KR102628010B1 - Encryption circuit for virtual encryption operation - Google Patents

Abstract

An encryption circuit that performs a virtual encryption operation is disclosed. An encryption circuit according to an embodiment of the present disclosure includes a plurality of round cores that perform an actual round operation on each sequentially input input data, and a pipeline that outputs encrypted data through an encryption operation using the actual round operation. An encryption core, and an encryption controller that controls at least one round core among the plurality of round cores to additionally perform a virtual round operation, wherein the encryption controller controls the virtual round operation of the at least one round core to be performed on the plurality of round cores. It may be performed in parallel with the actual round operation of at least one other round core.

Description

Encryption circuit for performing virtual encryption operations {ENCRYPTION CIRCUIT FOR VIRTUAL ENCRYPTION OPERATION}

The technical idea of the present disclosure relates to an encryption circuit that performs an encryption operation and a method of operating the same, and more specifically, to an encryption circuit that performs a virtual operation and a method of operating the same.

Smart cards and integrated circuit (IC) cards contain secure information about users. In order to prevent the user's security information from being leaked by hacking, etc., an encryption circuit is required to convert the security information transmitted through a signature or authentication process into ciphertext and transmit it.

Instead of directly manipulating input or output data, an attacker can conduct a "Side-channel Analysis Attack." In a side-channel analysis attack, an attacker can collect secondary information such as the amount of power consumed by the encryption circuit, the waveform of the electromagnetic waves generated by the encryption circuit, etc. An attacker can attack the encryption circuit to find out the key used in the encryption circuit based on the collected information. Therefore, as a technique to prevent side channel analysis attacks, a method of making power and electromagnetic waves, which are information collected through a side channel, appear randomly or appear uniformly can be used.

The technical idea of the present disclosure relates to an encryption circuit and a method of operating the same, and provides an encryption circuit and a method of operating the same that perform real and virtual operations on data.

In order to achieve the above object, according to one aspect of the technical idea of the present disclosure, an encryption circuit includes a plurality of round cores that perform an actual round operation on each sequentially input input data, and performs an actual round operation. A pipeline encryption core that outputs encryption data through an encryption operation using a pipeline encryption core, and an encryption controller that controls at least one round core among the plurality of round cores to additionally perform a virtual round operation, and the encryption controller includes at least one The virtual round operation of the round core may be performed in parallel with the actual round operation of at least one other round core among the plurality of round cores.

An encryption circuit according to another aspect of the technical idea of the present disclosure includes a first round core that performs a first real round operation on input data, and based on the result of the first real round operation, a second real round operation on input data. It includes a second round core that performs an operation, and a key scheduler that provides round keys to the first round core and the second round core, respectively, wherein the first round core provides dummy data and a first virtual round key provided from the key scheduler. The first virtual round operation may be further performed based on one of the first round cores, and the first virtual round operation of the first round core may be performed in parallel with the second real round operation.

According to another aspect of the technical idea of the present disclosure, the encryption circuit includes a first round core that performs a first real round operation on input data, based on the result of the first real round operation, a second real round core on the input data. It includes a second round core that performs a round operation, and a key scheduler that provides round keys to the first round core and the second round core, respectively, and the second round core includes dummy data and a virtual round key provided from the key scheduler. A virtual round operation may be further performed based on one, and the first real round operation may be performed in parallel with the virtual round operation of the second round core.

According to the encryption circuit and its operating method according to the technical idea of the present disclosure, the security level of the encryption circuit can be improved by making it difficult for an attacker to specify the point in time when the actual encryption operation is performed.

In addition, due to the noise generated when performing virtual encryption operations, it may become difficult for an attacker to determine the encryption key used in the encryption circuit from the information collected through the side channel, and the security level of the encryption circuit may be improved. there is.

Additionally, by overlapping actual calculation operations on different data, the time required for the encryption operation can be reduced and the security level can be improved at the same time.

1 is a block diagram showing a computing device according to an example embodiment of the present disclosure.
Figure 2 is a block diagram showing an encryption circuit according to an exemplary embodiment of the present disclosure.
Figure 3 is a block diagram showing a pipeline encryption core included in an encryption circuit according to an exemplary embodiment of the present disclosure.
Figure 4 is a flowchart illustrating an encryption operation performed in an encryption circuit according to an exemplary embodiment of the present disclosure.
Figure 5 is a flowchart for explaining the operation of an encryption controller of an encryption circuit according to an exemplary embodiment of the present disclosure.
6 to 8 are timing diagrams for explaining the operation of an encryption circuit according to an exemplary embodiment of the present disclosure.
9 is a flowchart for explaining the operation of an encryption controller of an encryption circuit according to an exemplary embodiment of the present disclosure.
10 to 12 are timing diagrams for explaining the operation of an encryption circuit according to an exemplary embodiment of the present disclosure.
13 is a timing diagram for explaining the operation of an encryption circuit according to an exemplary embodiment of the present disclosure.

Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings.

1 is a block diagram showing a computing device according to an example embodiment of the present disclosure.

1 is a block diagram showing a computing device including electronic devices employing encryption circuits according to embodiments of the present invention. In one embodiment, the computing device 1000 includes a processor device 1100, a working memory 1200, a storage device 1300, a user interface 1400, and a bus 1500. can do.

For example, the computing device 1000 includes a desktop computer, a laptop computer, a tablet computer, a workstation, a server, a digital television, a video game console, It may be one of various electronic devices such as a smart phone, wearable device, etc., but the present invention is not limited to this example.

The processor device 1100 may control overall operations of the computing device 1000. The processor device 1100 may be configured to process various types of arithmetic operations and/or logical operations. To this end, the processor device 1100 includes a special-purpose logic circuit (Special-purpose Logic Circuit) including one or more processor cores 1110; for example, Field Programmable Gate Array (FPGA), Application Specific Integrated Circuits (ASICs), etc. ) can be implemented. For example, the processor device 1100 may include a general-purpose processor, a dedicated processor, and/or an application processor.

For example, the processor device 1100 may execute an instruction set of program code using the processor cores 1110. One or more caches 1130 may temporarily store data generated by execution of an instruction set or data to be used to execute the instruction set.

The processor device 1100 may encrypt data output from the processor cores 1110 and/or caches 1130 using the encryption circuit 1150. Furthermore, the processor device 1100 may use the encryption circuit 1150 to decrypt data to be input to the processor cores 1110 and/or caches 1130.

The working memory 1200 may temporarily store data used in the operation of the computing device 1000. For example, the working memory 1200 may store data processed or to be processed by the processor device 1100 in one or more memories 1210. For example, the memories 1210 may include volatile memories such as static random access memory (SRAM), dynamic RAM (DRAM), and synchronous DRAM (SDRAM). The memory controller 1230 may control the memories 1210 so that the memories 1210 store data or output the stored data.

The working memory 1200 can encrypt data to be stored in the memories 1210 using the encryption circuit 1250. Furthermore, the working memory 1200 can decrypt data output from the memories 1210 using the encryption circuit 1250.

The storage device 1300 can store data regardless of power supply. The storage device 1300 may store system data used to operate the computing device 1000 and/or user data for a user of the computing device 1000 in one or more non-volatile memories 1310 . For example, the non-volatile memories 1310 include non-volatile memory such as flash memory, phase-change RAM (PRAM), magneto-resistive RAM (MRAM), resistive RAM (ReRAM), and ferro-electric RAM (FRAM). It may include at least one of volatile memories. The memory controller 1330 may control the non-volatile memories 1310 so that the non-volatile memories 1310 store data or output stored data. For example, the storage device 1300 may include a storage medium such as a solid state drive (SSD), a hard disk drive (HDD), a secure digital (SD) card, or a multimedia card (MMC).

The storage device 1300 may use the encryption circuit 1350 to encrypt data to be stored in the non-volatile memories 1310. Furthermore, the storage device 1300 can decrypt data output from the non-volatile memories 1310 using the encryption circuit 1350.

The user interface 1400 may mediate communication between the user and the computing device 1000 according to the control of the processor device 1100. For example, the user interface 1400 may process input from a keyboard, mouse, keypad, buttons, touch panel, touch screen, touch pad, touch ball, camera, microphone, gyroscope sensor, vibration sensor, etc. Furthermore, the user interface 1400 can process output to a display device, speaker, motor, etc.

Bus 1500 may provide a communication path between components of computing device 1000. Components of the computing device 1000 may exchange data with each other based on the bus format of the bus 1500. For example, bus formats include Peripheral Component Interconnect Express (PCIe), Nonvolatile Memory Express (NVMe), Small Computer System Interface (SCSI), Advanced Technology Attachment (ATA), Serial ATA (SATA), Parallel ATA (PATA), and SAS. It may include one or more of various communication protocols such as (Serial Attached SCSI), UFS (Universal Flash Storage), etc.

The encryption circuits 1150, 1250, and 1350 according to exemplary embodiments of the present disclosure may change data into encrypted data through an encryption operation. At this time, the encryption operation may include performing a plurality of round operations sequentially. For example, the encryption operation may include an initial encryption operation and first to nth round operations, and based on the result of the preceding round operation, the next round operation may be performed.

The encryption circuit according to the present disclosure can be configured to make it difficult to specify when the actual round operation is performed by additionally performing a virtual round operation that precedes or follows the actual round operation on data. Additionally, when performing an actual round operation on data, other circuit configurations (e.g., different round cores) simultaneously perform virtual round operations, allowing an attacker to configure the information collected through the side channel to include noise. You can. Accordingly, the security level of the encryption circuit can be improved.

Figure 1 shows that encryption circuits 1150, 1250, and 1350 are included in data input/output devices 1100, 1200, and 1300. However, in one embodiment, the encryption circuits 1150, 1250, and 1350 may be implemented as an encryption device separate from the data input/output devices 1100, 1200, and 1300. Additionally, each of devices other than the data input/output devices 1100, 1200, and 1300 (eg, 1400) and the bus 1600 may also include an encryption circuit. Encryption circuits can be employed anywhere along the path where data is input or output. Exemplary configurations and operations of the encryption circuits 1150, 1250, and 1350 are described below with reference to the drawings.

Figure 2 is a block diagram showing an encryption circuit according to an exemplary embodiment of the present disclosure. The block diagram of the encryption circuit 100 of FIG. 2 may be, for example, a specific block diagram of the encryption circuits 1150, 1250, and 1350 of FIG. 1. In this drawing, the encryption operation is explained, but it will be obvious that the same description can be applied to the decryption operation.

Referring to FIG. 2, the encryption circuit 100 may include an encryption controller 110, a pipelined encryption core 120, and a buffer 130.

The encryption controller 110 may control the overall operation of the encryption circuit 100 in response to the request (REQ). The encryption controller 110 may store control values that indicate the performance and environment of encryption operations. Based on the control value, the encryption controller 110 may transmit control signals CON_C and CON_B to control the operations of the pipeline encryption core 120 and the buffer 130, respectively.

The encryption controller 110 may control the plurality of round cores 121 included in the pipeline encryption core 120 to perform a virtual encryption operation through the control signal CON_C. In one embodiment, the encryption controller 110 uses random data (D_RAN) input from the outside to determine how many times a virtual encryption operation will be performed before each of the plurality of round cores 121 performs the actual encryption operation. Alternatively, it is possible to determine how many times the virtual encryption operation will be performed after performing the actual encryption operation. Alternatively, the encryption controller 110 controls the pipeline encryption core 120 so that when a specific round core among the plurality of round cores 121 performs an actual round operation, other round cores perform a virtual round operation. can do. However, in this drawing, the encryption controller 110 is shown as receiving random data (D_RAN) from the outside, but the present disclosure is not limited to this, and the encryption controller 110 generates random data (D_RAN) internally. You may.

The pipeline encryption core 120 may sequentially receive the first to kth actual data (PT1 to PTk) of the unit in which the operation is performed from the buffer 130. The pipeline encryption core 120 may output the first to kth encrypted data (CT1 to CTk) through an actual encryption operation on the first to kth actual data (PT1 to PTk). The pipeline encryption core 120 may update the buffer 130 with the first encryption data (CT1) to the kth encryption data (CTk) on which the actual encryption operation has been performed. At this time, k may be a natural number of 3 or more, but is not limited to this, and the pipeline encryption core 120 may sequentially receive one or more actual data.

The pipeline encryption core 120 may perform an actual encryption operation, for example, through permutation that mixes the bit positions of each of the first to kth real data (PT1 to PTk) based on the actual encryption key. . Alternatively, the pipeline encryption core 120 may perform an encryption operation by replacing each of the first to kth actual data (PT1 to PTk) with other mapped data based on the encryption key.

The pipeline encryption core 120 may receive dummy data (VPT) or a dummy encryption key (VRK) from the buffer 130. The pipeline encryption core 120 may perform a virtual encryption operation using dummy data (VPT) or a dummy encryption key (VRK). For example, the pipeline encryption core 120 performs a virtual encryption operation using dummy data (VPT) and a dummy encryption key (VRK), or performs a virtual encryption operation using dummy data (VPT) and a real encryption key. , a virtual encryption operation can be performed using real data (PT1 to PT_k) and a dummy encryption key (VRK).

In one embodiment, the pipeline encryption core 120 may include a plurality of round cores 121 that each perform a round operation. The actual encryption operation performed in the pipeline encryption core 120 may include actual round operations by each of the round cores 121. Additionally, the virtual encryption operation performed in the pipeline encryption core 120 may include virtual round operations by each of the round cores 121. The round operation performed in the pipeline encryption core 120 may be divided into one of a real round operation and a virtual round operation depending on the type of input data (D_in) and encryption key.

The pipeline encryption core 120 may perform encryption operations on each of the first to kth real data (PT1 to PTk) in parallel. For example, at least two of the plurality of round cores 121 may perform one of a real round operation and a virtual round operation in parallel.

In one embodiment, the pipeline crypto core 120 is responsive to a control signal (CON_C) provided by the crypto controller 110, such that the initial round core performing the initial round operation performs at least one initial round operation before performing the initial actual round operation. An initial virtual round operation can be performed. Alternatively, the pipeline encryption core 120 may perform at least one initial virtual round operation after the initial round core performs the initial real round operation in response to the control signal (CON_C) provided from the encryption controller 110. . Accordingly, the security level of the encryption circuit 100 according to the present disclosure can be improved by making it difficult for an attacker to specify the point in time when the actual encryption operation is performed. A detailed description of the round operation operation of the pipeline encryption core 120 will be described later with reference to FIG. 6, etc.

In one embodiment, the pipelined cryptographic core 120 is responsive to a control signal (CON_C) provided from the cryptographic controller 110 such that the first round core performs the first virtual round operation while the initial round core performs the initial real round operation. Round operations can be performed. Therefore, by performing a virtual encryption operation together with an actual encryption operation, noise can be generated and the security level of the encryption circuit can be improved. A detailed description of the round operation operation of the pipeline encryption core 120 will be described later with reference to FIG. 10, etc.

The buffer 130 may temporarily store input data D_in provided from the outside. That is, the buffer 130 can store data on which the actual operation for encryption will be performed. At this time, in response to the control signal (CON_B) provided from the encryption controller 110, the buffer 130 divides the input data (D_in) into units in which the encryption operation is performed and provides the input data to the pipeline encryption core 120. . For example, the buffer 130 may sequentially provide the first to kth actual data (PT1 to PTk) to the pipeline encryption core 120.

Additionally, the buffer 130 can temporarily store random data (D_RAN) provided from the outside. In response to the control signal CON_B provided from the encryption controller 110, at least a portion of the random data D_RAN stored in the buffer 130 may be provided to the pipeline encryption core 120. For example, the buffer 130 may provide at least a portion of the random data (D_RAN) to the pipeline encryption core 120 as dummy data (VPT) for a virtual round operation. Or, for example, the buffer 130 may be provided to the pipeline encryption core 120 as a dummy encryption key (VRK) for a virtual round operation.

The buffer 130 may receive first to kth encrypted data (CT1) to kth encrypted data (CTk) from the pipeline encryption core 120. The buffer 130 may output the first encrypted data (CT1) to the kth encrypted data (CTk) as output data (D_out). Accordingly, the output data (D_out) may be encrypted input data (D_in).

Figure 3 is a block diagram showing a pipeline encryption core included in an encryption circuit according to an exemplary embodiment of the present disclosure. In this drawing, the encryption operation is explained, but it will be obvious that the same explanation can be applied to the decryption operation.

Referring to FIG. 3, the pipeline encryption core 120 includes an initial round core (121_i), first to nth round cores (121_1 to 121_n), an initial register (123_i), and an initial round core (121_i). It may include 1st to nth registers (123_1 to 123_n) and a key scheduler (125). For example, the initial round core 121_i and the first to nth round cores 121_1 to 121_n may be the plurality of round cores 121 of FIG. 2 . At this time, n may be a natural number of 3 or more, but the present disclosure is not limited thereto, and the number of round cores included in the pipeline encryption core 120 may be variously configured to be 1 or more. In one embodiment, the initial round core 121_i may not be included and only the first to nth round cores 121_1 to 121_n may be included.

The encryption operation performed in the pipeline encryption core 120 may include a plurality of round operations to increase the security level, and each round operation may be performed by a different round core. For example, the initial round core 121_i may perform an initial round operation, the first round core 121_1 may perform a first round operation, and the nth round core 121_n may perform an nth round operation. can be performed.

Each round operation may include a real round operation and a virtual round operation. For example, the initial round operation may include an initial real round operation and an initial virtual round operation, the first round operation may include a first real round operation and a first virtual round operation, and the nth round operation may be It may include an nth real round operation and an nth virtual round operation.

The initial round core 121_i and the first to nth round cores 121_1 to 121_n perform initial encryption operations using real data (e.g., PT1 to PTk) and actual encryption keys (e.g., RK0 to RKn), and The first to nth actual encryption operations can be performed. For example, the initial round core 121_i may perform an initial actual encryption operation using the first to kth actual data (PT1 to PTk) and the initial actual encryption key (RK0). At this time, the initial actual encryption key (RK0) corresponding to each of the first to kth actual data (PT1 to PTk) may be different from each other or may be the same. The description of the initial actual encryption operation of the initial round core 121_i may also be applied to the first to nth actual encryption operations of the first to nth round cores 121_1 to 121_n.

First to kth actual data (PT1 to PTk) may be input to the initial round core 121_i. For example, when the first real data (PT1) is input to the initial round core (121_i), the initial round core (121_i) may perform an initial real round operation on the first real data (PT1), and perform the initial round operation on the first real data (PT1). The result may be stored in the initial register 123_i. The performed result may be provided again to the first round core 121_1, and the first round core 121_1 may perform the first real round operation on the first real data PT1. The result of performing the first real round operation on the first real data PT1 may be stored in the first register 123_1. That is, the first real data PT1 may be encrypted into the first encrypted data CT1 through a total of (n+1) real round operations and output from the pipeline encryption core 120. The description of the actual encryption operation for the first real data (PT1) can also be applied to the actual encryption operation for the second real data (PT2) to the kth real data (PTk).

First to kth actual data (PT1 to PTk) may be sequentially input to the initial round core 121_i. The pipeline encryption core 120 may perform encryption operations in parallel on the first to kth actual data (PT1 to PTk) that are sequentially input. That is, the pipeline encryption core 120 can perform encryption operations on the first to kth actual data (PT1 to PTk) in a pipeline manner. For example, while the first round core 121_1 performs a first round operation on the first real data PT1, the initial round core 121_i performs an initial round operation on the second real data PT2. It can be done. While the second round core 121_2 performs the second round operation on the first real data PT1, the first round core 121_1 performs the first round operation on the second real data PT2, , the initial round core 121_i may perform a round operation on the third actual data PT3.

Each of the initial round core 121_i and the first to nth round cores 121_1 to 121_n may perform a virtual encryption operation using dummy data (VPT0 to VPTn) or virtual encryption keys (VRK0 to VRKn). For example, the initial round core 121_i may be provided with at least one of initial dummy data (VPT0) and an initial virtual encryption key (VRK0). For example, the initial round core 121_i performs a virtual encryption operation using initial dummy data (VPT0) and an initial virtual encryption key (VRK0), or performs a virtual encryption operation using initial dummy data (VPT0) and an initial real encryption key (RK0). A virtual encryption operation can be performed, or a virtual encryption operation can be performed using real data (PT1 to PT_k) and the initial virtual encryption key (VRK0). The description of the initial virtual encryption operation of the initial round core 121_i may also be applied to the first to nth virtual encryption operations of the first to nth round cores 121_1 to 121_n.

In one embodiment, the initial register 123_i may include a real initial register and a virtual initial register. The result of the initial virtual round operation of the initial round core 121_i may be stored in an initial virtual register and provided to the first round core 121_1, which is the next round core. The first round core 121_1 may receive the result and perform a first virtual round operation. Alternatively, in one embodiment, the result of the initial virtual round operation of the initial round core 121_i is stored in the initial virtual register, but may not be provided to the first round core 121_1. The description of the initial virtual round operation of the initial round core 121_i may also be applied to the first to n-1th virtual round operations of the first to n-1th round cores 121_1 to 121_n-1.

The key scheduler 125 may manage encryption keys used for encryption operations in response to control of the encryption controller (eg, 110 in FIG. 2). For example, by managing the actual encryption keys (RK0 to RKn) used in the actual encryption operation, the actual encryption keys (RK0 to RKn) to be used in each actual round operation are stored in the initial round core 121_i and the first to second round cores. It can be provided as n round cores (121_1 to 121_n). Additionally, the key scheduler 125 may manage virtual encryption keys (VRK0 to VRKn) used in virtual encryption operations in response to control of the encryption controller 110. The key scheduler 125 may include a memory for storing encryption keys (RK0 to RKn, VRK0 to VRKn), or may access encryption keys stored in other memories.

In this drawing, dummy data (e.g., VPT0 to VPTn) is shown as being provided to each of the initial round core 121_i and the first to nth round cores 121_1 to 121_n, but the present disclosure is not limited thereto. . In the pipeline encryption core 120 according to the present disclosure, dummy data may be provided to at least one round core among the initial round core 121_i and the first to nth round cores 121_1 to 121_n. In addition, in this drawing, it is shown that virtual encryption keys (for example, VRK0 to VRKn) are provided to each of the initial round core 121_i and the first to nth round cores 121_1 to 121_n, but the present disclosure does not provide this. Without being limited, a virtual encryption key may be provided to at least one round core among the initial round core 121_i and the first to nth round cores 121_1 to 121_n. Accordingly, the pipeline encryption core 120 of the present disclosure operates at least one round core among the initial round core 121_i and the first to nth round cores 121_1 to 121_n under the control of the encryption controller 110 to perform a virtual round. It may be configured to perform an operation.

FIG. 4 is a flowchart explaining an encryption operation performed in an encryption circuit according to an exemplary embodiment of the present disclosure, and is a diagram for explaining an actual encryption operation. For example, Figure 4 shows that the pipeline encryption core 120 of Figure 3 performs an encryption operation according to the Advanced Encryption Standard (AES) established by the U.S. National Institute of Standards and Technology (NIST). Explain. However, Figure 4 is provided to facilitate better understanding, and the present disclosure is not intended to be limited thereto. The encryption operation may be performed by the pipeline encryption core 120 under the control of an encryption controller (eg, 110 in FIG. 2).

Referring to FIGS. 3 and 4 , in step S110, the initial round core 121_i may perform the “AddRoundKey” operation. The "AddRoundKey" operation is a bitwise combinatorial logic operation (e.g., logical It may include performing a sum operation, logical product operation, exclusive logical sum operation, etc.). Accordingly, the actual data (PT1 to PTk) can be converted to other data based on the selected initial actual round key (RK0). In one embodiment, the “AddRoundKey” operation may be implemented as an exclusive logical sum (XOR) operation.

In operation S120, the first round core 121_1 may perform a substitution operation on data converted in the initial round core 121_i. In operation S122, the first round core 121_1 may perform a “ShiftRows” operation on the state of the data replaced in step S120. In the “ShiftRows” operation, rows of the data state can be shifted in a cyclic structure. In operation S124, the first round core 121_1 may perform a “MixColumns” operation on the data state shifted in operation S122. In the “MixColumns” operation, columns of data states can be mixed.

Thereafter, in step S126, the first round core 121_1 may perform an “AddRoundKey” operation on the converted data having the mixed state in step S124. The first round core 121_1 may perform a bit-wise combinational logic operation on the converted data and the first real round key RK1.

In step S130, the encryption controller (eg, 110 in FIG. 2) may determine whether the next round operation is the last round operation. The encryption controller 110 can manage the number of actual round operations. If the next round is not the last round, step S120 may be performed again. For example, in step S120, the second round core 121_2 may perform a substitution operation on the data converted in operation S126. On the other hand, if the next actual round operation is the last round operation, step S140 may be performed.

Steps S120 to S126 may constitute one real round operation, that is, each of the first to n-1th real round operations. The key scheduler 125 may select different actual round keys (RK1 to RKn-1) for each of the first to n-1th round cores (121_1 to 121_n-1) for the “AddRoundKey” operation in step S126.

In step S140, the nth round core 121_n may perform a substitution operation on the data converted in operation S126. In step S142, the nth round core 121_n may perform a “ShiftRows” operation on the state of the data replaced in step S140. In step S144, the nth round core 121_n may perform an “AddRoundKey” operation on the converted data having the shifted state in step S142. For example, after the last actual round operation (nth actual round operation) is completed, encrypted data (eg, first to kth encrypted data (CT1 to CTk)) may be output.

As the initial real round operation and the first to nth real round operations are sequentially performed, the data value may be gradually converted. After the last round operation consisting of steps S140 to S144 is completed, the final converted data is output as encrypted data (CT1 to CTk), making it difficult for an attacker to arbitrarily manipulate or damage the encrypted data (CT1 to CTk). there is.

This figure shows only the initial real round operation and the first to nth real round operation of the initial round core 121_i and the first to nth round cores 121_1 to 121_n, but can also be applied to virtual round operation. . For example, the initial round core 121_i may be provided with at least one of initial dummy data (VPT0) and an initial virtual encryption key (VRK0), and at least one of the initial dummy data (VPT0) and an initial virtual encryption key (VRK0). The initial virtual round operation can be performed by performing step S110 using one. In addition, the first round core 121_1 may be provided with at least one of first dummy data VPT1 and a first virtual encryption key VRK1, and the first dummy data VPT1 and the first virtual encryption key VRK1 ) The first virtual round operation can be performed by performing steps S120 to S126 using at least one of the following. In addition, the n-th round core 121_n may be provided with at least one of n-th dummy data (VPTn) and an n-th virtual encryption key (VRKn), and the n-th dummy data (VPTn) and the n-th virtual encryption key (VRKn) may be provided. The nth virtual round operation can be performed by performing steps S140 to S144 using at least one of the following.

Figure 5 is a flowchart for explaining the operation of an encryption controller of an encryption circuit according to an exemplary embodiment of the present disclosure. In this drawing, the encryption operation is explained, but it will be obvious that the same description can be applied to the decryption operation.

Referring to FIGS. 2, 3, and 5, in step S210, the encryption controller 110 may determine a round core to perform a virtual round operation among the plurality of round cores 111. In one embodiment, the encryption controller 110 may determine a round core that is vulnerable to an attacker's attack as a round core that will perform a virtual round operation. For example, the encryption controller 110 may select the initial round core 121_i through which actual data is input or the nth round core 121_n through which encrypted data is output. When the first real data (PT1) is input to the initial round core (121_i), the first to nth round cores (121_1 to 121_n) excluding the initial round core (121_i) are not performing the actual round operation, so the attacker's May be vulnerable to side channel analysis attacks. Additionally, since data is first input to the nth round core 121_n during a decryption operation, the nth round core 121_n may be vulnerable to an attacker's side-channel analysis attack for the same reason as the initial round core 121_i. In one embodiment, in step S210, the determined round core may continuously perform a real round operation and a virtual round operation.

In step S220, the encryption controller 110 may determine the ratio of virtual round operations to actual round operations to be performed on the determined round core. In one embodiment, the sum of the number of real round operations and virtual round operations may be a power of 2. That is, the ratio of virtual round operations to actual round operations may be the exponent of 2 minus 1. For example, the encryption controller 110 may determine that when the actual round operation is performed once, the virtual round operation is performed three times.

In step S230, the encryption controller 110 may determine the number of virtual round operations to be performed before/after the actual round operation on the determined round core. In one embodiment, the encryption controller 110 uses random data (D_RAN) input from the outside to perform virtual rounds to be performed before and after performing the actual round operation on each of the first to kth real data (PT1 to PTk). The number of round operations can be determined randomly. For example, based on the actual round operation, the preceding virtual round operation may be set to 0 times and the following virtual round operation may be set to 3 times, or the preceding virtual round operation may be set to 1 time and the following virtual round operation may be set to 2 times. It may be possible. Or, for example, based on the actual round operation, the preceding virtual round operation is set to 2 times and the following virtual round operation is set to 1 time, or the preceding virtual round operation is set to 3 times and the following virtual round operation is set to 0 times. It could be.

The encryption controller 110 may output a control signal CON_C to the pipeline encryption core 120 based on what is determined in steps S210 to S230. The pipeline encryption core 120 may perform a real round operation and a virtual round operation based on the received control signal.

Therefore, since the encryption circuit 100 according to the present disclosure performs at least one virtual round operation before/or after the actual round operation, it may be difficult for an attacker to specify the point in time when the actual round operation is performed. Accordingly, the security level of the encryption circuit 100 can be improved.

6 to 8 are timing diagrams for explaining the operation of an encryption circuit according to an exemplary embodiment of the present disclosure. FIGS. 6 to 8 are for explaining the operation of the pipeline encryption core according to the operation of the encryption controller according to FIG. 5. In this drawing, the encryption operation is explained, but it will be obvious that the same description can be applied to the decryption operation.

Referring to FIG. 6, among the plurality of round cores 121_i and 121_1 to 121_n, some round cores may be determined as round cores that will sequentially perform real round operations and virtual round operations. For example, the initial round core 121_i and the nth round core 121_n may be determined. However, the present disclosure is not limited to the initial round core 121_i and the nth round core 121_n performing the virtual round operation, and other round cores may also perform the virtual round operation.

In one embodiment, the ratio of virtual round operations to actual round operations to be performed in each of the initial round core 121_i and the nth round core 121_n may be the same. At this time, the ratio of the virtual round operation to the actual round operation to be performed in each of the initial round core 121_i and the nth round core 121_n may be 3. One real round operation and three virtual round operations can be divided into one round operation set (OPS).

In the initial round core 121_i, one round operation set (OPS) for real data (e.g., real data of one of the first real data (PT1 to PTk)) must be completed, and then the first round, which is the next round core, must be completed. The core 121_1 may perform a first real round operation on the real data. Even though one round operation set (OPS) has not ended in the initial round core (121_i), if the first actual round operation is performed in the first round core (121_1) immediately after the initial actual round operation has ended, the attacker can It may become easier to infer the execution time of the initial actual round operation in the round core 121_i. Accordingly, after one round operation set (OPS) for real data ends, the first round core 121_1 may be configured to perform a first real round operation on the real data.

When the initial round core 121_i performs the initial real round operation on each of the first to kth real data (PT1 to PTk), the number of initial virtual round operations preceding/following the initial real round operation may be random. You can. For example, in one round operation set (OPS), one initial real round operation and three initial virtual round operations may be performed randomly. In addition, when the nth round core 121_n performs the nth real round operation on each of the first to kth real data (PT1 to PTk), the nth virtual round operation performed before and after the nth real round operation is performed. The number of times may be random. Therefore, it may be difficult for an attacker to specify when the initial actual round operation and the nth actual round operation are performed.

At least two round cores among the plurality of round cores 121_i, 121_1 to 121_n may include a section that simultaneously performs a virtual round operation or an actual round operation. For example, the round operation set (OPS) operation for the second real data (PT2) of the initial round core (121_i) is the first real round for the first real data (PT1) of the first round core (121_1). Operations can be performed in parallel with each other. In addition, the round operation set (OPS) operation for the first real data (PT1) of the n-th round core (121_n) is the first operation for the second real data (PT2) of the n-1th round core (121_n-1). They can be performed in parallel with n-1 actual round operations. Therefore, the encryption circuit according to the present disclosure performs encryption operations on different data simultaneously, making it difficult for an attacker to carry out a side-channel analysis attack.

Referring to FIG. 7, each of the plurality of round cores 121_i, 121_1 to 121_n may continuously perform real round operations and virtual round operations. In one embodiment, the ratio of virtual round operations to actual round operations to be performed in each of the round cores 121_i and 121_1 to 121_n may be the same. For example, the ratio of virtual round operations to actual round operations may be 3. One real round operation and three virtual round operations can be divided into one round operation set (OPS).

At least two round cores among the plurality of round cores 121_i, 121_1 to 121_n may include a section that simultaneously performs a virtual round operation or an actual round operation. For example, the round operation set (OPS) operation for the second real data (PT2) of the initial round core (121_i) is a round operation set (OPS) operation for the first real data (PT1) of the first round core (121_1) OPS) operations can be performed in parallel with each other. In addition, the round operation set (OPS) operation for the first real data (PT1) of the nth round core (121_n) is a round operation for the second real data (PT2) of the n-1th round core (121_n-1). Operation set (OPS) operations can be performed in parallel with each other.

Referring to FIG. 8, at least some of the round cores among the plurality of round cores 121_i and 121_1 to 121_n may continuously perform real round operations and virtual round operations. For example, the initial round core (121_i), the first round core (121_1), the n-1th round core (121_n-1), and the nth round core (121_n) sequentially perform real round operations and virtual round operations. can do.

In one embodiment, a virtual round for the actual round operation to be performed on each of the initial round core 121_i, the first round core 121_1, the n-1th round core 121_n-1, and the nth round core 121_n. The ratios of operations may not be the same. For example, the encryption controller 110 may determine the ratio of virtual round operations to round operations to be higher as the round core is expected to be vulnerable to an attacker's attack. For example, the ratio of virtual round operations to actual round operations to be performed on each of the initial round core 121_i and the n-th round core 121_n may be 3, and 1 real round operation and 3 virtual round operations are performed. It can be divided into one round operation set (OPSi, OPSn). On the other hand, the ratio of virtual round operations to actual round operations to be performed in each of the first round core (121_1) and the n-1th round core (121_n-1) may be 1, and one real round operation and one virtual round operation may be performed. Round operations can be divided into one round operation set (OPS1, OPSn-1). In one round operation set (OPSi, OPS1, OPSn-1, OPSn), the actual round operation and the virtual round operation can be performed randomly based on a set ratio.

9 is a flowchart for explaining the operation of an encryption controller of an encryption circuit according to an exemplary embodiment of the present disclosure. In this drawing, the encryption operation is explained, but it will be obvious that the same description can be applied to the decryption operation.

Referring to FIGS. 2, 3, and 9, in step S310, the encryption controller 110 may determine a round core to perform a virtual round operation when another round core is performing an actual round operation. For example, the encryption controller 110 may determine the first round core 121_1 as a round core to perform a virtual round operation.

In step S320, the encryption controller 110 may set a virtual operation section in which the round core determined in step S310 performs a virtual round operation. In one embodiment, the encryption controller 110 may set the period from the start to the end of the encryption operation for the first to kth real data (PT1 to PTk) as a virtual operation period. In one embodiment, the encryption controller 110 may set a section vulnerable to an attacker's side-channel analysis attack as a virtual operation section, for example, only one real round operation is performed or two real round operations are performed in parallel. The section performed can be set as a virtual operation section.

In step S330, the encryption controller 110 may check whether the round core determined in step S310 is scheduled to actually perform the round operation. For example, it can be confirmed whether the first round core 121_1 is scheduled to perform an actual round operation within the virtual operation section set in step S320.

If the determined round core is not scheduled to perform the actual round operation, in step S340, the determined round core may be controlled to perform the virtual round operation while the other round core is performing the actual round operation. On the other hand, if the determined round core is scheduled to perform the actual round operation, in step S350, the determined round core can also be controlled to perform the actual round operation while the other round core is performing the actual round operation.

In step S360, the encryption controller 110 may check whether the virtual operation section has ended, and if the virtual operation section has not ended, step S330 may be performed again. On the other hand, if the virtual operation section has ended, it can be ended without performing the virtual round operation.

The encryption circuit 100 according to the present disclosure may generate noise by performing a virtual round operation on a round core that does not perform operations other than the round core currently performing the actual round operation. Accordingly, an attacker's side-channel analysis attack may become difficult, and the security level of the encryption circuit 100 may be improved.

10 to 12 are timing diagrams for explaining the operation of an encryption circuit according to an exemplary embodiment of the present disclosure. FIGS. 10 to 12 are for explaining the operation of the pipeline encryption core according to the operation of the encryption controller according to FIG. 9. In this drawing, the encryption operation is explained, but it will be obvious that the same description can be applied to the decryption operation.

Referring to FIG. 10, when other round cores are performing an actual round operation, some of the round cores among the plurality of round cores 121_i, 121_1 to 121_n may be determined as round cores to perform a virtual round operation. For example, the first round core 121_1 and the n-1th round core 121_n-1 may be determined. At this time, the virtual operation section (VOP) in which the first round core (121_1) and the n-1th round core (121_n-1) will perform the virtual round operation is for the first to kth real data (PT1 to PTk). It can be set as the section from when the encryption operation starts to when it ends.

The first round core (121_1) and the n-1th round core (121_n-1), which are part of the plurality of round cores (121_i, 121_1 to 121_n), each perform a first real round operation and an n-1th real round operation. When not doing so, the first virtual round operation and the n-1th virtual round operation can be performed. The encryption circuit according to the present disclosure may include a section in which at least two round cores among the plurality of round cores 121_i and 121_1 to 121_n simultaneously perform a virtual round operation or an actual round operation. Therefore, in the encryption circuit according to the present disclosure, the real round operation and the virtual round operation are performed together, so after the encryption operation starts, only the initial real round operation is performed on the first real data (PT1), allowing the attacker to attack the side channel analysis attack. This can be prevented from becoming easier. In addition, only the n-th real round operation is performed on the k-th real data (PTk), thereby preventing an attacker from easily conducting a side-channel analysis attack.

Referring to FIG. 11, when another round core is performing an actual round operation, a plurality of round cores 121_i, 121_1 to 121_n may be determined as round cores to perform a virtual round operation. At this time, the virtual operation section (VOP) in which the plurality of round cores 121_i, 121_1 to 121_n will perform the virtual round operation ends when the encryption operation for the first to kth real data (PT1 to PTk) starts. It may be a section until it becomes possible.

Each of the plurality of round cores 121_i, 121_1 to 121_n may perform a virtual round operation when not performing an actual round operation. Therefore, in the encryption circuit according to the present disclosure, the real round operation and the virtual round operation are performed together, so after the encryption operation starts, only the initial real round operation is performed on the first real data (PT1), allowing the attacker to attack the side channel analysis attack. This can be prevented from becoming easier.

Referring to FIG. 12, when other round cores are performing an actual round operation, some of the round cores among the plurality of round cores 121_i, 121_1 to 121_n may be determined as round cores to perform a virtual round operation. For example, the first round core 121_1 and the n-1th round core 121_n-1 may be determined.

At this time, the initial real round operation on the first real data PT1 is performed as the first virtual operation section VOP1 in which the virtual round operation is performed, the first real round operation on the first real data PT1, and A section in which the initial actual round operation on the second actual data PT2 is performed may be set. In addition, as the second virtual operation section (VOP2) in which the virtual round operation is performed, the nth real round operation for the k-1th real data (PTk-1) and the n-1th real round operation for the kth real data (PTk) A round operation is performed, and a section in which the nth actual round operation is performed on the kth actual data (PTk) can be set.

If virtual round operations are not performed in the first virtual operation section (VOP1) and the second virtual operation section (VOP2), only one or two actual round operations are performed, making it vulnerable to attacks. Therefore, it is possible to prepare for attacks by setting a section that is relatively vulnerable to attacks as a virtual operation section and performing additional virtual round operations. The first virtual operation section (VOP1) and the second virtual operation section (VOP2) are set to a partial section rather than the entire section in which the encryption operation for the first to kth real data (PT1 to PTk) is performed, thereby attacking the attacker. It is possible to generate noise in sections judged to be vulnerable and at the same time reduce power consumption.

13 is a timing diagram for explaining the operation of an encryption circuit according to an exemplary embodiment of the present disclosure. FIG. 13 is for explaining the operation of the pipeline encryption core according to the operation of the encryption controller according to FIGS. 5 and 9. In this drawing, the encryption operation is explained, but it will be obvious that the same description can be applied to the decryption operation.

Referring to FIG. 13, among the plurality of round cores 121_i, 121_1 to 121_n, some round cores may be determined as round cores that will continuously perform real round operations and virtual round operations, for example, initial round cores. (121_i) and the nth round core (121_n) may be determined. However, the present disclosure is not limited to this, and a plurality of round cores 121_i, 121_1 to 121_n may be determined as round cores that will sequentially perform real round operations and virtual round operations.

In one embodiment, the ratio of virtual round operations to actual round operations to be performed in each of the initial round core 121_i and the nth round core 121_n may be the same. For example, the ratio of virtual round operations to actual round operations to be performed on each of the initial round core 121_i and the n-th round core 121_n may be 3, and 1 real round operation and 3 virtual round operations are performed. It can be divided into one round operation set (OPS). In one embodiment, the ratio of virtual round operations to actual round operations to be performed in each of the initial round core 121_i and the nth round core 121_n may be different.

When the initial round core 121_i performs the initial real round operation on each of the first to kth real data (PT1 to PTk), the number of initial virtual round operations performed before and after the initial real round operation may be random. . That is, in one round operation set (OPS), one initial real round operation and three initial virtual round operations can be performed randomly. Additionally, in one round operation set (OPS), one n-th real round operation and three n-th virtual round operations may be performed randomly. Therefore, it may be difficult for an attacker to specify when the initial actual round operation and the nth actual round operation are performed.

When another round core is performing an actual round operation, at least some of the round cores among the plurality of round cores 121_i, 121_1 to 121_n may be determined as the round core to perform the virtual round operation. For example, the first round core 121_1 and the n-1th round core 121_n-1 may be determined. At this time, the virtual operation section (VOP) in which the first round core (121_1) and the n-1th round core (121_n-1) will perform the virtual round operation is for the first to kth real data (PT1 to PTk). It may be at least a portion of the section from the start to the end of the encryption operation. For example, the virtual operation section (VOP) is where the encryption operation is performed on the first to kth real data (PT1 to PTk). It may be the entire section.

The first round core (121_1) and the n-1th round core (121_n-1), which are part of the plurality of round cores (121_i, 121_1 to 121_n), each perform a first real round operation and an n-1th real round operation. When not doing so, the first virtual round operation and the n-1th virtual round operation can be performed. Therefore, in the encryption circuit according to the present disclosure, the real round operation and the virtual round operation are performed together, so after the encryption operation starts, only the initial real round operation is performed on the first real data (PT1), allowing the attacker to attack the side channel analysis attack. This can be prevented from becoming easier. In addition, only the n-th real round operation is performed on the k-th real data (PTk), thereby preventing an attacker from easily conducting a side-channel analysis attack.

The description of the above-described embodiments is merely an example with reference to the drawings for a more thorough understanding of the present disclosure, and should not be construed as limiting the present disclosure. In addition, it will be clear to those skilled in the art to which this disclosure pertains that various changes and modifications can be made without departing from the basic principles of the present disclosure.

100: encryption circuit
110: Cryptographic Controller
120: Pipeline encryption core
130: buffer

Claims (20)

a pipeline encryption core that includes a plurality of round cores that perform an actual round operation on each of sequentially input input data, and outputs encrypted data through an encryption operation using the actual round operation; and
Comprising: an encryption controller that controls at least one round core among the plurality of round cores to additionally perform a virtual round operation,
The encryption controller is,
Controlling the virtual round operation of the at least one round core to be performed in parallel with the actual round operation of at least one other round core among the plurality of round cores,
the real round operation performed by the at least one other round core further encrypts input data previously encrypted by the round core performing the virtual round operation,
As the virtual round operation is performed, result data according to the virtual round operation is generated during at least a portion of a second time interval that is a multiple of the first time interval in which the actual round operation is performed. According to claim 1,
The encryption controller is,
Determining the at least one round core among the plurality of round cores as a round core to perform the virtual round operation,
Determine a ratio of the virtual round operation to the actual round operation to be performed on the determined round core,
An encryption circuit, characterized in that controlling the determined round core to perform the real round operation and the virtual round operation based on the ratio. According to clause 2,
The encryption controller is,
Based on the ratio, randomly determine the number of virtual round operations to be performed prior to the real round operation and the number of virtual round operations to be performed after the real round operation,
An encryption circuit, characterized in that controlling the determined round core to perform the real round operation and the virtual round operation based on the determined number of times. According to clause 2,
The encryption controller is,
An encryption circuit characterized in that, among the plurality of round cores, an initial round core to which the input data is first input is determined as a round core to perform the virtual round operation. According to clause 2,
The encryption controller is,
An encryption circuit, characterized in that determining the last round core to which the encrypted data is output among the plurality of round cores as the round core to perform the virtual round operation. According to clause 2,
The encryption controller is,
An encryption circuit, characterized in that determining the plurality of round cores as round cores to perform the virtual round operation. According to clause 2,
The encryption controller is,
Determine different round cores as round cores to perform the virtual round operation,
An encryption circuit, wherein the ratio of the virtual round operation to the actual round operation performed in each of the different round cores is different. According to claim 1,
The encryption controller is,
Among the plurality of round cores, determine a round core to perform the virtual round operation when another round core performs an actual round operation,
Setting a virtual operation section in which the determined round core will perform the virtual round operation,
An encryption circuit, characterized in that controlling the determined round core to additionally perform the virtual round operation during the virtual operation period. According to clause 8,
The encryption controller is,
An encryption circuit, characterized in that the section in which the pipeline encryption core performs the encryption operation is set as the virtual operation section. According to clause 8,
The encryption controller is,
An encryption circuit characterized in that the virtual operation section is set to include a section in which an initial round core to which the input data is input first among the plurality of round cores performs an operation on the data to be input first among the input data. . According to clause 8,
The encryption controller is,
An encryption circuit, wherein the virtual operation section is set to include a section in which the last round core outputting the encrypted data among the plurality of round cores performs an operation on the last input data among the input data. According to claim 1,
The encryption controller is,
Determining a first round core among the plurality of round cores to sequentially perform the real round operation and the virtual round operation,
Among the plurality of round cores, determine a second round core to perform the virtual round operation when another round core performs the actual round operation,
An encryption circuit, characterized in that controlling the first round core and the second round core to perform the real round operation and the virtual round operation. a first round core that performs a first actual round operation on input data;
a second round core that performs a second real round operation on the input data based on the first real round operation result; and
A key scheduler that provides round keys to the first round core and the second round core, respectively,
The first round core further performs a first virtual round operation based on one of dummy data and a first virtual round key provided from the key scheduler,
The first virtual round operation of the first round core is performed in parallel with the second real round operation,
The second round core further performs a second virtual round operation based on one of the second virtual round key and dummy data provided from the key scheduler,
the ratio of the first virtual round operations to the first real round operations has a first value, the ratio of the second virtual round operations to the second real round operations has a second value, and the first value and the second values are different from each other. delete delete delete According to claim 13,
The first round core performs the first virtual round operation while the second real round operation is performed after the first real round operation is completed. a first round core that performs a first actual round operation on input data;
a second round core that performs a second real round operation on the input data based on the first real round operation result; and
A key scheduler that provides round keys to the first round core and the second round core, respectively,
The first round core further performs a first virtual round operation based on one of dummy data and a first virtual round key provided from the key scheduler,
The second round core further performs a second virtual round operation based on one of dummy data and a second virtual round key provided from the key scheduler,
The first real round operation of the first round core is performed in parallel with the second virtual round operation of the second round core,
the ratio of the first virtual round operations to the first real round operations has a first value, the ratio of the second virtual round operations to the second real round operations has a second value, and the first value and the second values are identical to each other. According to clause 18,
An encryption circuit, wherein the second round core performs the second virtual round operation within a designated virtual operation period. According to clause 18,
The second round core performs the second virtual round operation while the first real round operation is performed before performing the second real round operation.

Images