Encryption method applicable to industrial control system, decryption method applicable to industrial control system, round key expansion method, and apparatus

Abstract

Provided in the present disclosure are an encryption method applicable to an industrial control system, a decryption method applicable to an industrial control system, a round key expansion method, and an apparatus. In the encryption method applicable to an industrial control system in the present disclosure, an SPN structure is used overall, and a plurality of rounds of iterative encryption operations are performed, the iterative encryption operation comprising three parts, i.e., round key introduction, S-box substitution and linear diffusion, a round key is introduced once in each round of encryption operation, and a vector is finally XORed to obtain output ciphertext. The present disclosure provides lightweight encryption and decryption solutions applicable to an industrial control system, thereby solving the problems in respect of data confidentiality and integrity in a deterministic low-latency scenario.

Description

Encryption and decryption method and device suitable for industrial control system

[0001] Cross-reference to Related Applications

[0002] The present disclosure claims priority to the Chinese patent application No. 202410414304.6, filed on April 8, 2024, and entitled "Encryption and decryption method and device suitable for industrial control system", the entire content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present disclosure relates to the field of data processing, and in particular, to an encryption and decryption method and device suitable for industrial control system. BACKGROUND

[0004] In recent years, industrial control systems and industrial internet have shown a deep integration trend, which has greatly improved the intelligent degree of industrial production, but has also brought new security challenges. In this case, it is crucial to encrypt data in the industrial control system.

[0005] In the design of cryptographic algorithms for industrial control systems, due to the low power consumption and low computing power of embedded devices in industrial control systems, traditional cryptographic algorithms cannot meet the requirements of embedded devices in industrial control systems. Therefore, academia and industry in various countries have begun to research and design lightweight cryptographic algorithms with excellent implementation efficiency. At present, although there are some well-known lightweight cryptographic algorithms internationally, there are still limited self-designed related algorithms.

[0006] SUMMARY

[0007] The present disclosure provides at least an encryption method and device suitable for industrial control system, a decryption method, and a round key expansion method to provide an encryption and decryption scheme suitable for industrial control system.

[0008] According to an aspect of the present disclosure, an encryption method suitable for industrial control system is provided, comprising:

[0009] XORing the plaintext to be encrypted with a preset first vector to obtain input state data corresponding to the first round encryption process; wherein the plaintext and the input state data are both N bits;

[0010] In the first round encryption process, the round key is XORed to the high N / 2-bit input state data in the order of bit from high to low to obtain key introduction state data; wherein the round key is N / 2-bit, and the key introduction state data is N-bit; and the key introduction state data is subjected to substitution operation by using a preset number of parallel S-boxes to obtain substitution state data; and the substitution state data is subjected to linear diffusion processing by using word reorganization and L transformation to obtain output data corresponding to the first round encryption process; wherein the S-box includes a 4-bit S-box.

[0011] In each round encryption process except the first round encryption process and the last round encryption process, the output data corresponding to the previous round encryption process is taken as input state data in the current round encryption process; the round key is XORed to the high N / 2-bit input state data in the order of bit from high to low to obtain key introduction state data; and the key introduction state data is subjected to substitution operation by using a preset number of parallel S-boxes to obtain substitution state data; and the substitution state data is subjected to linear diffusion processing by using word reorganization and L transformation to obtain output data corresponding to the current round encryption process.

[0012] In the last round encryption process, the output data corresponding to the previous round encryption process is taken as input state data in the current round encryption process; the round key is XORed to the high N / 2-bit input state data in the order of bit from high to low to obtain key introduction state data; and the key introduction state data is subjected to substitution operation by using a preset number of parallel S-boxes to obtain output data corresponding to the current round encryption process.

[0013] The output data corresponding to the last round encryption process is subjected to XOR operation with a preset second vector to obtain ciphertext.

[0014] In a possible implementation, the linear diffusion processing of the substitution state data by using word reorganization and L transformation includes:

[0015] The substitution state data is subjected to word reorganization to obtain reorganized state data;

[0016] The reorganized state data is subjected to L transformation to obtain L transformation data;

[0017] The L transformation data is subjected to word reorganization to obtain output data corresponding to the current round encryption process.

[0018] In a possible implementation, the S-box is based on Bit-Slice parallel query, and includes a plurality of Boolean logic operations.

[0019] The plurality of Boolean logic operations include at least one of the following: non-operation; data transmission operation; or operation; XOR operation; and operation.

[0020] In a possible implementation, the word recombination is based on 16-bit data recombination.

[0021] In a possible implementation, the L transformation includes two Perm transformations, which adopt a Feistel-like structure and include cyclic shift operations and XOR operations.

[0022] In a possible implementation, the Perm transformation has a differential branch number of 6 and includes 5 rounds of iterative cyclic shift operations and XOR operations; wherein the cyclic shift parameters are 0, 1, 2, 3, and 1 respectively.

[0023] In a possible implementation, the round key is expanded according to the following steps:

[0024] The initial round key is overwritten according to a preset bit number to obtain an overwritten round key corresponding to a first round iteration;

[0025] A multi-round round iteration process is performed, and in each round iteration process, a cyclic shift operation, an XOR operation, and an AND operation are performed on an overwritten round key corresponding to the round iteration process to obtain an expanded round key corresponding to the round iteration process; wherein the expanded round key corresponding to the round iteration process is taken as an overwritten round key corresponding to a next round iteration process;

[0026] The expanded round key corresponding to a last round iteration process is taken as a final round key.

[0027] According to another aspect of the present disclosure, a decryption method suitable for an industrial control system is provided, which includes an inverse operation of any of the encryption methods described above, wherein the inverse operation of the L transformation includes reverse ordering the cyclic shift parameters in the L transformation.

[0028] According to another aspect of the present disclosure, a round key expansion method is provided, which includes:

[0029] The initial round key is overwritten according to a preset bit number to obtain an overwritten round key corresponding to a first round iteration;

[0030] A multi-round round iteration process is performed, and in each round iteration process, a cyclic shift operation, an XOR operation, and an AND operation are performed on an overwritten round key corresponding to the round iteration process to obtain an expanded round key corresponding to the round iteration process; wherein the expanded round key corresponding to the round iteration process is taken as an overwritten round key corresponding to a next round iteration process;

[0031] The expanded round key corresponding to a last round iteration process is taken as a final round key.

[0032] According to another aspect of the present disclosure, an encryption device suitable for an industrial control system is provided, which includes:

[0033] The preliminary processing module is configured to perform an exclusive OR operation on the plaintext to be encrypted and a preset first vector to obtain input state data corresponding to a first round of the encryption process; wherein the plaintext and the input state data are both N bits;

[0034] The encryption processing module is configured to, in the first round of the encryption process, perform an exclusive OR operation on the round key and the input state data of the high N / 2 bits in a high-to-low order of bit positions to obtain key introduction state data; wherein the round key is N / 2 bits, the key introduction state data is N bits; and perform a substitution operation on the key introduction state data by using a preset number of parallel S-boxes to obtain substitution state data; and perform linear diffusion processing on the substitution state data by using word recombination and L transformation to obtain output data corresponding to the first round of the encryption process; wherein the S-box includes a 4-bit S-box.

[0035] In each round of the encryption process other than the first round and the last round, the output data corresponding to the previous round of the encryption process is taken as input state data in the current round of the encryption process; the round key is performed on the input state data of the high N / 2 bits in a high-to-low order of bit positions to obtain key introduction state data; and a substitution operation is performed on the key introduction state data by using a preset number of parallel S-boxes to obtain substitution state data; and linear diffusion processing is performed on the substitution state data by using word recombination and L transformation to obtain output data corresponding to the current round of the encryption process.

[0036] In the last round of the encryption process, the output data corresponding to the previous round of the encryption process is taken as input state data in the current round of the encryption process; the round key is performed on the input state data of the high N / 2 bits in a high-to-low order of bit positions to obtain key introduction state data; and a substitution operation is performed on the key introduction state data by using a preset number of parallel S-boxes to obtain output data corresponding to the current round of the encryption process.

[0037] The ciphertext processing module is configured to perform an exclusive OR operation on the output data corresponding to the last round of the encryption process and a preset second vector to obtain ciphertext.

[0038] The encryption method suitable for the industrial control system of the present disclosure adopts the SPN structure as a whole, performs multiple rounds of iterative encryption operations, and includes three parts of round key introduction, S-box substitution and linear diffusion in the iterative encryption operation. The round key is introduced once in each round of encryption operation, and then an output ciphertext is obtained by exclusive-ORing a vector. The SPN structure is selected in the algorithm structure of the present disclosure, which can provide fast diffusion and is easy to estimate the security bound based on the number of active S-boxes. The S-box selected by the present disclosure is a 4-bit S-box that is differential and linear optimal, that is, the upper bound of the differential probability is optimal, which is 2-2, and the upper bound of the linear correlation coefficient is optimal, which is 2-1. The 4-bit S-box is based on Bit-Slice parallel query, which is easy to realize lightweight software and hardware. Through analysis, the algorithm can resist common attack methods such as differential analysis, linear analysis, impossible differential analysis, zero correlation linear analysis and integral analysis. In addition, the core of the scheme of the present disclosure can be reused, the hardware resource consumption is small, and it is suitable for lightweight hardware use scenarios. Moreover, the present disclosure utilizes word reorganization and L transformation for linear diffusion processing. The word reorganization operation is equivalent to recombination based on 16-bit numbers, which has excellent hardware performance and is suitable for 8-bit and above processors. The L transformation facilitates the estimation of the number of active S-boxes based on the MILP technology. At the same time, the combination of word reorganization and L transformation also realizes the linear transformation between nibble internal bits, increasing the diffusion. In summary, the scheme of the present disclosure can solve the data confidentiality and integrity problem in the deterministic low-latency scenario, and can be applied to embedded controllers in industrial control systems, such as PLC and DCS systems.

[0039] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present disclosure, nor to limit the scope of the present disclosure. Other features of the present disclosure will become apparent through the following description. BRIEF DESCRIPTION OF DRAWINGS

[0040] The accompanying drawings are used to better understand the present scheme and do not limit the present disclosure. Among them:

[0041] Fig. 1 is a flowchart of the encryption method suitable for the industrial control system according to an embodiment of the present disclosure;

[0042] Fig. 2 is a schematic diagram of the encryption method according to an embodiment of the present disclosure;

[0043] Fig. 3 is a schematic diagram of the S-box processing method according to an embodiment of the present disclosure;

[0044] Fig. 4 is a schematic diagram of the L transformation according to an embodiment of the present disclosure;

[0045] Fig. 5 is a schematic diagram of the linear diffusion processing according to an embodiment of the present disclosure;

[0046] Fig. 6 is a structural schematic diagram of an encryption device applicable to an industrial control system according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0047] Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, which include various details of the embodiments of the present disclosure to assist in understanding, and should be considered as merely exemplary. Thus, those skilled in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present disclosure. Also, descriptions of known functions and constructions are omitted in the following description for clarity and conciseness.

[0048] The present disclosure provides an encryption method and device applicable to an industrial control system, a decryption method, and a round key expansion method to address the lack of lightweight encryption and decryption schemes applicable to industrial control systems. The encryption method of the present disclosure uses an SPN structure and performs multiple rounds of iterative encryption operations, which include the introduction of a round key, S-box substitution, and linear diffusion. Each round of encryption operation introduces a round key, and finally, an output ciphertext is obtained by XORing a vector. The present disclosure provides a lightweight encryption and decryption scheme applicable to industrial control systems, which can solve the data confidentiality and integrity problems in deterministic low-latency scenarios.

[0049] The technical solutions of the present disclosure are described below through specific embodiments.

[0050] As shown in Fig. 1, a flowchart of an encryption method applicable to an industrial control system according to the present embodiment is shown. The execution subject of the present embodiment is a component with data processing capability. Specifically, the method of the present embodiment can include the following steps:

[0051] S110, XORing the plaintext to be encrypted with a preset first vector to obtain input state data corresponding to the first round of encryption process; wherein the plaintext and the input state data are both N bits.

[0052] Optionally, the first vector has the same number of bits as the plaintext, both of which are N bits, and the first vector can be set to 0 on the first half of the number of bits, i.e., the first vector can be set to 0 on the first 2 / N number of bits.

[0053] As shown in Fig. 2, x0, x1, x2, and x3 are the input state data corresponding to the first round of encryption process described above.

[0054] S120, in the first round encryption process, the round key is XORed to the high N / 2 bit input state data in the order of bit from high to low, to obtain the key introduction state data; wherein, the round key is N / 2 bit, the key introduction state data is N bit; and, the preset number of parallel S-boxes is used to perform the substitution operation on the key introduction state data, to obtain the substitution state data; and, the word reorganization and L transformation are used to perform the linear diffusion processing on the substitution state data, to obtain the output data corresponding to the first round encryption process; wherein, the S-box includes a 4-bit S-box.

[0055] S130, in each round encryption process outside the first round encryption process and the last round encryption process, the output data corresponding to the last round encryption process is taken as the input state data in the current round encryption process; the round key is XORed to the high N / 2 bit input state data in the order of bit from high to low, to obtain the key introduction state data; and, the preset number of parallel S-boxes is used to perform the substitution operation on the key introduction state data, to obtain the substitution state data; and, the word reorganization and L transformation are used to perform the linear diffusion processing on the substitution state data, to obtain the output data corresponding to the current round encryption process.

[0056] S140, in the last round encryption process, the output data corresponding to the last round encryption process is taken as the input state data in the current round encryption process; the round key is XORed to the high N / 2 bit input state data in the order of bit from high to low, to obtain the key introduction state data; and, the preset number of parallel S-boxes is used to perform the substitution operation on the key introduction state data, to obtain the output data corresponding to the current round encryption process.

[0057] S120-S140 are used to describe each round encryption process, wherein, in each round iteration, the round key is introduced into the encryption process by XORing with the input state data, in the algorithm, N / 2 bit round key is introduced in each round, and XORed to the high N / 2 bit of the input state data, which is equivalent to XORing the round key to the high 2 bit of each S-box input, for details, refer to Fig. 2. In some embodiments, the value of N can be 128, and the round key can be 64 bits. In some other embodiments, the round key can also be 128, 256 bits, etc. As shown in Fig. 2, RKI represents the round key, and i is the round number.

[0058] As shown in Fig. 2, in the present embodiment, 32 S-boxes are placed in parallel to form a 4-bit S-box, and the substitution operation is performed on the key introduction state data by using the 4-bit S-box.

[0059] When the input is represented as in The output is represented as in The transformation relationship is Wherein:

[0060] The above, k represents the round number, and j represents the bit.

[0061] The specific permutation process is shown in FIG. 3.

[0062] The values of the S-box are shown in Table 1 below:

[0063] Table 1

[0064] In this embodiment, the linear transformation layer performing linear diffusion processing includes word reorganization and L transformation, wherein the specific definition of the word reorganization is that for 4 32-bit input words (in0, in1, in2, in3), the output after word reorganization is (out0, out1, out2, out3), and (out0, out1) = (in 0,L ||in 1,L ,in 0,R ||in 1,R );

[0065] (out2, out3) = (in 2,L ||in 3,L ,in 2,R ||in 3,R ); the above L represents the left half part of the corresponding input, i.e., the high 16 bits of the corresponding input, and P represents the right half part of the corresponding input, i.e., the low 16 bits of the corresponding input.

[0066] The specific definition of the L transformation is that for 4 32-bit input words (in0, in1, in2, in3), the output after L transformation is (out0, out1, out2, out3), and (out0, out1) = L(in0, in1); (out2, out3) = L(in2, in3)

[0067] The L transformation is shown in FIG. 4A, which includes a cyclic shift operation and an XOR operation, wherein p0, p1, p2, p3 represent cyclic shift parameters.

[0068] Optionally, the word reorganization of the linear transformation layer is performed twice, and the L transformation is performed between the two times of word reorganization, as shown in FIG. 4B, which specifically includes:

[0069] The permutation state data is subjected to word reorganization to obtain reorganized state data; the reorganized state data is subjected to L transformation to obtain L transformation data; and the L transformation data is subjected to word reorganization to obtain output data corresponding to the round encryption process.

[0070] Optionally, as shown in FIG. 2, the first word reorganization is (c0, c1) = (b 0,L ||b 1,L ,b 0,R ||b 1,R ) and (c2, c3) = (b2,L ||b 3,L ,b 2,R ||b 3,R ), (c0, c1, c2, c3) is the recombination data described above, and (d0, d1, d2, d3) is the L transform data obtained by L transform. The second word recombination is (y0, y1) = (d 0,L ||d 1,L ,d 0,R ||d 1,R ) and (y2, y3) = (d 2,L ||d 3,L ,d 2,R ||d 3,R ), (y0, y1, y2, y3) is the output data of the corresponding round encryption process.

[0071] As shown in FIG. 4B, input is the permutation state data, and output is the output data of the corresponding round encryption process.

[0072] Optionally, considering that the linear diffusion processing of the last round of encryption process has little effect on the security of the algorithm, and in order to make the decryption structure of the algorithm basically consistent with the encryption structure, the last round of operation does not perform linear diffusion operation.

[0073] S150, XOR operation is performed on the output data corresponding to the last round of encryption process and a preset second vector to obtain ciphertext.

[0074] Optionally, the bit number of the second vector is the same as the bit number of the plaintext, both of which are N bits, and the second vector can be set to 0 on the bits of the latter half bit number, that is, the second vector can be set to 0 on the bits of the latter 2 / N bit number.

[0075] The present disclosure provides a lightweight block cipher algorithm for industrial control programming platform and embedded platform, explores the use of lightweight component search, automated security analysis based on MILP (SAT), provably secure technology and method, and can solve the data confidentiality and integrity problem in the deterministic low latency scene. Finally, the scheme of the present disclosure can be applied to secure PLC and DCS system.

[0076] In some embodiments, the S-box with the optimal differential and linear properties is selected, and at the same time, the number of operations when the S-box is implemented based on the Bit-Slice mode is fully considered, and as few instructions (MOV, AND, XOR, OR, NOT) as possible are used to complete. The Bit-Slice implementation of the S-box layer is a Boolean logic operation, including non-operation (NOT), data transfer operation (MOV), or operation (OR), exclusive or operation (XOR), and and operation (AND).

[0077] In some embodiments, the L transformation includes two Perm transformations, which adopt a Feistel structure, including a cyclic shift operation and an XOR operation, and have low software and hardware implementation costs, consistent encryption and decryption implementation costs, and high efficiency; in the present embodiment, the implementation performance and security of the algorithm are comprehensively considered when selecting the number of iteration rounds and the cyclic shift parameters of the Perm transformation. First, the number of differential branches is ensured to be no less than 6; at the same time, the number of differential active S-boxes of a 3-round algorithm is calculated based on the MILP technology to be as large as possible; on the basis of satisfying the above search results, the number of iteration rounds is as small as possible, and the cyclic shift parameters are as small as possible. Under this strategy, through the search results, it is determined that the Perm transformation adopts 5 rounds of iteration, the cyclic shift parameters are 0, 1, 2, 3, and 1 in turn, the number of differential branches is 6, and the number of differential active S-boxes under a 3-round algorithm reaches 15. The number of active S-boxes under some other parameters is shown in Table 2 below.

[0078] Table 2

[0079] In some embodiments, the round key is expanded according to the following steps:

[0080] First, the initial round key is rewritten according to a preset bit number to obtain a rewritten round key corresponding to a first round of iteration; then, a multi-round iteration process is performed, and in each round of iteration, the rewritten round key corresponding to the round of iteration is subjected to a cyclic shift, an XOR operation, and an AND operation to obtain an expanded round key corresponding to the round of iteration; wherein the expanded round key corresponding to the round of iteration is taken as the rewritten round key corresponding to the next round of iteration; finally, the expanded round key corresponding to the last round of iteration is taken as the final round key.

[0081] Optionally, the expanded round key can be 256 bits, 128 bits, etc.

[0082] The above key expansion scheme is mainly based on a simple and lightweight design, and in the algorithm, a cyclic shift, an XOR operation, and an AND operation are combined with a 4-branch and an 8-branch generalized Feistel structure to expand the round key. The software and hardware resource occupation introduced by the key expansion is as low as possible. The round constant related to the "round number" introduced in the key expansion process can effectively resist related key attacks.

[0083] The present disclosure also provides a decryption method suitable for an industrial control system, which includes the inverse operation of the encryption method in the above embodiments, inputs an N-bit ciphertext and a round key, and outputs an N-bit plaintext P, wherein the inverse operation of the L transformation includes reverse sequence calling of the cyclic shift parameters in the L transformation. In addition, the inverse operation of the S-box is also performed, and the substitution corresponding relationship is shown in Table 3 below:

[0084] Table 3

[0085] The present disclosure provides a round key expansion method, which is the same as the expansion method in the above-mentioned embodiments, and thus will not be described here.

[0086] Based on the same inventive concept, the present disclosure also provides an encryption device applicable to an industrial control system, components of the device perform steps similar to the above-mentioned method, and thus similar parts will not be described here. As shown in FIG. 5, the encryption device applicable to the industrial control system of the present embodiment comprises:

[0087] The preliminary processing module 510 is configured to perform an exclusive OR operation on the plaintext to be encrypted and a preset first vector to obtain input state data corresponding to the first round of the encryption process; wherein the plaintext and the input state data are both N bits.

[0088] The encryption processing module 520 is configured to, in the first round of the encryption process, perform an exclusive OR operation on the input state data of the high N / 2 bits with the round key in the order of bit from high to low to obtain key introduction state data; wherein the round key is N / 2 bits, the key introduction state data is N bits; and perform a substitution operation on the key introduction state data by using a preset number of parallel S-boxes to obtain substitution state data; and perform linear diffusion processing on the substitution state data by using word reorganization and L transformation to obtain output data corresponding to the first round of the encryption process; wherein the S-box includes a 4-bit S-box.

[0089] The encryption processing module 520 is configured to, in each round of the encryption process other than the first round and the last round of the encryption process, take the output data corresponding to the previous round of the encryption process as the input state data in the current round of the encryption process; perform an exclusive OR operation on the input state data of the high N / 2 bits with the round key in the order of bit from high to low to obtain key introduction state data; and perform a substitution operation on the key introduction state data by using a preset number of parallel S-boxes to obtain substitution state data; and perform linear diffusion processing on the substitution state data by using word reorganization and L transformation to obtain output data corresponding to the current round of the encryption process.

[0090] The encryption processing module 520 is configured to, in the last round of the encryption process, take the output data corresponding to the previous round of the encryption process as the input state data in the current round of the encryption process; perform an exclusive OR operation on the input state data of the high N / 2 bits with the round key in the order of bit from high to low to obtain key introduction state data; and perform a substitution operation on the key introduction state data by using a preset number of parallel S-boxes to obtain output data corresponding to the current round of the encryption process.

[0091] The ciphertext processing module 530 is configured to perform an exclusive OR operation on the output data corresponding to the last round of the encryption process and a preset second vector to obtain ciphertext.

[0092] In some embodiments, the encryption processing module 520 is configured to, when performing linear diffusion processing on the permutation state data by using word reorganization and L transformation, perform:

[0093] reorganize the permutation state data to obtain reorganized state data;

[0094] perform L transformation on the reorganized state data to obtain L transformation data;

[0095] perform word reorganization on the L transformation data to obtain output data corresponding to a round encryption process.

[0096] In some embodiments, the S-box is based on Bit-Slice parallel query, including a plurality of Boolean logic operations; the plurality of Boolean logic operations include at least one of the following: non-operation; data transfer operation; or operation; XOR operation; and operation.

[0097] In some embodiments, the word reorganization is based on data reorganization of 16-bit bits.

[0098] In some embodiments, the L transformation includes two Perm transformations, and the Perm transformation adopts a Feistel-like structure, including a cyclic shift operation and an XOR operation.

[0099] In some embodiments, the Perm transformation has a differential branch number of 6, and includes 5 rounds of iterative cyclic shift operations and XOR operations; wherein the cyclic shift parameters are 0, 1, 2, 3, and 1, respectively.

[0100] In some embodiments, it further includes a round key expansion module 540, which expands the round key according to the following steps:

[0101] rewrite the initial round key according to a preset bit number to obtain a rewritten state round key corresponding to a first round iteration;

[0102] perform a plurality of round iteration processes, and in each round iteration process, perform a cyclic shift operation, an XOR operation, and an AND operation on the rewritten state round key corresponding to the round iteration process to obtain an expanded state round key corresponding to the round iteration process; wherein the expanded state round key corresponding to the round iteration process is used as the rewritten state round key corresponding to a next round iteration process;

[0103] use the expanded state round key corresponding to a last round iteration process as a final round key.

[0104] The various embodiments of the systems and techniques described above can be implemented in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a load programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0105] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces the functions / operations specified in the flowcharts and / or the block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, or entirely on a remote machine or server.

[0106] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0107] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0108] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0109] The computer system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server can arise by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0110] It should be understood that various forms of flow shown above can be used, with steps reordered, added, or removed. For example, the steps recited in the present disclosure can be performed in parallel, in series, or in a different order, without limitation, as long as the desired results of the technology disclosed in the present disclosure are achieved.

[0111] The specific embodiments described above are not intended to limit the scope of the present disclosure. Those skilled in the art will understand that various modifications, combinations, sub-combinations, and alternatives can be made to the specific embodiments without departing from the spirit and principles of the present disclosure. Any further modifications, changes, improvements, and the like that come within the spirit and scope of the present disclosure should be considered as falling within the scope of the present disclosure. Industrial Applicability

[0112] The industrial control system provided by the present disclosure is applicable to encryption and decryption methods, round key expansion methods and devices, and a lightweight encryption and decryption scheme applicable to the industrial control system is provided, which can solve the data confidentiality and integrity problem in a deterministic low-latency scenario.

Claims

1. An encryption method applicable to an industrial control system, characterized in that: include: Performing an XOR operation on the plaintext to be encrypted and a preset first vector to obtain input data corresponding to the first round of encryption process; wherein the plaintext and the input data are both N bits; During a first-round encryption process, the round key is XORed with the upper N / 2 bits of the input state data in descending bit order to obtain key introduction state data; wherein the round key is N / 2 bits and the key introduction state data is N bits; and a permutation operation is performed on the key introduction state data using a preset number of parallel S-boxes to obtain permuted state data; and a linear diffusion process is performed on the permuted state data using word recombination and L transformation to obtain output data corresponding to the first-round encryption process; wherein the S-box includes a 4-bit S-box; In each encryption round other than the first and last encryption rounds, the output data corresponding to the previous encryption round is used as the input data of the current encryption round; the round key is XORed with the upper N / 2 bits of the input data in descending order of bits to obtain key-introduced data; and a permutation operation is performed on the key-introduced data using a preset number of parallel S-boxes to obtain permuted data; and a linear diffusion operation is performed on the permuted data using word recombination and L transformation to obtain output data corresponding to the current encryption round. In the final encryption round, the output data corresponding to the previous encryption round is used as the input data for the current encryption round. The round key is XORed with the upper N / 2 bits of the input data in descending order to obtain key-introduction data. The key-introduction data is permuted using a preset number of parallel S-boxes to obtain the output data corresponding to the current encryption round. The output data corresponding to the final round of encryption process is XORed with the preset second vector to obtain the ciphertext.

2. The method according to claim 1, characterized in that The linear diffusion processing of the permuted state data by utilizing word reorganization and L transformation includes: Performing word reorganization on the replacement state data to obtain reorganized state data; Performing L transformation on the restructured data to obtain L transformation data; The L transformed data is word-reorganized to obtain output data of the corresponding round encryption process.

3. The method according to any one of claims 1-2, characterized in that The S-box is queried in parallel based on the Bit-Slice method, including multiple Boolean logic operations; The plurality of Boolean logic operations include at least one of the following: a NOT operation; a data transfer operation; an OR operation; an XOR operation; and an AND operation.

4. The method according to any one of claims 1 to 3, characterized in that The word reassembly is performed based on 16 bits to reassemble data.

5. The method according to any one of claims 1 to 4, characterized in that The L transform includes two Perm transforms. The Perm transform adopts a Feistel-like structure and includes a cyclic shift operation and an XOR operation.

6. The method according to claim 5, characterized in that The Perm transform has 6 differential branches and includes 5 rounds of iterative cyclic shift operations and XOR operations; wherein the cyclic shift parameters are 0, 1, 2, 3, and 1 respectively.

7. The method according to any one of claims 1 to 6, characterized in that The round key is expanded according to the following steps: Rewrite the initial round key according to the preset number of bits to obtain the rewritten round key corresponding to the first round of iteration; Perform multiple rounds of iterations, and in each round of iterations, perform cyclic shifts, XOR operations, and AND operations on the rewritten state round key corresponding to the round of iterations to obtain the extended state round key corresponding to the round of iterations; wherein the extended state round key corresponding to the round of iterations is used as the rewritten state round key corresponding to the next round of iterations; The extended round key corresponding to the last round of iteration is used as the final round key.

8. A decryption method applicable to an industrial control system, characterized in that: The method comprises the inverse operation of the encryption method according to any one of claims 1 to 6, wherein the inverse operation of the L transform comprises calling the cyclic shift parameters in the L transform in reverse order.

9. A round key expansion method, characterized in that: include: Rewrite the initial round key according to the preset number of bits to obtain the rewritten round key corresponding to the first round of iteration; Perform multiple rounds of iterations, and in each round of iterations, perform cyclic shifts, XOR operations, and AND operations on the rewritten state round key corresponding to the round of iterations to obtain the extended state round key corresponding to the round of iterations; wherein the extended state round key corresponding to the round of iterations is used as the rewritten state round key corresponding to the next round of iterations; The extended round key corresponding to the last round of iteration is used as the final round key.

10. An encryption device suitable for an industrial control system, characterized in that: include: a preliminary processing module configured to perform an XOR operation on the plaintext to be encrypted and a preset first vector to obtain input state data corresponding to a first round of encryption process; wherein the plaintext and the input state data are both N bits; The encryption processing module is configured to, during a first-round encryption process, XOR the round key with the upper N / 2 bits of the input state data in descending bit order to obtain key introduction state data; wherein the round key is N / 2 bits and the key introduction state data is N bits; and perform a permutation operation on the key introduction state data using a preset number of parallel S-boxes to obtain permuted state data; and perform a linear diffusion operation on the permuted state data using word recombination and L transformation to obtain output data corresponding to the first-round encryption process; wherein the S-box includes a 4-bit S-box; In each round of encryption except the first round of encryption and the last round of encryption, the output data corresponding to the previous round of encryption is used as the input data of the current round of encryption; the round encryption is converted into the input data according to the order of bits from high to low. XORing the key onto the upper N / 2 bits of the input state data to obtain key-introduced state data; and performing a permutation operation on the key-introduced state data using a preset number of parallel S-boxes to obtain permuted state data; and performing a linear diffusion operation on the permuted state data using word recombination and L transformation to obtain output data corresponding to this round of encryption process; In the final encryption round, the output data corresponding to the previous encryption round is used as the input data for the current encryption round. The round key is XORed with the upper N / 2 bits of the input data in descending order to obtain key-introduction data. The key-introduction data is permuted using a preset number of parallel S-boxes to obtain the output data corresponding to the current encryption round. The ciphertext processing module is configured to perform an XOR operation on the output data corresponding to the final round of encryption process and a preset second vector to obtain a ciphertext.

Images