CN111950039A

CN111950039A - Data processing device and method, memory controller, processor and electronic equipment

Info

Publication number: CN111950039A
Application number: CN202010828277.9A
Authority: CN
Inventors: 周鹏; 赵凤海
Original assignee: Haiguang Information Technology Co Ltd
Current assignee: Haiguang Information Technology Co Ltd
Priority date: 2020-08-17
Filing date: 2020-08-17
Publication date: 2020-11-17

Abstract

The application provides a data processing device and method, a memory controller, a processor and electronic equipment, and relates to the technical field of computers. The data processing apparatus includes: the key expander is used for performing multi-cycle expansion operation on a preset initial key to obtain a round key required by decrypting the data before the encryption and decryption circuit obtains the data to be decrypted, and storing the round key into a corresponding storage unit; a multiplexer for obtaining the round key from the storage unit; and the encryption and decryption circuit is used for carrying out multi-cycle decryption operation on the data by using the round key. It can be understood that before the data to be decrypted is obtained, the round key required for decrypting the data is obtained by the key expander through the multi-cycle expansion process in advance, so that when the data reaches the encryption and decryption circuit, the data can be directly decrypted by using the round key obtained in advance without waiting, and the decryption efficiency is greatly improved.

Description

Data processing device and method, memory controller, processor and electronic equipment

Technical Field

The present disclosure relates to the field of computer technologies, and in particular, to a data processing apparatus and method, a memory controller, a processor, and an electronic device.

Background

At present, in the SM4 algorithm adopted by mainstream manufacturers, key expansion needs to be completed in 32 cycles, that is, 32 cycles, and encryption and decryption of data by using an expanded key while key expansion also needs to be completed in 32 cycles, that is, 32 cycles.

The method can realize the basic synchronization of key expansion and encryption when encryption is carried out, so the efficiency is good. However, in the decryption, 32 cycles of expansion are required to expand the round key required for decryption, and then 32 cycles of reverse expansion are used to decrypt the data synchronously. This results in that after the data to be decrypted arrives, it is necessary to wait for 32 cycles of the expanded round key to decrypt, which results in a low decryption efficiency.

Disclosure of Invention

Embodiments of the present disclosure provide a data processing apparatus and method, a memory controller, a processor, and an electronic device, so as to improve decryption efficiency.

In a first aspect, an embodiment of the present application provides a data processing apparatus, where the apparatus includes: the key expander is used for performing multi-cycle expansion operation on a preset initial key to obtain a round key required by decrypting the data before the encryption and decryption circuit obtains the data to be decrypted, and storing the round key into a corresponding storage unit; a multiplexer for obtaining the round key from the storage unit; and the encryption and decryption circuit is used for carrying out multi-cycle decryption operation on the data by using the round key.

In the embodiment of the application, the key expander is added, and before the data to be decrypted is obtained, the round key required by decrypting the data is obtained and stored by the key expander through the multi-cycle expansion process in advance, so that when the data reaches the encryption and decryption circuit, the obtained round key can be directly used for decrypting without waiting, and the decryption efficiency is improved.

With reference to the first aspect, in a first possible implementation manner, N is a total cycle number of the multi-cycle expansion operation, N is an integer greater than 1, N is a positive integer, and N sequentially takes from 1 to N, where the N-th cycle of the expansion operation performed by the key expander is: performing expansion operation on data participating in the expansion operation of the nth period by using preset parameters to obtain a round key obtained by the expansion operation of the nth period; if n is 1, the data participating in the expansion operation of the nth period is the initial key; if n is more than 1, the data participating in the expansion operation of the nth period is a round key obtained by the expansion operation of the (n-1) th period; and if N is equal to N, the round key obtained by the expansion operation of the nth period is the round key which needs to be stored in the storage unit.

In the embodiment of the application, the key expander takes the expanded data of each period as the basis for the expansion of the next period, so that the orderly and efficient key expansion can be realized.

With reference to the first possible implementation manner of the first aspect, in a second possible implementation manner, both the number of data participating in the expansion operation in each period and the number of round keys obtained by the expansion operation in the period are X/N, where X is the total number of all keys involved in the multi-period expansion operation, and X/N is an integer greater than 1.

In the embodiment of the application, because the number of the expanded keys in each period is more than 1, the number of the key expansion periods is reduced, and the key expansion efficiency is improved.

With reference to the first aspect, in a third possible implementation manner, the encryption and decryption circuit includes: a key period expansion operation unit and a data encryption and decryption operation unit; m is the total cycle number of the multi-cycle decryption operation, and M is an integer greater than 1; m is a positive integer, and M is from 1 to M in sequence; the m-th cycle inverse expansion operation performed by the key cycle expansion operation unit is as follows: performing inverse expansion operation on the data participating in the inverse expansion operation of the mth period by using preset parameters to obtain data obtained by the inverse expansion operation of the mth period; if m is 1, the data participating in the m-th cycle of inverse spreading operation is the round key stored in the storage unit, and the data obtained by the m-th cycle of inverse spreading operation is the round key; if m is larger than 1, the data participating in the m-th cycle of inverse expansion operation is a round key obtained by the m-1-th cycle of inverse expansion operation; if M is equal to M, the data obtained by the M-th cycle of the inverse expansion operation is the initial key; the decryption operation of the m-th cycle executed by the data encryption and decryption operation unit is as follows: decrypting the data participating in the decryption operation of the mth period by using the key required by the decryption operation of the mth period to obtain decrypted data obtained by the decryption operation of the mth period; if m is 1, the key required for the decryption operation in the mth period is the round key stored in the storage unit, and the data participating in the decryption operation in the mth period is the data to be decrypted; if m is greater than 1, the key required by the decryption operation of the mth period is the data obtained by the inverse expansion operation of the (m-1) th period, and the data participating in the decryption operation of the mth period is the decryption data obtained by the decryption operation of the (m-1) th period.

In the embodiment of the application, the key synchronization of the back expansion of each period is used for decrypting data, so that the synchronization of decryption and key back expansion is realized, and the data decryption is ensured to be carried out efficiently. In addition, because the round key obtained by the multi-period expansion operation in advance can be directly used for decrypting the first period of the data, compared with a mode that the round key obtained by the multi-period expansion operation is subjected to first round key back expansion, and then the keys of the first round key back expansion in the periods are used for decrypting the first period of the data, the method saves the time of one period and further improves the decryption efficiency.

With reference to the third possible implementation manner of the first aspect, in a fourth possible implementation manner, the number of data participating in the inverse spreading operation in each period and the number of data obtained by the inverse spreading operation in the period are both Y/M, where Y is the total number of all keys involved in the multi-period inverse spreading operation, and Y/M is an integer greater than 1; the number of the data to be decrypted participating in the decryption operation of each period and the number of the decrypted data obtained by the decryption operation of the period are both Z/M, wherein Z is the total number of all data involved in the decryption process, and Z/M is an integer greater than 1.

In the embodiment of the application, because the number of the key for the reverse expansion in each period and the number of the data participating in the decryption in each period are more than 1, the number of the key for the reverse expansion and the data period decryption is reduced, and the data decryption efficiency is improved.

With reference to the first aspect, in a fifth possible implementation manner, the multiplexer is further configured to obtain the initial key when data to be encrypted needs to be encrypted; the encryption and decryption circuit is further configured to perform multi-cycle encryption operation on the data to be encrypted by using the initial key.

In the embodiment of the application, the data processing device can be used for not only efficient data decryption but also efficient data encryption, so that the data processing device has strong applicability in practice.

With reference to the fifth possible implementation manner of the first aspect, in a sixth possible implementation manner, the encryption and decryption circuit includes: a key period expansion operation unit and a data encryption and decryption operation unit; n is the total cycle number of the multi-cycle encryption operation, N is an integer greater than 1, N is a positive integer, and N is from 1 to N in sequence; the n-th cycle expansion operation performed by the key cycle expansion operation unit is as follows: performing expansion operation on the data participating in the expansion operation of the nth period by using preset parameters to obtain data obtained by the expansion operation of the nth period; if n is 1, the data participating in the n-th cycle of inverse expansion operation is the initial key, and the data obtained by the n-th cycle of expansion operation is a round key; if n is more than 1, the data participating in the expansion operation of the nth period is a round key obtained by the expansion operation of the (n-1) th period; if N is equal to N, the data obtained by the expanding operation of the nth period is the round key stored in the storage unit; the data encryption and decryption operation unit is used for executing the encryption operation of the nth cycle as follows: encrypting data participating in the encryption operation of the nth period by using a key required by the encryption operation of the nth period to obtain encrypted data obtained by the encryption operation of the nth period; if n is 1, the data participating in the encryption operation of the nth period is the data to be encrypted; if n is more than 1, the data participating in the encryption operation of the nth period is the encryption data obtained by the encryption operation of the (n-1) th period; the key required by the encryption operation of the nth period is data obtained by the expansion operation of the (n-1) th period.

In the embodiment of the application, the expanded key synchronization of each period is used for data encryption, so that the synchronization of encryption and key expansion is realized, and the data encryption is ensured to be performed efficiently.

With reference to the first aspect, in a seventh possible implementation manner, the multiplexer is configured to receive the round key output by the storage unit.

In the embodiment of the application, the multiplexer directly receives the round key output by the storage unit, so that the time of interaction with the storage unit is omitted, and the round key acquisition efficiency is improved.

With reference to the first aspect, in an eighth possible implementation manner, the multiplexer is configured to output the round key to the encryption and decryption circuit under the trigger of an enable signal sent by a virtual machine.

In the embodiment of the present application, since the multiplexer outputs the round key by being triggered by the enable signal, in other words, the multiplexer outputs the round key by being implemented in hardware, which is more efficient than that implemented in software.

In a second aspect, an embodiment of the present application provides a data processing method, where the method includes: when the data to be decrypted needs to be decrypted, obtaining a round key needed for decrypting the data from a storage unit, wherein the round key is as follows: before the data are acquired, acquiring and storing the data in the storage unit by performing multi-cycle expansion operation on a preset initial key; and carrying out multi-period decryption operation on the data by using the round key.

With reference to the second aspect, in a first possible implementation manner, N is a total cycle number of the multi-cycle expansion operation, N is an integer greater than 1, N is a positive integer, and N sequentially takes 1 to N, and the step of executing the expansion operation of the nth cycle includes: performing expansion operation on data participating in the expansion operation of the nth period by using preset parameters to obtain a round key obtained by the expansion operation of the nth period; if n is 1, the data participating in the expansion operation of the nth period is the initial key; if n is more than 1, the data participating in the expansion operation of the nth period is a round key obtained by the expansion operation of the (n-1) th period; and if N is equal to N, the round key obtained by the expansion operation of the nth period is the round key which needs to be stored in the storage unit.

With reference to the first possible implementation manner of the second aspect, in a second possible implementation manner, both the number of data participating in the expansion operation in each period and the number of round keys obtained by the expansion operation in the period are X/N, where X is the total number of all keys involved in the multi-period expansion operation, and X/N is an integer greater than 1.

With reference to the second aspect, in a third possible implementation manner, where M is a total cycle number of a multi-cycle decryption operation, and M is an integer greater than 1, the performing, by using the round key, the multi-cycle decryption operation on the data includes: firstly, executing the reverse expansion operation of the mth period, and then executing the decryption operation of the mth period, wherein M is a positive integer, and M sequentially takes 1 to M, wherein the reverse expansion operation of the mth period is as follows: performing inverse expansion operation on the data participating in the inverse expansion operation of the mth period by using preset parameters to obtain data obtained by the inverse expansion operation of the mth period; if m is 1, the data participating in the m-th cycle of inverse spreading operation is the round key stored in the storage unit, and the data obtained by the m-th cycle of inverse spreading operation is the round key; if m is larger than 1, the data participating in the m-th cycle of inverse expansion operation is a round key obtained by the m-1-th cycle of inverse expansion operation; if M is equal to M, the data obtained by the M-th cycle of the inverse expansion operation is the initial key; and the decryption operation of the mth period is as follows: decrypting the data participating in the decryption operation of the mth period by using the key required by the decryption operation of the mth period to obtain decrypted data obtained by the decryption operation of the mth period; if m is 1, the key required for the decryption operation in the mth period is the round key stored in the storage unit, and the data participating in the decryption operation in the mth period is the data to be decrypted; if m is greater than 1, the key required by the decryption operation of the mth period is the data obtained by the inverse expansion operation of the (m-1) th period, and the data participating in the decryption operation of the mth period is the decryption data obtained by the decryption operation of the (m-1) th period.

With reference to the third possible implementation manner of the second aspect, in a fourth possible implementation manner, the number of data participating in the inverse spreading operation in each period and the number of data obtained by the inverse spreading operation in the period are both Y/M, where Y is the total number of all keys involved in the multi-period inverse spreading operation, and Y/M is an integer greater than 1; the number of the data to be decrypted participating in the decryption operation of each period and the number of the decrypted data obtained by the decryption operation of the period are both Z/M, wherein Z is the total number of all data involved in the decryption process, and Z/M is an integer greater than 1.

With reference to the second aspect, in a fifth possible implementation manner, the method further includes: when data to be encrypted needs to be encrypted, the initial key is obtained; and carrying out multi-period encryption operation on the data to be encrypted by utilizing the initial key.

With reference to the fifth possible implementation manner of the second aspect, in a sixth possible implementation manner, where N is a total cycle number of a multi-cycle encryption operation, and N is an integer greater than 1, the performing, by using the initial key, the multi-cycle encryption operation on the data to be encrypted includes: performing the expansion operation of the nth period, and then performing the encryption operation of the nth period, wherein N is a positive integer and is 1 to N in sequence; wherein, the expansion operation of the nth period is as follows: performing expansion operation on the data participating in the expansion operation of the nth period by using preset parameters to obtain data obtained by the expansion operation of the nth period; if n is 1, the data participating in the n-th cycle of inverse expansion operation is the initial key, and the data obtained by the n-th cycle of expansion operation is a round key; if n is more than 1, the data participating in the expansion operation of the nth period is a round key obtained by the expansion operation of the (n-1) th period; if N is equal to N, the data obtained by the expanding operation of the nth period is the round key stored in the storage unit; and the encryption operation of the nth period is as follows: encrypting data participating in the encryption operation of the nth period by using a key required by the encryption operation of the nth period to obtain encrypted data obtained by the encryption operation of the nth period; if n is 1, the data participating in the encryption operation of the nth period is the data to be encrypted; if n is more than 1, the data participating in the encryption operation of the nth period is the encryption data obtained by the encryption operation of the (n-1) th period; the key required by the encryption operation of the nth period is data obtained by the expansion operation of the (n-1) th period.

With reference to the second aspect, in a seventh possible implementation manner, obtaining a round key required for decrypting the data from a storage unit includes: receiving the round key output by the storage unit.

With reference to the second aspect, in an eighth possible implementation manner, the performing, by using the round key, a multi-cycle decryption operation on the data includes: and under the triggering of an enabling signal sent by the virtual machine, carrying out multi-cycle decryption operation on the data by using the round key.

In a third aspect, an embodiment of the present application provides a memory controller, including: a data processing apparatus as claimed in the first aspect or any one of the possible implementations of the first aspect.

In a fourth aspect, an embodiment of the present application provides a processor, including: a data processing apparatus as claimed in the first aspect or any one of the possible implementations of the first aspect.

In a fifth aspect, an embodiment of the present application provides an electronic device, including: a memory, and a processor connected to the memory, wherein the data processing apparatus according to the first aspect or any possible implementation manner of the first aspect is disposed in the processor.

In a sixth aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor connected to the memory, and a memory controller connected to the processor, wherein the memory controller is provided with the data processing apparatus according to the first aspect or any one of the possible implementation manners of the first aspect.

In a seventh aspect, an embodiment of the present application provides an electronic device, including: a memory, and a processor connected to the memory and configured to execute the data processing method according to the second aspect or any possible implementation manner of the second aspect, so as to encrypt data in the memory or write encrypted data into the memory.

In an eighth aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor connected to the memory, and a memory controller connected to the processor, where the memory controller is provided with the data processing apparatus as described in the second aspect or any possible implementation manner of the second aspect, so as to encrypt data in the memory or write encrypted data into the memory.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required to be used in the embodiments of the present application will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and that those skilled in the art can also obtain other related drawings based on the drawings without inventive efforts.

Fig. 1 is a diagram of a first application environment of a data processing apparatus according to an embodiment of the present application;

fig. 2 is a diagram of a second application environment of a data processing apparatus according to an embodiment of the present application;

fig. 3 is a block diagram of a data processing apparatus according to an embodiment of the present application;

fig. 4 is a flowchart illustrating encryption performed by a data processing apparatus according to an embodiment of the present application;

fig. 5 is a flowchart of decryption performed by a data processing apparatus according to an embodiment of the present application;

fig. 6 is a flowchart of key expansion performed by a data processing apparatus according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

Referring to fig. 1 and fig. 2, an embodiment of the present application provides a data processing apparatus 100, where the data processing apparatus 100 may be applied to an electronic device 10, such as a terminal or a server. The terminal may be a mobile phone, a tablet computer, a Personal Digital Assistant (PDA), a Point of Sales (POS), or the like; the server may be a single server or a server group (the server group may be centralized or distributed).

For example, as shown in FIG. 1, the electronic device 10 may include: a memory 11, and a processor 13 connected to the memory 11. The memory 11 may be a magnetic disk, a ROM, or a RAM, or any combination thereof, and the processor 13 may be a CPU (Central Processing Unit), an MCU (micro controller Unit), or the like. The data processing apparatus 100 described in this embodiment may be disposed in the processor 13, so that the processor 13 can encrypt and decrypt data and write the data to the memory 11 efficiently or encrypt and decrypt data read from the memory 11 efficiently through the data processing apparatus 100.

For example, as shown in fig. 2, the electronic device 10 may include: a memory 12, a processor 13 connected to the memory 12, and a memory controller 14 connected to the processor 13, wherein the processor 13 may also be a Central Processing Unit (CPU), a Micro Controller Unit (MCU), or the like. The memory controller 14 may be integrally disposed in the processor 13, or may be disposed separately from the processor 13, and in addition, the data processing apparatus 100 described in this embodiment is disposed in the memory controller 14, so that the memory controller 14 can efficiently encrypt and decrypt data and write the data into the memory 11 through the data processing apparatus 100 and cooperate with the processor 13, or efficiently encrypt and decrypt data read from the memory 11.

Further, in some practical application scenarios, a plurality of virtual machines are deployed in the electronic device 10, and the data processing apparatus 100 is configured to encrypt and decrypt data of the virtual machines, for example, the virtual machine VM1 — the virtual machine VM10 may all run on the electronic device 10; if the virtual machine VM1 is currently running on the electronic device 10, the data processing apparatus 100 may run based on the software environment of the virtual machine VM1 to encrypt and decrypt the data of the virtual machine VM 1; if the virtual machine VM6 is currently running on the electronic device 10, the data processing apparatus 100 may run based on the software environment of the virtual machine VM6 to encrypt and decrypt the data of the virtual machine VM 6. Of course, the above application scenario is only an exemplary application scenario of the present embodiment, and is not limited to the present embodiment, for example, the data processing apparatus 100 may also directly encrypt and decrypt the data of the electronic device 10 itself, that is, if the data processing apparatus 100 is disposed in the electronic device 10A, the data of the electronic device 10A is encrypted and decrypted, and if the data processing apparatus 100 is disposed in the electronic device 10B, the data of the electronic device 10B is encrypted and decrypted.

Referring to fig. 3, further, the data processing apparatus 100 in the present embodiment may include: a key expander 110, a multiplexer 120 connected to the key expander 110, and an encryption/decryption circuit 130 connected to the multiplexer 120.

The key expander 110 is configured to obtain a round key required for decrypting the data by performing a multi-cycle expansion operation on a preset initial key before the encryption and decryption circuit 130 acquires the data to be decrypted, and store the round key in a corresponding storage unit.

A multiplexer 120 for obtaining the round key from the storage unit.

And the encryption and decryption circuit 130 is used for carrying out multi-period decryption operation on the data by using the round key.

It should be noted that the above scenario shows a scenario of decryption first, that is, before data of a certain virtual machine is encrypted in multiple cycles, if the data of the virtual machine is decrypted in multiple cycles first, keys in multiple cycles are generated and stored by using a multiple-cycle expansion operation before the data to be decrypted reaches the encryption/decryption circuit 130, so that after the data is acquired by the encryption/decryption circuit 130, the data is directly decrypted by using the stored round keys. However, in the case of the scene encrypted first, the data processing apparatus 100 may store the round key generated in the multi-cycle encryption in the storage unit, and then, when the data of the virtual machine is subsequently decrypted in the multi-cycle, the data is directly decrypted by using the stored round key.

The principle of encrypting and decrypting the data processing apparatus 100 will be described in detail below with reference to one of the virtual machines as an example, from the perspective of encrypting first and then decrypting and decrypting first and then encrypting.

1. Encryption and decryption:

the virtual machine may have its own initial key to ensure data security when using the virtual machine, and the initial key may be set by a user to whom the virtual machine belongs, or may be generated or allocated according to a preset rule for the virtual machine, or may be generated randomly by the virtual machine itself. In addition, the initial key of the virtual machine is stored in advance in a storage unit corresponding to the virtual machine, the storage unit may be a register or may also be an SRAM (Static Random-Access Memory), and the storage unit may be a single storage unit or may also be a storage unit array composed of a plurality of storage units. In this way, when the initial key needs to be used, the initial key of the corresponding virtual machine can be acquired from the corresponding storage unit.

And in the running environment of the virtual machine, the address of the virtual machine, i.e., the virtual machine VM-ID, may point to the storage unit storing the initial key of the virtual machine. Therefore, when the virtual machine initiates an encryption instruction for certain data to be encrypted, a corresponding process in the running environment of the virtual machine triggers a storage unit for storing an initial key of the virtual machine to output the initial key by using the VM-ID of the virtual machine. Since the output of the memory cell is connected to the input of the multiplexer 120, the multiplexer 120 receives the initial key from the output of the memory cell.

In this embodiment, the multiplexer 120 may be implemented by hardware, so that when the virtual machine initiates encryption of a certain data to be encrypted, a corresponding process in the running environment of the virtual machine may also trigger the multiplexer 120 by a hardware triggering manner, such as by sending an enable signal, to output the received initial key to the encryption/decryption circuit 130. For example, a corresponding process in the running environment of the virtual machine may apply a high level to the trigger interface of the multiplexer 120, and since the multiplexer 120 is a hardware structure, under the high level trigger, a loop in the multiplexer 120 for outputting the initial key is turned on, so as to output the initial key to the encryption/decryption circuit 130.

Of course, if the multiplexer 120 is implemented by software, the multiplexer 120 may be controlled to output the initial key by sending a software signal.

In this embodiment, when the virtual machine initiates an encryption instruction for a certain data to be encrypted, a corresponding process in the operating environment of the virtual machine sends the data to be encrypted to the encryption/decryption circuit 130. Since the data to be encrypted needs a certain time to be transmitted, the encryption/decryption circuit 130 receives the initial key before acquiring the data to be encrypted. In this way, after the encryption/decryption circuit 130 obtains the data to be encrypted, the initial key may be used to perform a multi-cycle encryption operation on the data to be encrypted, so as to obtain encrypted data, and output the encrypted data. The adopted multi-period encryption algorithm can be an Sm4 algorithm with 32 iteration rounds, or an AES algorithm with 8, 10 or 12 iteration rounds.

As shown in fig. 4, as an exemplary manner, if the encryption/decryption circuit 130 is implemented by hardware, the encryption/decryption circuit 130 may include: a key cycle expansion operation unit BT of hardware and a data encryption and decryption operation unit BF of hardware.

If the total cycle number of the multi-cycle encryption operation is N, and N is an integer greater than 1, if N is a positive integer, and N sequentially takes 1 to N, the specific process of the encryption/decryption circuit 130 performing the encryption operation of the nth cycle may be:

the n-th cycle expansion operation performed by the key cycle expansion operation unit BT may be: the key cycle expansion operation unit BT performs expansion operation on data participating in the expansion operation of the nth cycle by using preset parameters to obtain data obtained by the expansion operation of the nth cycle; if n is 1, the data participating in the n-th cycle of the inverse expansion operation is an initial key of the virtual machine, and the data obtained by the n-th cycle of the expansion operation is a round key; if n is more than 1, the data participating in the expansion operation of the nth period is a round key obtained by the expansion operation of the (n-1) th period; if N is equal to N, the data obtained by the N-th cycle of the expansion operation is the round key stored in the storage unit.

The n-th cycle of the encryption operation performed by the data encryption/decryption operation unit BF may be: the data encryption and decryption operation unit BF encrypts the data participating in the encryption operation of the nth period by using the key required by the encryption operation of the nth period to obtain the encrypted data obtained by the encryption operation of the nth period; if n is 1, the data participating in the encryption operation of the nth period is the data to be encrypted of the virtual machine; if n is more than 1, the data participating in the encryption operation of the nth period is the encryption data obtained by the encryption operation of the (n-1) th period; the key required by the encryption operation of the nth period is data obtained by the expansion operation of the (n-1) th period.

It can be understood that, in order to improve the efficiency of encryption, both the number of data participating in the expansion operation of each period and the number of data obtained by the expansion operation of the period may be X/N, where X is the total number of all keys involved in the multi-period expansion operation, and X/N is an integer greater than 1; and the number of the data to be encrypted participating in the encryption operation of each period and the number of the decrypted data obtained by the decryption operation of the period can be P/N, wherein P is the total number of all data involved in the encryption process. In other words, the expansion of each period can simultaneously expand two or more round keys, and the encryption of each period can simultaneously encrypt two or more data, so that the encryption time length is shortened, and the encryption efficiency is improved.

In practice, 2 or 4 data are simultaneously operated per cycle in consideration of the performance of the hardware, and of course, 8, 16 or even 32 data can be simultaneously operated per cycle in the case where the performance of the hardware is satisfied. For example, fig. 4 shows a scenario in which 4 data are simultaneously operated for each cycle. In the scenario shown in fig. 4, i sequentially takes 1 to 32, and the total number of cycles N is 8, and the encryption process of the scenario shown in fig. 4 is described below by taking a certain cycle as an example, so as to more clearly understand the encryption process of the present application.

For the certain cycle of the expansion operation:

the encryption and decryption circuit 13 inputs 4 keys (Ki, Ki +1, Ki +2, Ki +3) to the key cycle expansion operation unit BT through the internal selection circuit MUX1, wherein if the cycle is the first cycle, the 4 keys are the initial keys, otherwise, the 4 keys are the keys of the 4 cycles obtained by the expansion of the previous cycle. The key cycle expansion operation unit BT performs a cycle expansion operation for the 4 keys (Ki, Ki +1, Ki +2, Ki +3) for the one cycle using preset 4 parameters (CKi, CKi +1, CKi +2, CKi +3) to obtain 4 keys (Ki +4, Ki +5, Ki +6, Ki +7), where the 4 keys (Ki +4, Ki +5, Ki +6, Ki +7) are also used as keys (RKi, RKi +1, RKi +2, RKi +3) for the 4 cycles. While obtaining the keys (Ki +4, Ki +5, Ki +6, Ki +7) of 4 cycles, on the one hand, when the cycle is less than 8 cycles, the key cycle expansion operation unit BT may input the keys (Ki +4, Ki +5, Ki +6, Ki +7) of 4 cycles again to the internal selection circuit MUX1 to be used as the expansion operation of the next cycle, wherein since the keys (Ki +4, Ki +5, Ki +6, Ki +7) of 4 cycles are also used as the keys (RKi, RKi +1, RKi +2, RKi +3) of 4 cycles, it can be understood that the keys (Ki +4, Ki +5, Ki +6, Ki +7) of 4 cycles are used as the expansion operation of the next cycle, that is, the keys (RKi, RKi +1, RKi +2, Ki +3) of 4 cycles are used as the expansion operation of the next cycle; on the other hand, the key cycle expansion operation unit BT may output the keys (RKi, RKi +1, RKi +2, RKi +3) of the 4 cycles to the data encryption/decryption operation unit BF for use as the cycle encryption operation of the cycle.

For the certain period of encryption operation:

the encryption and decryption circuit 130 inputs the 128-bit 4 data Date-in (Xi, Xi +1, Xi +2, Xi +3) to the data encryption and decryption operation unit BF through the internal selection circuit MUX2, wherein if the period is the first period, the 4 data are the acquired data to be encrypted, otherwise, the 4 encrypted data obtained by the encryption of the previous period are obtained. The data encryption and decryption operation unit BF performs the periodic encryption operation of the period on the 4 data (Xi, Xi +1, Xi +2, Xi +3) by using the currently acquired keys (RKi, RKi +1, RKi +2, RKi +3) of the 4 periods, so as to obtain 4 encrypted data (Xi +4, Xi +5, Xi +6, Xi + 7). While obtaining 4 pieces of encrypted data (Xi +4, Xi +5, Xi +6, Xi +7), if the cycle is less than 8 cycles, the data encryption/decryption operation unit BF may input the 4 pieces of encrypted data (Xi +4, Xi +5, Xi +6, Xi +7) again to the selection circuit MUX2 for use as an encryption operation of the next cycle.

When the cycle is up to the 8 th cycle, the key cycle expansion operation unit BT stores the 4 cycles of keys (RK32, RK33, RK34, RK35) obtained by the 8 th cycle of expansion operation into the corresponding units, and the data encryption/decryption operation unit BF outputs the 4 encrypted data Date-out ((X36, X37, X38, X39) obtained by the 8 th cycle of encryption operation.

It should be noted that, based on the above-described structure of the key cycle expansion operation unit BT and the data encryption/decryption operation unit BF, if 2 pieces of data are simultaneously operated in each cycle, the number of data input to the key cycle expansion operation unit BT and the data encryption/decryption operation unit BF in each cycle is still 4, but two of the 4 pieces of data are different from those in the previous cycle. For example, for the key cycle expansion operation unit BT: the 4 keys of the input key cycle expansion operation unit BT of the first cycle are (K1, K2, K3, K4) and thus expanded to (K3, K4, K5, K6), the 4 keys of the input key cycle expansion operation unit BT of the second cycle are (K3, K4, K5, K6) and thus expanded to (K5, K6, K7, K8), and so on. For another example, for the data encryption/decryption arithmetic unit BF: the 4 data of the input data encryption and decryption arithmetic unit BF in the first period are (X1, X2, X3, X4) and are encrypted to obtain (X3, X4, X5, X6), the 4 data of the input data encryption and decryption arithmetic unit BF in the second period are (X3, X4, X5, X6) and are encrypted to obtain (X5, X6, X7, X8), and so on.

In addition, in other implementation scenarios, the number of cycles of the period expansion operation and the period encryption operation may be different. For example, the cycle expansion operation performs 4 cycles of expansion by operating 8 data per cycle, and the cycle encryption operation performs 8 cycles of encryption by operating 4 data per cycle.

Of course, the implementation of the key cycle expansion operation unit BT in hardware and the data encryption/decryption operation unit BF in hardware is only an exemplary implementation manner of the present embodiment, and is not limited to the present embodiment. For example, the key cycle expansion operation unit and the data encryption/decryption operation unit may be implemented by software.

In this embodiment, after the virtual machine completes encryption of a certain data to be encrypted, if the virtual machine initiates decryption of the certain data to be decrypted, a corresponding process in the running environment of the virtual machine may trigger, by using the VM-ID of the virtual machine, a storage unit storing a key of each period of the virtual machine to output the key of the period. Since the output of the memory cell is also connected to the input of the multiplexer 120, the multiplexer 120 receives the key for each cycle of the memory cell output.

The corresponding process in the running environment of the virtual machine may also trigger the multiplexer 120 by a hardware triggering method, such as by sending an enable signal, to output the received key for each cycle to the encryption/decryption circuit 130. For example, a corresponding process in the running environment of the virtual machine may apply a low level to the trigger interface of the multiplexer 120, and since the multiplexer 120 is a hardware structure, under the low level trigger, a loop in the multiplexer 120 that outputs the key of one cycle is turned on, so as to output the key of one cycle to the encryption/decryption circuit 130.

Of course, if the multiplexer 120 is implemented by software, the multiplexer 120 may be controlled to output the key for a period by sending a software signal.

In this embodiment, when the virtual machine initiates decryption of a certain data to be decrypted, the corresponding process in the running environment of the virtual machine also sends the data to be decrypted to the encryption/decryption circuit 130. Since the data to be decrypted needs a certain time to transmit, the encryption/decryption circuit 130 receives the key for one cycle before acquiring the data to be decrypted. In this way, after the encryption and decryption circuit 130 obtains the data to be decrypted, the multi-cycle decryption operation may be performed on the data to be decrypted by using the round key, so as to obtain decrypted data, and the decrypted data is output. The algorithm of the multi-cycle decryption operation may be an Sm4 algorithm with an iteration round number of 32 rounds, or an AES algorithm with an iteration round number of 8, 10, or 12.

As shown in fig. 5, in a case where the encryption/decryption circuit 130 includes a hardware key period expansion operation unit BT and a hardware data encryption/decryption operation unit BF, if the total number of cycles of the multi-cycle decryption operation is M and M is an integer greater than 1, if M is a positive integer and M sequentially takes 1 to M, the specific flow of the decryption operation performed by the encryption/decryption circuit 130 in the mth cycle may be:

the m-th cycle inverse expansion operation performed by the key cycle expansion operation unit BT is: the key cycle expansion operation unit BT performs reverse expansion operation on data participating in the reverse expansion operation of the mth cycle by using preset parameters to obtain data obtained by the reverse expansion operation of the mth cycle; if m is 1, the data participating in the m-th cycle of the back expansion operation is a round key of the virtual machine stored in the storage unit, and the data obtained by the m-th cycle of the back expansion operation is the round key; if m is larger than 1, the data participating in the m-th cycle of inverse expansion operation is a round key obtained by the m-1-th cycle of inverse expansion operation; and if M is equal to M, the data obtained by the M-th cycle of the back expansion operation is the initial key of the virtual machine.

The decryption operation of the m-th cycle executed by the second encryption and decryption operation unit BF is as follows: the second encryption and decryption operation list BF decrypts the data participating in the decryption operation of the mth period by using the key required by the decryption operation of the mth period to obtain the decrypted data obtained by the decryption operation of the mth period; if m is 1, the key required by the decryption operation of the mth period is the round key of the virtual machine stored in the storage unit, and the data participating in the decryption operation of the mth period is the data to be decrypted; if m is greater than 1, the key required by the decryption operation of the mth period is the data obtained by the inverse expansion operation of the (m-1) th period, and the data participating in the decryption operation of the mth period is the decryption data obtained by the decryption operation of the (m-1) th period.

It can be understood that, in order to improve the efficiency of encryption, both the number of data participating in the back expansion operation of each period and the number of data obtained by the back expansion operation of the period may be Y/N, where Y is the total number of all keys involved in the multi-period back expansion operation, and Y/M is an integer greater than 1; and the number of the data to be decrypted participating in the decryption operation of each period and the number of the decrypted data obtained by the decryption operation of the period can be Z/M, wherein Z is the total number of all data involved in the decryption process, and Z/M is an integer greater than 1. In other words, the reverse expansion of each period can simultaneously expand two or more round keys, and the decryption of each period can simultaneously decrypt two or more data, so that the decryption time length is shortened, and the decryption efficiency is improved.

In practice, 2 or 4 data are simultaneously operated per cycle in consideration of the performance of the hardware, and of course, 8, 16 or even 32 data can be simultaneously operated per cycle in the case where the performance of the hardware is satisfied. For example, fig. 5 shows a scenario in which 4 data are simultaneously operated for each cycle. In the scenario shown in fig. 5, i is 36 to 5 in sequence, and the total number of cycles M is 8, and the encryption process of the scenario shown in fig. 5 is described below by taking a certain cycle as an example, so as to more clearly understand the decryption process of the present application.

The inverse expansion operation for the certain period:

the encryption and decryption circuit 130 inputs 4 keys (Ki, Ki +1, Ki +2, Ki +3) to the key period expansion operation unit BT through the interface of the selection circuit MUX1, and synchronously inputs 4 keys (RKi, RKi +1, RKi +2, RKi +3) of periods to the data encryption and decryption operation unit BF, wherein, according to the above analysis, the 4 keys (Ki, Ki +1, Ki +2, Ki +3) and the 4 keys (RKi, RKi +1, RKi +2, RKi +3) of periods are the same data, and the description is only used for distinguishing the flow path so as to understand. The key cycle expansion operation unit BT performs cycle inverse expansion operation of the one cycle on 4 keys (Ki, Ki +1, Ki +2, Ki +3) by using preset 4 parameters (CKi, CKi +1, CKi +2, CKi +3) to obtain 4 keys (Ki, Ki +1, Ki +2, Ki +3), and the 4 keys (Ki, Ki +1, Ki +2, Ki +3) are also used as keys (RKi-4, RKi-3, RKi-2, RKi-1) of the 4 cycles to be used as inverse expansion operation of the next cycle.

The decryption operation for the certain period:

the encryption and decryption circuit 130 inputs 128 bits of 4 data-in (Xi, Xi +1, Xi +2, Xi +3) to the data encryption and decryption arithmetic unit BF through the selection circuit MUX2, wherein if the period is the first period, the 4 data are the acquired data to be decrypted, otherwise, the 4 decrypted data obtained by the decryption in the previous period. And the data encryption and decryption operation unit BF performs the periodic decryption operation of the period on the 4 data (Xi, Xi +1, Xi +2 and Xi +3) by using the currently acquired 4 periodic keys (RKi, RKi +1, RKi +2 and RKi +3) so as to obtain 4 decrypted data (Xi-4, Xi-3, Xi-2 and Xi-1). While obtaining 4 decrypted data (Xi-4, Xi-3, Xi-2, Xi-1), if the period is less than 8 periods, the data encryption/decryption operation unit BF may input 4 decrypted data (Xi-4, Xi-3, Xi-2, Xi-1) again to the selection circuit MUX2 for the next period of decryption operation.

When the cycle reaches the 8 th cycle, the key cycle expansion operation unit BT stores the 4 initial keys (RK1, RK2, RK3, RK4) obtained by the expansion operation of the 8 th cycle into the corresponding storage units, and the data encryption and decryption operation unit BF outputs the 4 decrypted data Date-out (X1, X2, X3, X4) obtained by the encryption operation of the 8 th cycle.

It should be noted that, based on the above-described structure of the key cycle expansion operation unit BT and the data encryption/decryption operation unit BF, if 2 pieces of data are simultaneously operated in each cycle, the number of data input to the key cycle expansion operation unit BT and the data encryption/decryption operation unit BF in each cycle is still 4, but two of the 4 pieces of data are different from those in the previous cycle. For example, for the key cycle expansion operation unit BT: the keys of 4 cycles of the input key cycle expansion operation unit BT in the first cycle are (K33, K34, K35, K36) so as to obtain (K31, K32, K33, K34) by inverse expansion, and the keys of 4 cycles of the input key cycle expansion operation unit BT in the second cycle are (K31, K32, K33, K34) so as to obtain (K29, K30, K31, K32) by inverse expansion, and so on. For another example, for the data encryption/decryption arithmetic unit BF: the 4 pieces of encrypted data of the input data encryption and decryption arithmetic unit BF in the first period are (X33, X34, X35, X36) and are decrypted to obtain (X31, X32, X33, X34), the 4 pieces of data of the input data encryption and decryption arithmetic unit BF in the second period are (X31, X32, X33, X34) and are decrypted to obtain (X29, X30, X31, X32), and so on.

In addition, in other implementation scenarios, the cycle times of the cycle back-expansion operation and the cycle decryption operation may be different. For example, the cycle despreading operation performs 4 cycles despreading with 8 data operations per cycle, and the cycle decryption operation performs 8 cycles decryption with 4 data operations per cycle.

It should be noted that the total cycle number N of the multi-cycle encryption operation and the total cycle number M of the multi-cycle decryption operation both depend on the data participating in the operation in each cycle and the number of the operation results, and N and M may be set to be the same or different according to actual requirements.

2. Decryption and then encryption:

when the virtual machine initiates decryption of certain data to be decrypted, a corresponding process in the running environment of the virtual machine triggers a storage unit for storing an initial key of the virtual machine to output the initial key by using the VM-ID of the virtual machine. On the one hand, since the output of the memory cell is connected to the input of the multiplexer 120, the multiplexer 120 receives the initial key output by the memory cell; on the other hand, since the output of the storage unit is connected to the input of the key expander 110, the key expander 110 also receives the initial key output from the storage unit, so that the key expander 110 can perform multi-cycle expansion operation using the initial key to obtain the round key required for decrypting the data to be decrypted.

In this embodiment, as an exemplary manner, the key expander 110 may also implement a multi-cycle expansion operation in a hardware manner, that is, the key expander 110 may also be provided with a key cycle expansion operation unit BT. Thus, as can be seen from the foregoing, the total number of cycles of the multi-cycle expansion operation is N, and N sequentially takes 1 to N, so that the specific flow of the key expander 110 performing the expansion operation of the nth cycle may be:

a key cycle expansion operation unit BT in the key expander 110 performs expansion operation on data participating in the expansion operation of the nth cycle by using preset parameters to obtain a round key obtained by the expansion operation of the nth cycle; if n is 1, the data participating in the expansion operation of the nth period is an initial key of the virtual machine; if n is more than 1, the data participating in the expansion operation of the nth period is a round key obtained by the expansion operation of the (n-1) th period; if N is equal to N, the round key obtained by the expansion operation of the nth cycle is the round key which needs to be stored in the storage unit.

It can be understood that, in order to improve the efficiency of key expansion, in the multi-cycle expansion operation before decryption, the number of data participating in the expansion operation in each cycle and the number of round keys obtained by the expansion operation in the cycle may also be X/N. In other words, in the multi-cycle expansion operation before decryption, two or more round keys can be expanded simultaneously by each cycle of expansion, so that the time length of key expansion is shortened, and the efficiency of key expansion is improved.

In practice, considering the performance of the hardware, 2 or 4 keys are operated at the same time in each cycle, that is, x is 2 or 4, and of course, 8, 16 or even 32 data can be operated at the same time in each cycle under the condition that the performance of the hardware is satisfied. For example, fig. 6 shows a scenario in which 4 keys are simultaneously operated every cycle. In the scenario shown in fig. 4, i sequentially takes 1 to 32, and the total number of cycles N is 8, and the following describes the key expansion process of the scenario shown in fig. 6 by taking a certain cycle as an example, so as to more vividly understand the key expansion process of the present application.

For the certain cycle of the expansion operation:

the key expander 110 inputs 4 keys (Ki, Ki +1, Ki +2, Ki +3) to the key cycle expansion operation unit BT in the key expander 110 through the internal selection circuit MUX3, wherein if the cycle is the first cycle, the 4 keys are the initial keys, otherwise, the 4 keys are the keys of the 4 cycles obtained by the expansion of the previous cycle. The key cycle expansion operation unit BT performs a cycle expansion operation for the 4 keys (Ki, Ki +1, Ki +2, Ki +3) for the one cycle using preset 4 parameters (CKi, CKi +1, CKi +2, CKi +3) to obtain 4 keys (Ki +4, Ki +5, Ki +6, Ki +7), where the 4 keys (Ki +4, Ki +5, Ki +6, Ki +7) are also used as keys (RKi, RKi +1, RKi +2, RKi +3) for the 4 cycles. When the cycle is less than 8 cycles while obtaining 4 keys (Ki +4, Ki +5, Ki +6, Ki +7), the key cycle spreading operation unit BT may input the 4 keys (Ki +4, Ki +5, Ki +6, Ki +7) again to the selection circuit MUX3 to be used as the spreading operation of the next cycle, and since the 4 keys (Ki +4, Ki +5, Ki +6, Ki +7) are also used as the keys (RKi, RKi +1, RKi +2, RKi +3) of the 4 cycles, it can be understood that the spreading operation of the next cycle using the 4 keys (Ki +4, Ki +5, Ki +6, Ki +7) is the spreading operation of the next cycle using the keys (RKi, RKi +1, RKi +2, RKi +3) of the 4 cycles.

It will be appreciated that the storage unit storing the round key, in the case of data storage, will not only store data, but will also synchronise the output of the most recently stored data. In other words, since the output of the storage unit storing the round key is connected to the input of the multiplexer 120, the key expander 110 stores the round key obtained by the multi-cycle expansion operation into the storage unit, and simultaneously triggers the storage unit to output the round key to the multiplexer 120, so that the multiplexer 120 can acquire the key of the cycle in the first time.

In this embodiment, the multiplexer 120 may obtain the initial key output by the storage unit storing the initial key, or may obtain the key of each cycle output by the storage unit storing the key of each cycle. And in a hardware-triggered manner, such as by sending an enable signal to trigger the multiplexer 120, the multiplexer 120 may output the received key for each cycle to the encryption/decryption circuit 130. For example, a corresponding process in the running environment of the virtual machine may apply a low level to the trigger interface of the multiplexer 120, and since the multiplexer 120 is a hardware structure, under the low level trigger, a loop in the multiplexer 120 that outputs the key of one cycle is turned on, so as to output the key of one cycle to the encryption/decryption circuit 130.

In this embodiment, when the virtual machine initiates decryption of a certain data to be decrypted, the corresponding process in the running environment of the virtual machine also sends the data to be decrypted to the encryption/decryption circuit 130. Since the data to be decrypted needs a certain time to be transmitted, and the time consumed for the transmission is longer than the time consumed for the key expander 110 to perform the multi-cycle expansion operation to obtain the round key, in other words, the encryption and decryption circuit 130 receives the expanded key of each cycle before acquiring the data to be decrypted. In this way, after the encryption/decryption circuit 130 acquires the data to be decrypted, the multi-cycle decryption operation may be performed on the data to be decrypted by using the round key, so as to obtain decrypted data, and the decrypted data is output.

It will be appreciated that the subsequent decryption and encryption processes are analogous to those described above, and will be understood with reference to the foregoing description, and will not be repeated herein.

It should be further noted that, for the virtual machine, after the key expander 110 performs the multi-cycle expansion operation once to obtain the keys of the cycles, if the initial key of the virtual machine is not updated, the virtual machine does not trigger the key expander 110 to perform the flow of the multi-cycle expansion operation any more, and the expanded keys of the cycles may be directly used for subsequent decryption. Once the initial key of the virtual machine is updated, the key expander 110 will re-execute the multi-cycle expansion operation once again to correspondingly update the key of each cycle. Of course, the execution logic described above is also only an exemplary manner of the present embodiment, and is not limited to the present embodiment. For example, it may be that the decryption key expander 110 performs a multi-cycle expansion operation each time, regardless of whether the initial key is updated.

Based on the same inventive concept, the embodiment of the present application further provides a data processing method, where the method includes:

step S100: when the data to be decrypted needs to be decrypted, obtaining a round key needed for decrypting the data from a storage unit, wherein the round key is as follows: before the data are acquired, acquiring and storing the data in the storage unit by performing multi-cycle expansion operation on a preset initial key;

step S200: and carrying out multi-period decryption operation on the data by using the round key.

Optionally, N is a total cycle number of the multi-cycle expansion operation, N is an integer greater than 1, N is a positive integer, and N sequentially takes from 1 to N, and the step of executing the nth cycle expansion operation includes:

performing expansion operation on data participating in the expansion operation of the nth period by using preset parameters to obtain a round key obtained by the expansion operation of the nth period; if n is 1, the data participating in the expansion operation of the nth period is the initial key; if n is more than 1, the data participating in the expansion operation of the nth period is a round key obtained by the expansion operation of the (n-1) th period; and if N is equal to N, the round key obtained by the expansion operation of the nth period is the round key which needs to be stored in the storage unit.

Optionally, both the number of data participating in the expansion operation in each period and the number of round keys obtained by the expansion operation in the period are X/N, where X is the total number of all keys involved in the multi-period expansion operation, and X/N is an integer greater than 1.

Optionally, M is a total cycle number of the multi-cycle decryption operation, and M is an integer greater than 1, and the multi-cycle decryption operation is performed on the data by using the round key, including:

firstly, executing the reverse expansion operation of the mth period, then executing the decryption operation of the mth period, wherein M is a positive integer, M is sequentially from 1 to M,

wherein, the m-th cycle inverse expansion operation is as follows: performing inverse expansion operation on the data participating in the inverse expansion operation of the mth period by using preset parameters to obtain data obtained by the inverse expansion operation of the mth period; if m is 1, the data participating in the m-th cycle of inverse spreading operation is the round key stored in the storage unit, and the data obtained by the m-th cycle of inverse spreading operation is the round key; if m is larger than 1, the data participating in the m-th cycle of inverse expansion operation is a round key obtained by the m-1-th cycle of inverse expansion operation; if M is equal to M, the data obtained by the M-th cycle of the inverse expansion operation is the initial key;

and the decryption operation of the mth period is as follows: decrypting the data participating in the decryption operation of the mth period by using the key required by the decryption operation of the mth period to obtain decrypted data obtained by the decryption operation of the mth period; if m is 1, the key required for the decryption operation in the mth period is the round key stored in the storage unit, and the data participating in the decryption operation in the mth period is the data to be decrypted; if m is greater than 1, the key required by the decryption operation of the mth period is the data obtained by the inverse expansion operation of the (m-1) th period, and the data participating in the decryption operation of the mth period is the decryption data obtained by the decryption operation of the (m-1) th period.

Optionally, the number of data participating in the back expansion operation of each period and the number of data obtained by the back expansion operation of the period are both Y/M, where Y is the total number of all keys involved in the multi-period back expansion operation, and Y/M is an integer greater than 1; the number of the data to be decrypted participating in the decryption operation of each period and the number of the decrypted data obtained by the decryption operation of the period are both Z/M, wherein Z is the total number of all data involved in the decryption process, and Z/M is an integer greater than 1.

Optionally, the method further includes:

step S210: when data to be encrypted needs to be encrypted, the initial key is obtained;

step S220: and carrying out multi-period encryption operation on the data to be encrypted by utilizing the initial key.

Optionally, N is a total cycle number of the multi-cycle encryption operation, and N is an integer greater than 1, and the multi-cycle encryption operation is performed on the data to be encrypted by using the initial key, including:

performing the expansion operation of the nth period, and then performing the encryption operation of the nth period, wherein N is a positive integer and is 1 to N in sequence;

wherein, the expansion operation of the nth period is as follows: performing expansion operation on the data participating in the expansion operation of the nth period by using preset parameters to obtain data obtained by the expansion operation of the nth period; if n is 1, the data participating in the n-th cycle of inverse expansion operation is the initial key, and the data obtained by the n-th cycle of expansion operation is a round key; if n is more than 1, the data participating in the expansion operation of the nth period is a round key obtained by the expansion operation of the (n-1) th period; if N is equal to N, the data obtained by the expanding operation of the nth period is the round key stored in the storage unit;

and the encryption operation of the nth period is as follows: encrypting data participating in the encryption operation of the nth period by using a key required by the encryption operation of the nth period to obtain encrypted data obtained by the encryption operation of the nth period; if n is 1, the data participating in the encryption operation of the nth period is the data to be encrypted; if n is more than 1, the data participating in the encryption operation of the nth period is the encryption data obtained by the encryption operation of the (n-1) th period; the key required by the encryption operation of the nth period is data obtained by the expansion operation of the (n-1) th period.

Optionally, obtaining a round key required for decrypting the data from the storage unit includes:

receiving the round key output by the storage unit.

Optionally, performing a multi-cycle decryption operation on the data by using the round key includes:

and under the triggering of an enabling signal sent by the virtual machine, carrying out multi-cycle decryption operation on the data by using the round key.

It will be appreciated that the principles of carrying out the above method may be with reference to the apparatus embodiments described above and will not be described again here. The above method is applicable to the data processing apparatus 100, and may be applied to other hardware configurations or software configurations.

In summary, the embodiments of the present application provide a data processing apparatus and method, a memory controller, a processor, and an electronic device. Before the data to be decrypted is obtained, the round key required by decrypting the data is obtained by a multi-period expansion process in advance through the key expander, so that the data can be directly decrypted by using the round key obtained in advance when the data reaches the encryption and decryption circuit without waiting, and the decryption efficiency is improved.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one logical division, and there may be other divisions when actually implemented, and for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection of devices or units through some communication interfaces, and may be in an electrical, mechanical or other form.

In addition, units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

Furthermore, the functional modules in the embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

In this document, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions.

The above description is only an example of the present application and is not intended to limit the scope of the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A data processing apparatus, characterized in that the apparatus comprises:

the key expander is used for performing multi-cycle expansion operation on a preset initial key to obtain a round key required by decrypting the data before the encryption and decryption circuit obtains the data to be decrypted, and storing the round key into a corresponding storage unit;

a multiplexer for obtaining the round key from the storage unit;

and the encryption and decryption circuit is used for carrying out multi-cycle decryption operation on the data by using the round key.

2. The data processing apparatus of claim 1,

n is the total cycle number of the multi-cycle expansion operation, N is an integer greater than 1, N is a positive integer, and N sequentially takes 1 to N, and the expansion operation of the nth cycle executed by the key expander is as follows: performing expansion operation on data participating in the expansion operation of the nth period by using preset parameters to obtain a round key obtained by the expansion operation of the nth period; if n is 1, the data participating in the expansion operation of the nth period is the initial key; if n is more than 1, the data participating in the expansion operation of the nth period is a round key obtained by the expansion operation of the (n-1) th period; and if N is equal to N, the round key obtained by the expansion operation of the nth period is the round key which needs to be stored in the storage unit.

3. The data processing apparatus of claim 2,

the number of data participating in the expansion operation of each period and the number of round keys obtained by the expansion operation of the period are both X/N, wherein X is the total number of all keys involved in the multi-period expansion operation, and X/N is an integer greater than 1.

4. The data processing apparatus of claim 1, wherein the encryption/decryption circuit comprises: a key period expansion operation unit and a data encryption and decryption operation unit;

m is the total cycle number of the multi-cycle decryption operation, and M is an integer greater than 1; m is a positive integer, and M is from 1 to M in sequence;

the m-th cycle inverse expansion operation performed by the key cycle expansion operation unit is as follows: performing inverse expansion operation on the data participating in the inverse expansion operation of the mth period by using preset parameters to obtain data obtained by the inverse expansion operation of the mth period; if m is 1, the data participating in the m-th cycle of inverse spreading operation is the round key stored in the storage unit, and the data obtained by the m-th cycle of inverse spreading operation is the round key; if m is larger than 1, the data participating in the m-th cycle of inverse expansion operation is a round key obtained by the m-1-th cycle of inverse expansion operation; if M is equal to M, the data obtained by the M-th cycle of the inverse expansion operation is the initial key;

the decryption operation of the m-th cycle executed by the data encryption and decryption operation unit is as follows: decrypting the data participating in the decryption operation of the mth period by using the key required by the decryption operation of the mth period to obtain decrypted data obtained by the decryption operation of the mth period; if m is 1, the key required for the decryption operation in the mth period is the round key stored in the storage unit, and the data participating in the decryption operation in the mth period is the data to be decrypted; if m is greater than 1, the key required by the decryption operation of the mth period is the data obtained by the inverse expansion operation of the (m-1) th period, and the data participating in the decryption operation of the mth period is the decryption data obtained by the decryption operation of the (m-1) th period.

5. The data processing apparatus of claim 4,

the number of data participating in the reverse expansion operation of each period and the number of data obtained by the reverse expansion operation of the period are both Y/M, wherein Y is the total number of all keys involved in the multicycle reverse expansion operation, and Y/M is an integer greater than 1;

the number of the data to be decrypted participating in the decryption operation of each period and the number of the decrypted data obtained by the decryption operation of the period are both Z/M, wherein Z is the total number of all data involved in the decryption process, and Z/M is an integer greater than 1.

6. The data processing apparatus of claim 1,

the multiplexer is further configured to obtain the initial key when data to be encrypted needs to be encrypted;

the encryption and decryption circuit is further configured to perform multi-cycle encryption operation on the data to be encrypted by using the initial key.

7. The data processing apparatus of claim 6, wherein the encryption/decryption circuit comprises: a key period expansion operation unit and a data encryption and decryption operation unit;

n is the total cycle number of the multi-cycle encryption operation, N is an integer greater than 1, N is a positive integer, and N is from 1 to N in sequence;

the n-th cycle expansion operation performed by the key cycle expansion operation unit is as follows: performing expansion operation on the data participating in the expansion operation of the nth period by using preset parameters to obtain data obtained by the expansion operation of the nth period; if n is 1, the data participating in the n-th cycle of inverse expansion operation is the initial key, and the data obtained by the n-th cycle of expansion operation is a round key; if n is more than 1, the data participating in the expansion operation of the nth period is a round key obtained by the expansion operation of the (n-1) th period; if N is equal to N, the data obtained by the expanding operation of the nth period is the round key stored in the storage unit;

the data encryption and decryption operation unit is used for executing the encryption operation of the nth cycle as follows: encrypting data participating in the encryption operation of the nth period by using a key required by the encryption operation of the nth period to obtain encrypted data obtained by the encryption operation of the nth period; if n is 1, the data participating in the encryption operation of the nth period is the data to be encrypted; if n is more than 1, the data participating in the encryption operation of the nth period is the encryption data obtained by the encryption operation of the (n-1) th period; the key required by the encryption operation of the nth period is data obtained by the expansion operation of the (n-1) th period.

8. The data processing apparatus of claim 1,

the multiplexer is used for receiving the round key output by the storage unit.

9. The data processing apparatus of claim 1,

and the multiplexer is used for outputting the round key to the encryption and decryption circuit under the triggering of an enabling signal sent by the virtual machine.

10. A method of data processing, the method comprising:

when the data to be decrypted needs to be decrypted, obtaining a round key needed for decrypting the data from a storage unit, wherein the round key is as follows: before the data are acquired, acquiring and storing the data in the storage unit by performing multi-cycle expansion operation on a preset initial key;

and carrying out multi-period decryption operation on the data by using the round key.

11. The data processing method of claim 10, wherein N is a total number of cycles of the multi-cycle spreading operation, N is an integer greater than 1, N is a positive integer, and N sequentially takes from 1 to N, and the step of performing the nth cycle of spreading operation comprises:

12. The data processing method of claim 11,

13. The data processing method of claim 10, wherein M is a total number of cycles of a multi-cycle decryption operation, and M is an integer greater than 1, and performing the multi-cycle decryption operation on the data using the round key comprises:

14. The data processing method of claim 13,

15. The data processing method of claim 10, wherein the method further comprises:

when data to be encrypted needs to be encrypted, the initial key is obtained;

and carrying out multi-period encryption operation on the data to be encrypted by utilizing the initial key.

16. The data processing apparatus of claim 15, wherein N is a total number of cycles of a multi-cycle encryption operation, and N is an integer greater than 1, and performing the multi-cycle encryption operation on the data to be encrypted using the initial key comprises:

17. The data processing method of claim 10, wherein obtaining a round key required to decrypt the data from a storage unit comprises:

receiving the round key output by the storage unit.

18. The data processing method of claim 10, wherein performing a multi-cycle decryption operation on the data using the round key comprises:

19. A memory controller, comprising: a data processing apparatus as claimed in any one of claims 1 to 9.

20. A processor, comprising: a data processing apparatus as claimed in any one of claims 1 to 9.

21. An electronic device, comprising: a memory, a processor connected to the memory, the processor having the data processing apparatus of any one of claims 1-9 disposed therein.

22. An electronic device, comprising: a memory, a processor coupled to the memory, and a memory controller coupled to the processor, the memory controller having the data processing apparatus as claimed in any one of claims 1 to 9 disposed therein.

23. An electronic device, comprising: a memory, a processor connected to the memory, the processor being configured to perform the data processing method of any of claims 10-18 to encrypt data in the memory or to write encrypted data to the memory.

24. An electronic device, comprising: a memory, a processor connected with the memory, and a memory controller connected with the processor, wherein the memory controller is provided with the data processing device as claimed in any one of claims 1 to 9, so as to encrypt the data in the memory or write the encrypted data into the memory.