980, and round key addition circuit 950 can be considered as AES encoding circuits. Parity check code register 914, substitution check circuit 1530, parity check circuit 960, and parity prediction circuit 970 can be considered as error checking circuits.

[0080] refer to Figure 17 The block diagram shown is of the AES key scheduling circuit 830. The key splitting circuit 1750 splits the 256-bit base key K0 into two keys K#0 and K#1, each key word being 128 bits long, the same as the length of a single entity. The key parity generation circuitry 1742 contains multiple mutually exclusive OR gates arranged to generate a parity check code based on the received key K#0, such as... Figure 7 The parity bits R0 to R1 in the small key shown are shown. 15 (collectively referred to as R#0), and 9 bits V0 to V3 (collectively referred to as V#0) for parity checking across the small key, and the parity bits R#0 within the small key and the 9 bits V#0 for parity checking across the small key are stored in register 1752. The key parity code generation circuit 1744 includes multiple mutually exclusive OR gates arranged to generate, based on the received key K#1, a parity code as follows: Figure 7 The parity bit R in the small key shown 16 To R 31(collectively referred to as R#1), and 9 bits of parity check across the small key, V4 to V7 (collectively referred to as V#1), and the parity check bits within the small key R#1 and the 9 bits of parity check across the small key V#1 are stored in register 1754. Registers 1752 and 1754 can also be called Current Cycle Parity Registers.

[0081] Key parity check circuits 1762 and 1764 check whether errors occurred in the generation of keys K#0 and K#1, respectively. Key parity check circuit 1762 obtains key K#0 from key splitting circuit 1750, and obtains the parity bit R#0 within the minor key and the 9-bit parity bit V#0 across the minor key corresponding to key K#0 from register 1752. Key parity check circuit 1762 determines whether key K#0 and the parity bit R#0 within the minor key match; if they do not match, it issues a key error signal err_kc=1. Key parity check circuit 1762 also determines whether key K#0, the parity bit R#0 within the minor key, and the 9-bit parity bit V#0 across the minor key match; if they do not match, it issues a key error signal err_kc=1. The key parity check circuit 1764 obtains the key K#1 from the key splitting circuit 1750, and obtains the parity bit R#1 within the minor key and the 9-bit parity check across the minor key V#1 corresponding to the key K#1 from the register 1754. The key parity check circuit 1764 determines whether the key K#1 and the parity bit R#1 within the minor key match. If they do not match, it issues a key error signal err_kd=1. The key parity check circuit 1764 also determines whether the key K#1, the parity bit R#1 within the minor key, and the 9-bit parity check V#1 across the minor key match. If they do not match, it issues a key error signal err_kd=1. The key error signal err_kc=1 or err_kd=1 can trigger the processing unit 134 to execute any management procedures in response to AES key errors.

[0082] The 1710 key splitting circuit divides the 256-bit base key K0 into 8 key words W. 0,0 To W 0,3 and W 1,0 To W 1,3 Each key word is 4 bytes long, and 8 key words are stored in register 1712. The key word processing circuit 1720 processes the key words based on the last key word W. 1,3 This produces an intermediate result of a key operation, which is then used in conjunction with the first key W. 0,0Perform a bitwise logical XOR operation to generate the first key word W of key K#2. 2,0 In addition to generating intermediate calculation results, the key processing circuit 1720 can also check whether an error occurred during the generation of the intermediate calculation results. If so, the key processing circuit 1720 outputs a key error signal err_ka=1. The key error signal err_ka=1 can trigger the processing unit 134 to execute any management procedures in response to AES key errors.

[0083] refer to Figure 18 The block diagram shown is of the key word processing circuit 1720. The key word segmentation circuit 1810 reads the last key word W from register 1712. 1,3 The key is divided into four smaller keys, each 1 byte in size. The Rotate-WordCircuitry 1820 shifts these four smaller keys cyclically to the left by one smaller key. The Substitute-WordCircuitry 1830 replaces the value of each shifted smaller key with another value according to a lookup table (also known as a Rijndael S-box), where the lookup table is constructed using the following formula: SB i =Affine((i) -1 ), for i=0~127 SB i The output represents the value of i, where Affine() represents the Affine conversion function, and i is a positive integer from 0 to 127. In addition to converting the value of each input byte, the replacement key circuit 1830 also checks whether the conversion result is correct.

[0084] refer to Figure 19 The block diagram shown is of the substitution key circuit 1830. Each of the enhanced lookup table circuits 1930#0 to 1930#3 performs the substitution operation of the corresponding byte value and determines whether the operation is correct. If any of the enhanced lookup table circuits 1930#0 to 1930#3 finds an error, it outputs a lookup error signal err_w_i=1, where i is a positive integer from 0 to 3. Whenever any enhanced lookup table circuit outputs the lookup error signal err_w_i, the substitution key circuit 1830 outputs a key error signal err_ka=1 to the processing unit 134, causing the processing unit 134 to execute any management procedures in response to AES encryption errors. Since the circuit structure, function, and operational details of any of the enhanced lookup table circuits 1930#0 to 1930#3 are similar to those of enhanced lookup table circuit 1430#i, the reader can refer to... Figure 15 and Figure 16The description will not be repeated for the sake of brevity.

[0085] Reference Figure 18 The Round-Constant Circuitry 1840 discards the key w#0. (in) Perform a bit-by-bit mutually exclusive OR (XOR) operation with the constant C. (See reference) Figure 20 The diagram shows a 1840 constant discarding circuit. The XOR gate 2010 sets the key word w#0. (in) Each bit of the constant C and the corresponding bit of the constant C perform a logical mutual exclusion OR operation.

[0086] The Word Concatenation Circuitry 1850 obtains four smaller keys w#0 to w#3 from the constant discarding circuitry 1840, and merges these smaller keys w#0 to w#3 into the complete key word W. (out) And output the key W (out) To mutually exclusive OR gate 1725.

[0087] The Word Parity Generation Circuitry 1860 includes an intra-key parity generation circuit and a cross-key parity generation circuit. The intra-key parity generation circuit contains multiple mutually exclusive OR gates arranged to generate four intra-key parity bits rt10 to rt13 based on the keys w#0 to w#3 received from the substitution key circuitry 1830. The cross-key parity generation circuit contains multiple mutually exclusive OR gates arranged to generate one cross-key parity byte vt1 based on the keys w#0 to w#3 received from the substitution key circuitry 1830. 0..7 .

[0088] The Word Parity Prediction Circuitry 1870 includes intra-key parity prediction circuitry and cross-key parity prediction circuitry. The intra-key parity prediction circuitry predicts the parity bits rt10 within the key using the following formula. (out) And the output is sent to the Word Cross-parity Prediction Circuit 1880 and the Key Parity Prediction Circuit 1772:

[0089] rt10 (out) Represents the parity check bit within the 0th subkey after calculation, rt10 (in)C represents the parity bit within the 0th small key received from the key parity generation circuit 1860. i This represents the i-th bit of the constant C used in the discard constant circuit 1840. Furthermore, the intra-key parity prediction circuit directly outputs the intra-key parity bits rt11 to rt13 received from the key word parity generation circuit 1860 to the key word cross-parity prediction circuit 1880 and the key parity prediction circuit 1772. The cross-key parity prediction circuit predicts the cross-key parity byte using the following formula and outputs it to the key word parity 9-bit concatenation circuit 1890: vt1 0..7 (out) =vt1 0..7 (in) +C vt1 0..7 (out) The output parity byte across the small key, vt1 0..7 (in) C represents the parity byte across the small key received from the key parity generation circuit 1860, and C represents the constant used in the discard constant circuit 1840.

[0090] The key-cross parity prediction circuit 1880 uses the following formula to calculate the last bit of the 9-bit parity vt across the small key:

[0091] vt18 represents the last bit of the 9-bit parity check VT across the small key, rt1 i This represents the parity check bit within the i-th subkey.

[0092] The 9-bit parity merging circuit 1890 combines the results of the parity prediction circuit 1870 with the result VT1. 0..7 The calculation result VT18 of the key word cross-parity prediction circuit 1880 is combined to become the 9-bit cross-parity VT1. 0..8 And output to the key parity check circuit 1772.

[0093] Reference Figure 17 The key processing circuit 1730 calculates the result of the operation of the mutex OR gate 1727 (that is, the key W). 2,3 This produces an intermediate result of a key operation, which is then used in conjunction with the key W. 1,0 Perform a bit-by-bit logical mutual exclusion OR operation to generate the first key word W of key K#3. 3,0In addition to generating intermediate calculation results, the key processing circuit 1730 can also check whether an error occurred during the generation of the intermediate calculation results. If so, the key processing circuit 1730 outputs a key error signal err_kb=1. The key error signal err_kb=1 can trigger the processing unit 134 to execute any management procedures in response to AES key errors.

[0094] refer to Figure 21 The block diagram shown is of the key word processing circuit 1730. The key word segmentation circuit 2110 reads the operation result (i.e., the key word W) from the mutex OR gate 1727. 2,3 The key replacement circuit 2130 replaces the value of each byte with another value according to a lookup table, which is constructed using the following formula: SB i =Affine((i) -1 ), for i=0~127 SB i The output value represents `i`, where `Affine()` represents the Affine conversion function, and `i` is a positive integer from 0 to 127. In addition to converting the value of each input byte, the substitution key circuit 2130 also checks the correctness of the conversion result. Since the circuit structure, function, and operation results of the substitution key circuit 2130 are similar to those of the substitution key circuit 1830, readers can refer to... Figure 15 , Figure 16 and Figure 19 The description is omitted for brevity. Whenever any of the enhanced lookup table circuits in the replacement key circuit 2130 outputs a lookup error signal err_w_i, the replacement key circuit 2130 outputs a key error signal err_kb=1 to the processing unit 134, causing the processing unit 134 to execute any management procedures in response to AES encryption errors.

[0095] Key merging circuit 2150 obtains the four substituted keys w#0 to w#3 from key merging circuit 2130, and merges the keys w#0 to w#3 into the complete key W. (out) And output the key W (out) To mutually exclusive OR gate 1729.

[0096] The key parity generation circuit 2160 includes an intra-key parity generation circuit and a cross-key parity generation circuit. The intra-key parity generation circuit includes multiple mutually exclusive OR gates arranged to generate four intra-key parity bits rt20 to rt23 corresponding to the keys w#0 to w#3 received from the alternative key circuit 2130. These four intra-key parity bits rt20 to rt23 are output to the key cross-key parity prediction circuit 2180 and the key parity prediction circuit 1774. The cross-key parity generation circuit includes multiple mutually exclusive OR gates arranged to generate a cross-key parity byte vt2 corresponding to the keys w#0 to w#3 received from the alternative key circuit 2130. 0..7 (That is, the 8th bit is missing from the 9-bit cross-key parity byte VT2). This cross-key parity byte VT2 0..7 Output to the 2190 key word parity check 9-bit merging circuit.

[0097] The key word parity prediction circuit 2180 uses the following formula to calculate the last bit of the 9 bits corresponding to the minor key w#0 to w#3 across the minor key parity:

[0098] vt28 represents the last bit of a 9-bit parity check corresponding to the minor keys w#0 to w#3, rt2 i This represents the parity check bit within the corresponding little key w#i.

[0099] The 9-bit parity merger 2190 combines the results of the parity check calculation by the parity check generator 2160 into vt2. 0..7 The calculation result vt28 of the key word cross-parity prediction circuit 2180 is combined and used as the 9-bit cross-parity vt2. 0..8 And output to the key parity prediction circuit 1774.

[0100] Reference Figure 17 The Key Parity Prediction Circuitry 1772 contains multiple adders arranged to calculate the parity bits R#20 to R#2 corresponding to the minor key K#2 using the following formula. 15 : R#2 i =rt1 i +R#0 i for i=0~3 R#2 i =R#2 i-4 +R#0 ifor i=4~15 R#2 i Represents the parity check bit within the i-th subkey corresponding to key K#2, rt1 i R#0 represents the parity check bit within the i-th small key obtained from the key processing circuit 1720. i R#2 represents the parity bit within the i-th subkey corresponding to key K#0, read from register 1752. i-4 This represents the (i-4)th parity bit within the subkey corresponding to key K#2, read from register 1752. The key parity prediction circuit 1772 further includes multiple adders arranged to calculate the 9-bit parity across the subkeys corresponding to key K#2, V#20 to V#23, using the following formula: V#2 i =vt1+V#0 i for i=0 V#2 i =V#2 i-1 +V#0 i for i=1~3 V#2 i V#0 represents the 9-bit parity check corresponding to the i-th cross-key K#2, vt1 represents the 9-bit cross-key parity check obtained from the key processing circuit 1720, and V#0 represents the parity check. i V#2 represents the 9 bits of parity check corresponding to the i-th cross-key K#0 read from register 1752. i-1 This represents the (i-1)th cross-key parity 9 bits corresponding to key K#2 read from register 1752. The key parity prediction circuit 1772 stores the prediction results R#2, V#2 into register 1782 for use by the key parity checking circuit 1762 in the next iteration.

[0101] The key parity prediction circuit 1774 includes multiple adders arranged to calculate the parity bits R#30 to R#3 corresponding to the minor key K#3 using the following formula. 15 : R#3 i =rt2 i +R#1 i for i=0~3 R#3 i =R#3 i-4 +R#1 i for i=4~15 R#3 i Represents the parity check bit within the i-th subkey corresponding to key K#3, rt2 iR#1 represents the parity check bit within the i-th small key obtained from the key processing circuit 1730. i R#3 represents the parity bit within the i-th subkey corresponding to key K#1, read from register 1754. i-4 This represents the (i-4)th parity bit within the subkey corresponding to key K#3, read from register 1754. The key parity prediction circuit 1774 further includes multiple adders arranged to calculate the 9-bit parity across the subkeys corresponding to key K#3, V#30 to V#33, using the following formula: V#3 i =vt2+V#1 i for i=0 V#3 i =V#3 i-1 +V#1 i for i=1~3 V#3 i V#1 represents the 9-bit parity check corresponding to the i-th cross-key K#3, vt2 represents the 9-bit cross-key parity check obtained from the key processing circuit 1730, and V#1 represents the 9-bit cross-key parity check obtained from the key processing circuit 1730. i This represents the 9 bits of parity check corresponding to the i-th cross-key K#1 read from register 1754, V#3. i-1 This represents the (i-1)th cross-key parity 9 bits corresponding to key K#3 read from register 1754. The key parity prediction circuit 1774 stores the prediction results R#3 and V#3 in register 1784 for the key parity checking circuit 1764 to check in the next iteration.

[0102] Although Figure 17 Only the generation of keys K#2 and K#3 and the error detection of their generation process are described. However, since keys K#2 and K#3 are the keys used to generate keys K#4 and K#5 (that is, the keys used in the next iteration), and so on, those skilled in the art can refer to the above technical content to deduce the generation of keys for other rounds and the error detection of their generation process.

[0103] In some embodiments, registers 1712 and 1714 may be physically different registers. In other embodiments, registers 1712 and 1714 may refer to the same register, but store the base key and the subsequently generated round keys in a specified chronological order.

[0104] In some embodiments, registers 1752 and 1782 may be physically different registers. In other embodiments, registers 1752 and 1782 may refer to the same register, but store the first parity bit R#0 within the first little key and the parity 9 bits across the little key V#0 in a specified time sequence, as well as the subsequently generated parity bits within the little key and the parity 9 bits across the little key.

[0105] In some embodiments, registers 1754 and 1784 may be physically different registers. In other embodiments, registers 1754 and 1784 may refer to the same register, but store the second parity bit R#1 within the second little key and the parity 9 bit V#1 across the little key in a specified chronological order, as well as the subsequently generated parity bits within the little key and the parity 9 bits across the little key.

[0106] Although Figures 1 to 2 , Figure 5 , Figures 8 to 21 It includes the components described above, but does not preclude the use of other additional components to achieve better technical results without violating the spirit of the invention.

[0107] The above description is merely a preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any person skilled in the art can make further improvements and changes on this basis without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the scope defined in the claims of this application.

Claims

1. A data encryption error detection device, characterized in that, include: The search circuit is configured to convert the first value, which corresponds to one byte of plaintext or intermediate encryption result, into a second value based on a lookup table; as well as An alternative verification circuit, coupled to the search circuit, is configured to determine whether an error occurs during the conversion of the first value to the second value using a formula corresponding to the lookup table, and to issue an error signal when an error is detected.

2. The data encryption error detection device as described in claim 1, characterized in that, The lookup table is built using the following formula: SB i =Affine((i) -1 ) SB i The output of i represents the result of i. Affine() represents the Affine conversion function, where i is a positive integer from 0 to 127.

3. The data encryption error detection device as described in claim 2, characterized in that, The alternative verification circuit includes: A calculation circuit, coupled to the search circuit, is configured to obtain the second value and calculate Affine(S' (out) ) -1 And thus a third value is generated, where S' (out) Representing the second value, Affine() -1 The inverse function representing the Affine transformation; A multiplier, coupled to the search circuit and the calculation circuit, is configured to multiply the second value by the third value to produce a fourth value; and A comparator, coupled to the search circuit and the multiplier, is configured to implement the following logical expression to produce a judgment result: err_nl=0,if(S’ (mul) ==1)&&(S’ (in) !=0)&&(Affine(S’ (out) ) -1 !=0) err_nl=0,if(S’ (mul) ==0)&&(S’ (in) ==0)&&(Affine(S’ (out) ) -1 ==0) err_nl_i=1, otherwise When err_nl_i equals 1, it means an error has been detected, S' (mul) Representing the fourth value, S' (in) S' represents the first value. (out) This represents the second value.

4. The data encryption error detection device as described in claim 3, characterized in that, The alternative verification circuit is configured to send the error signal to the processing unit when the comparator detects that err_nl_i equals 1.

5. The data encryption error detection device as described in claim 1, characterized in that, The search circuit is configured to perform substitution byte operations in the Advanced Encryption Standard (AES) algorithm.

6. A data encryption error detection method, applied in an error detection circuit, characterized in that, include: The first byte corresponding to the plaintext or intermediate encryption result is converted into the second value based on the lookup table; Use the formula corresponding to the lookup table to determine whether an error occurred during the conversion of the first value to the second value; as well as When the aforementioned error is detected, an error signal is issued.

7. The error detection method for data encryption as described in claim 6, characterized in that, The lookup table is built using the following formula: SB i =Affine((i) -1 ) SB i The output of i represents the result of i. Affine() represents the Affine conversion function, where i is a positive integer from 0 to 127.

8. The error detection method for data encryption as described in claim 7, characterized in that, The step of determining whether the error occurred during the conversion of the first value to the second value using the formula corresponding to the lookup table includes: Calculate Affine(S' (out) ) -1 And thus a third value is generated, where S' (out) Representing the second value, Affine() -1 The inverse function representing the Affine transformation; Multiply the second value by the third value to produce a fourth value; and Use the following logical expression to generate the judgment result: err_nl=0,if(S’ (mul) ==1)&&(S’ (in) !=0)&&(Affine(S’ (out) ) -1 !=0) err_nl=0,if(S’ (mul) ==0)&&(S’ (in) ==0)&&(Affine(S’ (out) ) -1 ==0) err_nl_i=1, otherwise When err_nl_i equals 1, it means an error has been detected, S' (mul) Representing the fourth value, S' (in) S' represents the first value. (out) This represents the second value.

9. The error detection method for data encryption as described in claim 8, characterized in that, The step of issuing the error signal when the error is detected includes: When err_nl_i is detected to be equal to 1, the error signal is sent to the processing unit.

10. The error detection method for data encryption as described in claim 6, characterized in that, The error detection method for data encryption corresponds to the alternative byte operations in the Advanced Encryption Standard (AES) algorithm.

Images