KR102627585B1 - Electronic circuit performing encryption/ decryption operation to prevent side-channel analysis attack, and electronic device including the same - Google Patents

Abstract

The electronic circuit of the present invention includes a cryptographic operator and a controller. The encryption operator performs encryption/decryption operations using a plurality of logic gates. The controller is configured to output a logic value such that each of the plurality of logic gates outputs a first logic value during a first time period and outputs a first logic value during a second time period, based on the control value related to the encryption/decryption operation and the clock signal. The operation of the encryption operator is controlled so that the number of gates and the number of logic gates outputting the second logic value are maintained constant. When the control value indicates that the encryption/decryption operation is not performed, the plurality of logic gates operate in one of the first time period and the second time period. According to the present invention, the amount of power consumed by the encryption/decryption circuit is reduced, and the computational performance and security level of the encryption/decryption circuit are improved.

Description

Electronic circuit that performs encryption/decryption operations to prevent side-channel analysis attacks and electronic device including the same {ELECTRONIC CIRCUIT PERFORMING ENCRYPTION/ DECRYPTION OPERATION TO PREVENT SIDE-CHANNEL ANALYSIS ATTACK, AND ELECTRONIC DEVICE INCLUDING THE SAME}

The present invention relates to electronic circuits and electronic devices, and more specifically, to configurations and operations of electronic circuits and electronic devices that perform encryption/decryption operations.

Recently, various types of electronic devices have been used. An electronic device performs its unique function according to the operations of one or more electronic circuits included in it. The operation of an electronic circuit is performed as data in electronic form is input to or output from the electronic circuit.

Input or output data may be exposed to entities external to the electronic device. For example, an attacker (eg, a hacker) to an electronic device may gain control of the electronic device by manipulating data input to the electronic device. For example, an attacker can manipulate data output from an electronic device to arbitrarily change the data or damage the security properties of the data. In these examples, the security levels and reliability of electronic devices and electronic circuits may deteriorate significantly.

For this reason, electronic devices may include encryption/decryption circuits to encrypt input or output data and decrypt the encrypted data. The encryption/decryption circuit can encrypt/decrypt data according to an encryption/decryption algorithm using a key. If the key is unknown, it may be difficult for an attacker to determine the key based solely on the input/output data, and therefore, it may also be difficult for an attacker to determine the original version of the encrypted data. Therefore, encryption/decryption operations can improve the security level and reliability of electronic devices and electronic circuits.

However, some encryption/decryption circuits can still be exploited by attackers. Instead of directly manipulating input or output data, an attacker can conduct a "Side-channel Analysis Attack." In a side channel analysis attack, an attacker can collect side information such as the amount of power consumed by the encryption/decryption circuit, the waveform of electromagnetic waves generated by the encryption/decryption circuit, etc. An attacker can attack the encryption/decryption circuit to find out the key used in the encryption/decryption circuit based on the collected information.

Embodiments of the present invention may provide configurations and operations of electronic circuits and electronic devices that perform encryption operations and/or decryption operations to prevent side channel analysis attacks. Electronic circuits and electronic devices according to embodiments of the present invention can adaptively use clock signals necessary to perform encryption operations and/or decryption operations.

An electronic circuit according to an embodiment of the present invention may include an encryption calculator and a controller. The encryption operator may perform at least one of encryption and decryption operations using a plurality of logic gates. Based on a control value related to the performance of at least one of the encryption and decryption operations and a clock signal, the controller causes each of the plurality of logic gates to output a first logic value during a first time period and the plurality of logic gates during a second time period. The operation of the encryption operator can be controlled so that the number of logic gates outputting the first logic value and the number of logic gates outputting the second logic value among the logic gates are maintained constant. When the control value indicates that at least one of the encryption and decryption operations is not performed, the plurality of logic gates may operate in one of the first time period and the second time period under the control of the controller.

An electronic circuit according to an embodiment of the present invention may include an encryption operator, an encryption controller, and a section controller. The cryptographic operator may include a plurality of logic gates. The encryption controller may output a control value related to the performance of at least one of encryption and decryption operations by the encryption operator. The section controller may generate an activation signal based on the control value and clock signal. During the first time period, each of the plurality of logic gates may output a first logic value in response to the deactivation value of the activation signal. During the second time period, the number of logic gates outputting the first logic value and the number of logic gates outputting the second logic value among the plurality of logic gates may be maintained constant in response to the activation value of the activation signal.

An electronic device according to an embodiment of the present invention may include a data input/output device, an encryption/decryption circuit, and a section controller. An encryption/decryption circuit may perform encryption and decryption operations for a data input/output device. The section controller may generate an activation signal based on a clock signal and a control value indicating whether encryption and decryption operations are performed. When the control value indicates that encryption and decryption operations are not to be performed, in response to an enable signal having one of the following values: disable and enable, the outputs from the encryption/decryption circuit are left unchanged and the amount consumed by the encryption/decryption circuit is The amount of power can be kept constant.

An electronic circuit according to an embodiment of the present invention may include an encryption calculator and a controller. The cryptographic operator may include a plurality of logic gates that operate based on a clock signal. The controller includes logic gates that output a first logic value among the plurality of logic gates in response to the second logic value of the clock signal without changing output values from the plurality of logic gates in response to the first logic value of the clock signal. The operation of the encryption operator can be controlled so that the number of logic gates outputting the second logic value is maintained constant. The length of the first time period in which the clock signal has the first logic value may be shorter than the length of the second time period in which the clock signal has the second logic value.

An electronic circuit according to an embodiment of the present invention may include a clock controller and an encryption calculator. The clock controller may generate a second clock signal based on the first clock signal. The cryptographic operator may include a plurality of logic gates that operate based on the second clock signal. The length of the first time period in which the first clock signal has the first logic value may be the same as the length of the second time period in which the first clock signal has the second logic value. The length of the third time period in which the second clock signal has the first logic value may be shorter than the length of the fourth time period in which the second clock signal has the second logic value. In response to the first logic value of the second clock signal, output values from the plurality of logic gates may not change. In response to the second logic value of the second clock signal, the number of logic gates outputting the first logic value and the number of logic gates outputting the second logic value among the plurality of logic gates may be maintained constant.

An electronic device according to an embodiment of the present invention may include a data input/output device, a clock controller, and an encryption/decryption circuit. A clock controller can generate a clock signal. An encryption/decryption circuit may perform encryption and decryption operations for a data input/output device based on a clock signal. The length of the first time period in which the clock signal has the first logic value may be shorter than the length of the second time period in which the clock signal has the second logic value. In response to the first logic value of the clock signal, output values from the encryption/decryption circuit may not change. In response to the second logic value of the clock signal, the amount of power consumed by the encryption/decryption circuit may be kept constant.

According to embodiments of the present invention, the amount of power consumed by the encryption/decryption circuit can be reduced. Furthermore, the computational performance and security level of the encryption/decryption circuit can be improved.

1 is a block diagram showing a computing device including electronic devices employing encryption/decryption circuits according to embodiments of the present invention.
FIG. 2 is a block diagram showing an exemplary configuration of the encryption/decryption circuit of FIG. 1.
FIG. 3 is a flow diagram illustrating an example encryption operation performed in the encryption/decryption circuit of FIG. 2.
FIG. 4 is a block diagram showing an example logic circuit included in the encryption/decryption circuit of FIG. 2.
FIG. 5 is a table for explaining the operation of the logic circuit of FIG. 4.
FIG. 6 is a timing diagram illustrating time sections of an exemplary encryption/decryption operation performed in the encryption/decryption circuit of FIG. 2.
FIG. 7 is a block diagram showing an example configuration included in the encryption/decryption circuit of FIG. 2.
FIG. 8 is a timing diagram for explaining time sections of an example encryption/decryption operation performed in an encryption/decryption circuit including the section controller of FIG. 7.
FIGS. 9A and 9B are block diagrams showing example configurations of the section controller of FIG. 7 in relation to the timing diagram of FIG. 8.
FIG. 10 is a timing diagram for explaining time sections of an example encryption/decryption operation performed in an encryption/decryption circuit including the section controller of FIG. 7.
FIGS. 11A and 11B are block diagrams showing example configurations of the section controller of FIG. 7 in relation to the timing diagram of FIG. 10.
FIG. 12 is a block diagram showing an example configuration included in the encryption/decryption circuit of FIG. 2.
FIG. 13 is a block diagram showing an example configuration included in the encryption/decryption circuit of FIG. 2.
FIG. 14 is a timing diagram illustrating time sections of an exemplary encryption/decryption operation performed in the encryption/decryption circuit of FIG. 2.
FIG. 15 is a block diagram showing an example configuration included in the encryption/decryption circuit of FIG. 2.
FIG. 16 is a block diagram showing an exemplary configuration of the clock controller of FIG. 15.
FIG. 17 is a timing diagram illustrating time intervals of an example encryption/decryption operation performed in the encryption/decryption circuit of FIG. 15 including the clock controller of FIG. 16.
FIG. 18 is a block diagram showing an example configuration of the clock controller of FIG. 15.
FIG. 19 is a timing diagram illustrating time intervals of an example encryption/decryption operation performed in the encryption/decryption circuit of FIG. 15 including the clock controller of FIG. 18.
FIG. 20 is a block diagram showing an example configuration included in the encryption/decryption circuit of FIG. 2.
FIG. 21 is a timing diagram illustrating time sections of an example encryption/decryption operation performed in an encryption/decryption circuit including the initialization controller of FIG. 20.
FIGS. 22A and 22B are block diagrams showing example configurations of the initialization controller of FIG. 20 in relation to the timing diagram of FIG. 21.
FIG. 23 is a block diagram showing an example configuration included in the encryption/decryption circuit of FIG. 2.
FIG. 24 is a block diagram showing an example configuration of the initialization randomizer of FIG. 23.

Below, embodiments of the present invention are described clearly and in detail with reference to the accompanying drawings so that those skilled in the art (hereinafter, skilled in the art) can easily practice the present invention. It will be explained.

1 is a block diagram showing a computing device including electronic devices employing encryption/decryption circuits according to embodiments of the present invention. In some embodiments, the computing device 1000 includes a processor device 1100, a working memory 1200, a storage device 1300, a communication block 1400, a user interface 1500, and other devices ( s) (1600), and a bus (Bus, 1700).

For example, the computing device 1000 may include a desktop computer, a laptop computer, a tablet computer, a workstation, a server, a digital television, a video game console, and a smart computer. It may be one of various electronic devices such as a phone, wearable device, etc., but the present invention is not limited to this example.

The processor device 1100 may control overall operations of the computing device 1000. The processor device 1100 may be configured to process various types of arithmetic operations and/or logical operations. To this end, the processor device 1100 is a special-purpose logic circuit (e.g., Field Programmable Gate Array (FPGA), Application Specific Integrated Circuits (ASICs), etc.) including one or more processor cores 1110. It can be implemented. As an example, the processor device 1100 may include a general-purpose processor, a dedicated processor, and/or an application processor.

For example, the processor device 1100 may execute an instruction set of program code using the processor cores 1110. One or more caches 1130 may temporarily store data generated by execution of an instruction set or data to be used to execute the instruction set.

The working memory 1200 may temporarily store data used in the operation of the computing device 1000. As an example, the working memory 1200 may store data processed or to be processed by the processor device 1100 in one or more memories 1210 . For example, the memories 1210 may include volatile memory such as static random access memory (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), etc. The memory controller 1230 may control the memories 1210 so that the memories 1210 store data or output the stored data.

The storage device 1300 can store data regardless of power supply. The storage device 1300 may store system data used to operate the computing device 1000 and/or user data for a user of the computing device 1000 in one or more nonvolatile memories 1310 . For example, the non-volatile memories 1310 include non-volatile memory such as flash memory, phase-change RAM (PRAM), magneto-resistive RAM (MRAM), resistive RAM (ReRAM), and ferro-electric RAM (FRAM). It may include at least one of the memories. The memory controller 1330 may control the non-volatile memories 1310 so that the non-volatile memories 1310 store data or output stored data. For example, the storage device 1300 may be a solid state drive (SSD). , may include storage media such as HDD (Hard Disk Drive), SD (Secure Digital) card, MMC (Multimedia Card), etc.

The communication block 1400 may communicate with an external device/system of the computing device 1000 under the control of the processor device 1100. As an example, the communication block 1400 may use at least one of various wired communication protocols such as Ethernet, Transfer Control Protocol/Internet Protocol (TCP/IP), Universal Serial Bus (USB), Firewire, and/or LTE (Long Term Evolution), WiMax (Worldwide Interoperability for Microwave Access), GSM (Global System for Mobile communications), CDMA (Code Division Multiple Access), Bluetooth, NFC (Near Field Communication), WiFi (Wireless Fidelity), RFID (Radio Frequency Identification) ) may communicate with an external device/system of the computing device 1000 according to at least one of various wireless communication protocols such as ).

The user interface 1500 may mediate communication between the user and the computing device 1000 according to the control of the processor device 1100. For example, the user interface 1500 may process input from a keyboard, mouse, keypad, button, touch panel, touch screen, touch pad, touch ball, camera, microphone, gyroscope sensor, vibration sensor, etc. Furthermore, the user interface 1500 can process output to a display device, speaker, motor, etc.

In addition, the computing device 1000 may further include other devices 1600. For example, the other device 1600 may include various peripheral devices such as an image sensor, a graphics processing unit, a sound processor, and a Global Positioning System (GPS) device.

Each of the processor device 1100, working memory 1200, storage device 1300, communication block 1400, user interface 1500, and other devices 1600 may be implemented as chip-level and/or package-level devices. and may be mounted on the computing device 1100. Alternatively, the processor device 1100, working memory 1200, storage device 1300, communication block 1400, user interface 1500, and other devices 1600 may each be implemented as independent electronic devices, Can be assembled into computing device 1100. Mounted or assembled components may be connected to each other through a bus 1700.

Bus 1700 may provide a communication path between components of computing device 1000. Components of the computing device 1000 may exchange data with each other based on the bus format of the bus 1700. As examples, bus formats include Peripheral Component Interconnect Express (PCIe), Nonvolatile Memory Express (NVMe), Small Computer System Interface (SCSI), Advanced Technology Attachment (ATA), Serial ATA (SATA), Parallel ATA (PATA), and SAS ( It may include one or more of various communication protocols such as Serial Attached SCSI (Serial Attached SCSI), UFS (Universal Flash Storage), etc.

Depending on the operation of the computing device 1000, data may be input to or output from the components of the computing device 1000. Each of the components of the computing device 1000 may be referred to as a data input/output device.

Input or output data may be exposed to entities external to the computing device 1000. For example, an attacker (e.g., a hacker) on the computing device 1000 may manipulate data input to the processor device 1100 and gain control of the processor device 1100 and the computing device 1000. can be obtained. For example, an attacker may gain control of the processor device 1100 and stop the operation of the computing device 1000 or operate the computing device 1000 maliciously.

For example, an attacker may manipulate data stored in the working memory 1200 and/or the storage device 1300 to arbitrarily change the data or damage the security properties of the data. For example, an attacker may insert malicious code into data stored in the working memory 1200 or crack the access password or Digital Right Management (DRM) properties of data stored in the storage device 1300. . In these examples, the security levels and reliability of computing device 1000 and its components may deteriorate significantly.

For this reason, components of the computing device 1000 may include encryption/decryption circuits to encrypt input or output data and decrypt the encrypted data. An encryption/decryption circuit may perform encryption and decryption operations for a data input/output device. In encryption and decryption operations, the encryption/decryption circuit can encrypt/decrypt data according to an encryption/decryption algorithm using a key. If the key is unknown, it may be difficult for an attacker to determine the key based solely on the input/output data, and therefore, it may also be difficult for an attacker to determine the original version of the encrypted data. Therefore, encryption and decryption operations can improve the security level and reliability of electronic devices and electronic circuits.

As an example, the processor device 1100 may encrypt data output from the processor cores 1110 and/or caches 1130 using the encryption/decryption circuit 1150. Furthermore, the processor device 1100 may decrypt data to be input to the processor cores 1110 and/or caches 1130 using the encryption/decryption circuit 1150. It can be difficult for an attacker to understand and analyze data that is transformed according to encryption and decryption operations. Accordingly, the control authority of the processor device 1100 can be protected.

As an example, the working memory 1200 may use the encryption/decryption circuit 1250 to encrypt data to be stored in the memories 1210. Furthermore, the working memory 1200 can decrypt data output from the memories 1210 using the encryption/decryption circuit 1250. Similarly, the storage device 1300 can encrypt data to be stored in the non-volatile memories 1310 using the encryption/decryption circuit 1350. Furthermore, the storage device 1300 can decrypt data output from the non-volatile memories 1310 using the encryption/decryption circuit 1350. Accordingly, it may be difficult for an attacker to arbitrarily change or damage data stored in the memories 1210 and/or non-volatile memories 1310, and the stored data may be safely protected.

Figure 1 shows that encryption/decryption circuits 1150, 1250, and 1350 are included in data input/output devices 1100, 1200, and 1300. However, in some cases, the encryption/decryption circuits 1150, 1250, and 1350 may be implemented separately from the data input/output devices 1100, 1200, and 1300. Furthermore, in addition to the data input/output devices 1100, 1200, and 1300, some devices (eg, 1400, 1500, 1600, etc.) and the bus 1700 may also employ encryption/decryption circuits. Encryption/decryption circuits can be employed anywhere on the path where data is input or output. Figure 1 is provided to aid better understanding and is not intended to limit the invention.

Hereinafter, example configurations and operations of the encryption/decryption circuit 1350 will be described with reference to FIGS. 2 to 24. However, the encryption/decryption circuits 1150 and 1250 and other encryption/decryption circuits not shown may also be configured and operated according to the following embodiments. The following examples are provided to aid better understanding and are not intended to limit the present invention.

FIG. 2 is a block diagram showing an exemplary configuration of the encryption/decryption circuit of FIG. 1. As shown in FIGS. 1 and 2 , the encryption/decryption circuit 1350 may be connected to the non-volatile memories 1310 and the memory controller 1330 in the storage device 1300. Although the encryption/decryption circuit 1350 for non-volatile memories 1310 is described in this specification, the encryption/decryption circuit 1350 does not include volatile memory (e.g., buffer memory, cache memory, etc.) included in the storage device 1300. ) can also be applied.

In some embodiments, the encryption/decryption circuit 1350 includes a buffer 1351, an encryption operator 1352, a decryption operator 1353, a key manager 1354, a Substitution-Box (S-Box) 1355, and an encryption/decryption operator 1355. It may include a decryption controller 1356. However, in some other embodiments, the encryption/decryption circuit 1350 may not include some of the components shown in FIG. 2 or may further include components not shown in FIG. 2 .

The buffer 1351 may temporarily store (eg, buffer) data provided from the non-volatile memories 1310 and the memory controller 1330. Data buffered in the buffer 1351 may be provided to the encryption operator 1352 or the decryption operator 1353. That is, the buffer 1351 can store data on which encryption and/or decryption operations are to be performed.

The encryption operator 1352 may perform an encryption operation on data to be stored in the non-volatile memories 1310. Accordingly, the security level of data stored in the non-volatile memories 1310 can be improved. The decryption operator 1353 may perform a decryption operation on data read from the non-volatile memories 1310. Accordingly, the memory controller 1330 can receive decrypted data.

Some encryption and decryption operations can be performed using keys. As an example, some encryption and decryption operations involve combinational logical operations (e.g., Or, And, Exclusive Or, etc.) for given data and a given key. It may include performing The key may not be known to an external entity and may be uniquely selected in the encryption/decryption circuit 1350. Accordingly, encryption and decryption operations can protect data from attackers' attacks.

Key manager 1354 may manage keys used in encryption and decryption operations. Key manager 1354 may include memory for storing keys, or may access keys stored in other memories.

As will be explained with reference to Figure 3, the encryption operation (and/or decryption operation) is not performed only once, but may be repeated multiple times to increase the level of security. Performing an encryption operation (and/or decryption operation) once may be referred to as one “Round.” The number of repetitions of encryption operations (and/or decryption operations) may be managed based on a “round value”. As an example, the key may be selected differently for each round. As an example, the key selected for the first round may be different from the key selected for the second round.

Key manager 1354 can manage multiple keys. The key manager 1354 can schedule a key to be selected in each round among a plurality of keys. The key manager 1354 may provide a scheduled key to the encryption operator 1352 and/or the decryption operator 1353 in response to requests from the encryption operator 1352 and/or the decryption operator 1353.

S-Box 1355 can perform substitution operations. In the substitution operation, the S-Box 1355 can convert m-bit input into n-bit output (m and n are each integers of 1 or more, and m may be the same as or different from n. has exist). As an example, the substitution operation of the S-Box 1355 may be performed based on a look-up table including a correspondence between m-bit input and n-bit output.

For example, instead of directly performing encryption and decryption operations on data received from the buffer 1351, the encryption operator 1352 and the decryption operator 1353 encrypt the data replaced by the S-Box 1355. Calculation and decryption operations can be performed. The S-Box 1355 can convert data buffered in the buffer 1351 into other data for the encryption operator 1352 and the decryption operator 1353. Because the S-Box 1355 changes the data on which encryption and decryption operations are performed, the security level of the data can be further improved.

In some cases, S-Box 1355 may also perform substitution operations on keys selected by key manager 1354. Encryption and decryption operations can keep data more secure when both data and keys change.

Each of the encryption operator 1352, the decryption operator 1353, and the S-Box 1355 may include a plurality of logic gates. The encryption operator 1352, the decryption operator 1353, and the S-Box 1355 can respectively perform encryption operations, decryption operations, and substitution operations using logic gates.

The logic gates of the cryptographic operator 1352 may operate based on the clock signal CLK1 to perform the cryptographic operation. The logic gates of the decryption operator 1353 may operate based on the clock signal CLK2 to perform a decryption operation. The logic gates of the S-Box 1355 may operate based on the clock signal CLK3 to perform a substitution operation. Each of the clock signals CLK1, CLK2, and CLK3 has a rising edge and a falling edge to have a first logic value (e.g., logic “0”) and a second logic value (e.g., logic “1”). It may refer to a signal formed by an edge.

As an example, each of the clock signals CLK1, CLK2, and CLK3 may be provided from a clock generator internal or external to the encryption/decryption circuit 1350. As an example, storage device 1300 and/or computing device 1000 may include clock generator(s) that generate clock signals CLK1, CLK2, and CLK3. By way of example, the clock signals CLK1, CLK2, and CLK3 may be provided from separate clock generators, or may be provided from one clock generator.

Figure 2 shows that the encryption operator 1352, the decryption operator 1353, and the S-Box 1355 each receive separate clock signals (CLK1, CLK2, and CLK3). However, in some embodiments, some or all of encryption operator 1352, decryption operator 1353, and S-Box 1355 may share the same clock signal.

When the encryption operator 1352 is implemented separately from the decryption operator 1353, the encryption operation and the decryption operation can be performed in parallel, thereby improving the performance of the encryption/decryption circuit 1350. Meanwhile, in some cases, the encryption operator 1352 and the decryption operator 1353 may be implemented as one module, and thus the area of the encryption/decryption circuit 1350 may be reduced. In some cases, the encryption/decryption circuit 1350 may include multiple encryption operators and/or multiple decryption operators to achieve higher performance.

As shown in Figure 2, S-Box 1355 can be implemented as an independent module. However, in some cases, S-Box 1355 may be included in encryption operator 1352, decryption operator 1353, and/or key manager 1354. The encryption operator 1352, the decryption operator 1353, and the key manager 1354 may share the S-Box 1355 or use separate S-Boxes.

The encryption/decryption controller 1356 may control the operations of the components of the encryption/decryption circuit 1350. As an example, the encryption/decryption controller 1356 may control the operations of the buffer 1351, the encryption operator 1352, the decryption operator 1353, and the key manager 1354.

As an example, the encryption/decryption controller 1356 may initiate an encryption operation of the encryption operator 1352 and/or a decryption operation of the decryption operator 1353 in response to a request (REQ). The request (REQ) may be provided from an external component of the encryption/decryption circuit 1350 (e.g., memory controller 1330, processor unit 1100, etc.), or may be generated within the encryption/decryption circuit 1350.

The encryption/decryption controller 1356 may include a register (Register, 1356a). Register 1356a may store control values. The control value may be related to performing at least one of encryption and decryption operations. By way of example, a control value may indicate whether a cryptographic operation is performed or not performed, or may indicate the circumstances of the cryptographic operation (e.g., speed, security level, operation mode, etc.).

The control value may be stored in register 1356a in response to a request (REQ) or based on a determination of the encryption/decryption controller 1356. As an example, if the memory controller 1330 provides a request (REQ) to initiate an encryption operation to the encryption/decryption controller 1356, register 1356a may store a control value indicating that the encryption operation is performed. . As an example, the encryption/decryption controller 1356 refers to the control value stored in the register 1356a and controls the operations of the buffer 1351, the encryption operator 1352, and the key manager 1354 so that the encryption operation is performed. You can.

Although “register” has been described with reference to FIG. 2, the present invention is not limited to FIG. 2. The encryption/decryption controller 1356 may employ other types of memory other than registers to store control values. Furthermore, as explained above, the blocks shown in FIG. 2 are provided to aid better understanding and are not intended to limit the invention. In other embodiments, some blocks may be combined into larger blocks, and one block may be divided into multiple blocks.

FIG. 3 is a flow diagram illustrating an example encryption operation performed in the encryption/decryption circuit of FIG. 2.

As an example, Figure 3 illustrates that the encryption/decryption circuit 1350 performs an encryption operation according to the Advanced Encryption Standard (AES) established by the U.S. National Institute of Standards and Technology (NIST). The encryption operation may be performed by the encryption operator 1352 mainly under the control of the encryption/decryption controller 1356. The register 1356a can store control values that indicate the performance and environment of the encryption operation.

In operation S110, the cryptographic operator 1352 may perform the “AddRoundKey” operation. The “AddRoundKey” operation performs a bitwise combinational logical operation (e.g., a logical sum operation, a logical product operation, an exclusive logical sum operation, etc.) on the data from the buffer 1351 and the key from the key manager 1354. It may include performing Accordingly, data from buffer 1351 can be converted to other data based on the selected key.

In operation S120, the S-Box 1355 may perform a substitution operation on the data converted in operation S110 in response to a request from the encryption operator 1352. In operation S122, the encryption operator 1352 may perform a “ShiftRows” operation on the state of the data replaced in operation S120. In the “ShiftRows” operation, rows of the data state can be shifted in a cyclic structure. In operation S124, the encryption operator 1352 may perform a “MixColumns” operation on the data state shifted in operation S122. In the “MixColumns” operation, columns of data states can be mixed.

Thereafter, in operation S126, the encryption operator 1352 may perform an “AddRoundKey” operation on the converted data having a mixed state in operation S124. The encryption operator 1352 may perform a bit-wise combinational logic operation on the converted data and the key from the key manager 1354. In some embodiments, the encryption operator 1352 may omit operation S126 and perform operation S130 depending on settings.

According to operations S120 to S126, data from the buffer 1351 may be converted to have a different value from the original value. Therefore, it can become difficult for attackers to intentionally attack data, and the security level can be improved. Operations S120 to S126 may constitute one round. The key manager 1354 may select different keys for each round for the “AddRoundKey” operation of operation S126.

In operation S130, the encryption/decryption controller 1356 may determine whether the next round is the last round. The encryption/decryption controller 1356 can manage the round value and increase the round value by 1 each time one round is performed. As an example, rounds may be repeated 10, 12, or 14 times depending on the data size (however, the invention is not limited thereto), and the encryption/decryption controller 1356 may repeat the next round based on the round value. It is possible to determine whether is the last round. As an example, the round value may be stored in register 1356a as part of the control value.

If the next round is not the last round, operation S120 may be performed again. In operation S120, the S-Box 1355 may perform a substitution operation on the data converted in operation S126 in response to a request from the encryption operator 1352. On the other hand, if the next round is the last round, operation S140 may be performed.

In operation S140, the S-Box 1355 may perform a substitution operation on the data converted in operation S126 in response to a request from the encryption operator 1352. In operation S142, the encryption operator 1352 may perform a “ShiftRows” operation on the state of the data replaced in operation S140. In operation S144, the encryption operator 1352 may perform an “AddRoundKey” operation on the converted data having the shifted state in operation S142. As an example, after the last round is completed, the round value may be initialized (e.g., to 0).

As the round is repeated, the data value may be gradually converted. After the last round consisting of operations S140 to S144 is completed, the finally converted data may be stored in the non-volatile memories 1310. Accordingly, it may become quite difficult for an attacker to arbitrarily manipulate or damage encrypted data in the non-volatile memories 1310.

As an example, the encryption operation of FIG. 3 may be initiated in response to a request (REQ) from an external device or based on a determination of the encryption/decryption controller 1356. In some embodiments, the memory controller 1330 may provide a request (REQ) to the encryption/decryption controller 1356 to store encrypted data in the non-volatile memories 1310. The encryption/decryption controller 1356 may control the encryption operator 1352 to perform an encryption operation in response to a request (REQ). Register 1356a may store a control value indicating that an encryption operation is performed in response to a request (REQ).

Encryption operations can be performed on data having an operation unit size. As an example, the operation unit size for the “MixColumns” operation may be 32 bits, and the “MixColumns” operation may be performed on 32 bits of data. As an example, the operation unit size for the “ShiftRows” operation may be 128 bits, and the “ShiftRows” operation may be performed on 128 bits of data.

In some embodiments, the encryption/decryption controller 1356 may monitor the size of data stored in the buffer 1351. If the data stored in the buffer 1351 has the operation unit size of the encryption operation, the encryption/decryption controller 1356 may determine that the encryption operation is performed. For example, as data gradually accumulates in the buffer 1351, if the buffer 1351 completely stores 32 bits of data for the “MixColumns” operation, the encryption/decryption controller 1356 causes the “MixColumns” operation to be performed. The encryption operator 1352 can be controlled.

Meanwhile, if the data stored in the buffer 1351 does not have the operation unit size of the encryption operation, the encryption/decryption controller 1356 may determine that the encryption operation is not performed. Register 1356a may store a control value indicating whether an encryption operation is performed or not, depending on the determination of the encryption/decryption controller 1356.

In some embodiments, encryption/decryption controller 1356 may control encryption operations based on round values. If the round value corresponds to 0, the encryption operation may not be performed, and thus the register 1356a may store a control value indicating that the encryption operation is not performed. On the other hand, if the round value does not correspond to 0 (e.g., when the encryption/decryption controller 1356 increases the round value), an encryption operation can be performed, and thus the register 1356a indicates that the encryption operation is performed. Control values can be saved.

The decryption operation of the decryption operator 1353 may be performed corresponding to the encryption operation of FIG. 3. As an example, the decryption operator 1353 may perform the encryption operations of FIG. 3 in reverse to decrypt the encrypted data. Register 1356a may store a control value indicating whether a decryption operation is performed or not performed. Since the decryption operation can be well understood by those skilled in the art, detailed descriptions of the decryption operation will be omitted below. Decrypted data may be provided to the memory controller 1330.

Cryptographic operations defined in the FIPS 197 document published by NIST were explained with reference to FIG. 3. However, Figure 3 is provided to facilitate better understanding and is not intended to limit the present invention. The encryption/decryption circuit 1350 may employ different types of standards for encryption/decryption operations. Alternatively, the encryption/decryption circuit 1350 may employ different operations than those shown in FIG. 3 to improve the level of security.

FIG. 4 is a block diagram showing an example logic circuit included in the encryption/decryption circuit of FIG. 2. FIG. 5 is a table for explaining the operation of the logic circuit of FIG. 4.

Some encryption/decryption circuits can be attacked by a "Side-channel Analysis Attack". In a side channel analysis attack, an attacker can collect side information such as the amount of power consumed by the encryption/decryption circuit, the waveform of electromagnetic waves generated by the encryption/decryption circuit, etc. An attacker can attack the encryption/decryption circuit to find out the key used in the encryption/decryption circuit based on the collected information.

Accordingly, the encryption/decryption circuit 1350 according to an embodiment of the present invention may include a logic circuit (LGC) to prevent side channel analysis attacks. Referring to FIG. 4, the logic circuit LGC may perform a combinational logic operation corresponding to an exclusive OR operation. In some examples, cryptographic operator 1352 may include logic circuitry (LGC), which may include an “AddRoundKey” operation (e.g., in operations S110, S126, and S144 of FIG. 3) and It can be related.

The logic circuit (LGC) can receive four inputs (A, B, ~A, ~B). Input (~A) may correspond to the inverted value of input (A), and input (~B) may correspond to the inverted value of input (B). As an example, if logic circuit (LGC) is associated with an “AddRoundKey” operation, input (A) may correspond to a bit contained in data from buffer 1351 and input (B) may correspond to a bit contained in data from key manager 1354. It can correspond to the bits included in the key. The logic circuit (LGC) may output the exclusive logical sum of the inputs (A, B) and results corresponding to the inverted value of the exclusive logical sum.

Inputs A, B, ~A, ~B may or may not pass through logic gates P1, P2, P3, and P4, respectively, based on the clock signal CLK1. As an example, while clock signal CLK1 has a first logic value (e.g., logic “0”), inputs A, B, ~A, ~B have logic gates P1, P2, P3, and P4. ) and each of the logic gates P1, P2, P3, and P4 may output a first logic value (eg, logic “0”). Meanwhile, while the clock signal CLK1 has a second logic value (e.g., logic “1”), the inputs A, B, ~A, ~B have logic gates P1, P2, P3, and P4. (that is, the logic gates (P1, P2, P3, and P4) can output values corresponding to the inputs (A, B, ~A, ~B), respectively). Here, “passing” a specific input may mean that that specific input actively affects generating the output of the logic gate.

Logic gates (AND1, AND2, OR1, OR2) can combine values output from logic gates (P1, P2, P3, and P4). Logic gates OR3 and AND3 can combine values output from logic gates AND1, AND2, OR1, and OR2. Accordingly, the logic gates OR3 and AND3 may output results corresponding to the exclusive logical sum of the inputs A and B and the inverted value of the exclusive logical sum.

Figure 5 shows the relationship between the inputs (A, B) of the logic circuit (LGC) and the outputs of the logic gates (AND1, AND2, AND3, OR1, OR2, OR3). When the clock signal (CLK1) has a value of logic "0", each of the logic gates (AND1, AND2, AND3, OR1, OR2, OR3) has a logic "0" value regardless of the values of the inputs (A, B). The value of can be output. Meanwhile, when the clock signal (CLK1) has a value of logic “1”, the logic gates (AND1, AND2, AND3, OR1, OR2, OR3) display different values depending on the values of the inputs (A, B). Can be printed.

Referring to FIG. 5 , it can be understood that while the clock signal CLK1 has a value of logic “1”, the number of logic gates outputting a value of logic “1” is constant. As an example, in the logic circuit LGC of FIG. 4, logic gates outputting a value of logic “1” can be changed depending on the values of inputs A and B. However, regardless of the values of the inputs (A, B), one logical product (AND) gate outputs a value of logic “1” and two logical sum (OR) gates output values of logic “1”. can do.

In the logic circuit (LGC) of FIG. 4, the number of logic gates outputting a value of logic “1” can be kept constant, and thus the total amount of power consumed by the logic circuit (LGC) can be kept constant. You can. Because of this, even if the attacker collects ancillary information such as the amount of power consumed by the logic circuit (LGC), the waveform of electromagnetic waves generated by the logic circuit (LGC), etc., the attacker cannot determine the configuration and operation of the logic circuit (LGC). may be difficult to understand. As a result, the logic circuit (LGC) can enable protection against side-channel analysis attacks.

However, the configuration and operation of the logic circuit (LGC) described with reference to FIGS. 4 and 5 are only examples to facilitate better understanding and are not intended to limit the present invention. The configuration and operation of the logic circuit (LGC) can be modified or changed in various ways. Furthermore, the logic circuit (LGC) is only one example of various logic circuits included in the encryption/decryption circuit 1350. The encryption/decryption circuit 1350 may further include several other logical circuits with various configurations to perform encryption and decryption operations.

In embodiments of the present invention, the encryption/decryption circuit 1350 may include one or more logic circuits configured to consume a certain amount of power to prevent side channel analysis attacks. These logic circuits may include a plurality of logic gates, and among the plurality of logic gates, the number of logic gates outputting a value of logic “0” and the number of logic gates outputting a value of logic “1” are maintained constant. It can be.

FIG. 6 is a timing diagram illustrating time sections of an exemplary encryption/decryption operation performed in the encryption/decryption circuit of FIG. 2.

To facilitate better understanding, the clock signal CLK1 in FIGS. 2 and 4 will be explained. The clock signal CLK1 may alternately have a value of logic “0” and a value of logic “1”. While the clock signal CLK1 has a logic value of “1”, the encryption/decryption circuit 1350 may perform encryption and/or decryption operations. As an example, logic circuit LGC of FIG. 4 may output an exclusive logical sum of inputs A and B while clock signal CLK1 has a value of logic “1.”

Meanwhile, while the clock signal CLK1 has a logic value of “0”, the encryption/decryption circuit 1350 may not perform encryption and decryption operations. As an example, logic circuit LGC of Figure 4 may output a value of logic "0" regardless of the values of inputs A and B while clock signal CLK1 has a value of logic "0". , therefore, encryption operations may not be performed. When the clock signal CLK1 has a logic value of “0”, the states of the logic gates of the encryption/decryption circuit 1350 may be reset, and the power consumed by these logic gates may be reduced. can be minimized.

Changing the state and power consumption of logic gates (eg, switching) based on the clock signal CLK1 can make side channel analysis attacks more difficult. Therefore, alternation of the logic values of the clock signal CLK1 can improve the security level.

While the clock signal CLK1 has a value of logic “0”, the states of the logic gates may be reset. The first time period in which the clock signal CLK1 has a logic value of “0” may be referred to as an “initialization period.” Meanwhile, while the clock signal CLK1 has a logic value of “1”, at least one of an encryption operation and a decryption operation may be performed. The second time period in which the clock signal CLK1 has a logic value of “1” may be referred to as an “operation period.” In response to the alternation of logic values of the clock signal CLK1, the initialization period and the calculation period may occur alternately.

In some examples, one round of operations may be performed during one operation period. In some other examples, multiple rounds of operations may be performed during one operation interval. In some other examples, one round of operations may be performed over multiple operation intervals. The relationship between calculation sections and rounds may be changed or modified due to various factors such as hardware size, calculation performance, and operation policy of the encryption/decryption circuit 1350.

However, the encryption operation and decryption operation may not be performed in the entire operation section. For example, if a request (REQ) is not provided from an external device, the encryption operation and decryption operation may not be performed even in the operation section. For example, when the encryption/decryption controller 1356 determines that the encryption and decryption operations are not performed (e.g., when the size of the data stored in the buffer 1351 is smaller than the operation unit size), the encryption operation is also performed in the operation section. And the decryption operation may not be performed.

For example, based on a request (REQ) from an external device or a determination by the encryption/decryption controller 1356, an encryption operation and/or a decryption operation may be performed between the time point TP1 and the time point TP2. In this case, the encryption operation and the decryption operation may not be performed in the time section before the time point TP1 and in the time section after the time point TP2.

In some cases, even if encryption and decryption operations are not performed, the logical values of the clock signal CLK1 may continue to alternate. However, alternating the logical values of the clock signal CLK1 while encryption and decryption operations are not performed may increase the amount of power consumed by the encryption/decryption circuit 1350. This is because logic gates repeat outputting logic “0” (in the initialization section) and outputting logic “1” (in the operation section) (i.e., power may be consumed due to switching of the output value). there is).

Additionally, as described above, encryption and/or decryption operations may be performed only in the operation section. Accordingly, when the length of the initialization section becomes long, the length of the calculation section may become short, and thus the calculation performance of the encryption/decryption circuit 1350 may deteriorate.

FIG. 7 is a block diagram showing an example configuration included in the encryption/decryption circuit of FIG. 2. In some embodiments, the encryption/decryption circuit 2350 may include an encryption operator 2352, an encryption/decryption controller 2356, and a section controller 2357.

The configurations and operations of the encryption operator 2352 and the encryption/decryption controller 2356 may include the configurations and operations of the encryption operator 1352 and the encryption/decryption controller 1356 of FIG. 2, respectively. FIG. 7 only shows an exemplary configuration of the encryption/decryption circuit 2350, and the encryption/decryption circuit 2350 may further include components included in the encryption/decryption circuit 1350 of FIG. 2. For convenience of explanation, redundant descriptions of the encryption/decryption circuit 2350, encryption operator 2352, and encryption/decryption controller 2356 will be omitted below.

The encryption/decryption controller 2356 may output a control value (EC) and/or an inverted value (~EC) of the control value (EC). A control value (EC) may be related to the performance of a cryptographic operation. By way of example, a control value (EC) may indicate whether a cryptographic operation is performed or not performed. As an example, the control value (EC) may be output from register 1356a in FIG. 2.

The section controller 2357 may receive a clock signal (CLK1). The section controller 2357 may receive a control value (EC) from the encryption/decryption controller 2356. In some cases, section controller 2357 may receive an inverse value (˜EC) of the control value (EC) along with or instead of the control value (EC).

The section controller 2357 may generate an activation signal ACT1 based on the control value EC (and/or the inversion value of the control value EC (˜EC)) and the clock signal CLK1. The cryptographic operator 2352 may operate based on the activation signal ACT1 instead of directly receiving the clock signal CLK1. As an example, the encryption operator 2352 may perform an encryption operation based on the activation signal ACT1.

Unlike the clock signal CLK1, the logical values of the activation signal ACT1 may not alternate while an encryption operation is not performed. Accordingly, while an encryption operation is not performed, outputs from logic gates included in the encryption operator 2352 may not change. Furthermore, while an encryption operation is not being performed, the amount of power consumed by the logic gates of the encryption operator 2352 can be maintained constant. The activation signal ACT1 will be further described with reference to FIGS. 8 and 10.

In some embodiments, some or all of the section controller 2357 may be included in the encryption/decryption controller 2356. In some other embodiments, some or all of the section controller 2357 may be provided external to the encryption/decryption circuit 2350. The exemplary configuration in FIG. 7 is provided to aid better understanding and is not intended to limit the invention. The configuration of the encryption/decryption circuit 2350 can be changed or modified in various ways.

FIG. 8 is a timing diagram for explaining time sections of an example encryption/decryption operation performed in an encryption/decryption circuit including the section controller of FIG. 7.

The section controller 2357 may receive a clock signal CLK1 that alternately has a value of logic “0” and a value of logic “1”. Furthermore, the section controller 2357 may receive a control value (EC) indicating whether an encryption operation and/or a decryption operation is performed or not.

As an example, a control value (EC) of logic “0” may indicate that encryption and/or decryption operations are not performed. As an example, if a request (REQ) from an external device is not provided, the control value (EC) may have a value of logic “0”. For example, if the data stored in the buffer 1351 of FIG. 2 does not have an operation unit size, the control value EC may have a value of logic “0”. As an example, if the round value corresponds to 0, the control value EC may have a value of logic “0”.

For example, in the time interval before the time point TP1 and in the time interval after the time point TP2, the encryption operation and the decryption operation may not be performed. Accordingly, in the time interval before the time point TP1 and the time interval after the time point TP2, the control value EC will have a value of logical “0” to indicate that the encryption operation and/or decryption operation is not performed. You can.

As an example, a control value (EC) of logic “1” may indicate that an encryption operation and/or a decryption operation are performed. As an example, when a request (REQ) is provided from an external device, the control value (EC) may have a value of logic “1”. For example, if the data stored in the buffer 1351 has an operation unit size, the control value EC may have a value of logic “1”. As an example, if the round value does not correspond to 0 (eg, increases above 1), the control value EC may have a value of logic “1”.

For example, in the time interval between the time points TP1 and TP2, at least one of an encryption operation and a decryption operation may be performed. Accordingly, in the time interval between the time points TP1 and TP2, the control value EC may have a value of logic “1” to indicate that the encryption operation and/or the decryption operation are performed.

However, the above examples are provided to aid better understanding and are not intended to limit the present invention. In some other examples, a control value (EC) of logical “0” may indicate that an encryption operation and/or decryption operation is performed, and a control value (EC) of logic “1” may indicate that an encryption operation and/or decryption operation are performed. You can indicate that it will not be performed.

The activation signal ACT1 may have a deactivation value and an activation value based on the clock signal CLK1 and the control value EC. To facilitate better understanding, it will be assumed that the deactivation value of the activation signal ACT1 corresponds to logic “0” and the activation value of the activation signal ACT1 corresponds to logic “1”. However, the present invention is not limited by this assumption, and the logical value corresponding to the deactivation value and the logical value corresponding to the activation value are interchangeable.

While the control value EC has a value of logic “0”, the activation signal ACT1 may be maintained at a deactivation value (eg, logic “0”) without alternating. As described above, the cryptographic operator 2352 may operate based on the activation signal (ACT1) instead of the clock signal (CLK1). Accordingly, if the control value (EC) indicates that the encryption operation and/or decryption operation is not performed, the outputs from the logic gates of the encryption operator 2352 may not be changed. For example, the logic circuit LGC of FIG. 4 may receive the deactivation value of the activation signal ACT1 instead of the clock signal CLK1, and each of the logic gates of the logic circuit LGC may receive the deactivation value of the activation signal ACT1. A first logic value (eg, logic “0”) may be output in response to the value.

While the encryption operation and/or the decryption operation are not performed, the logic gates of the encryption operator 2352 may operate in a first time period (eg, an initialization period) based on the deactivation value of the activation signal ACT1. Since the outputs from the logic gates of the cryptographic operator 2352 do not change during the initialization period, the amount of power consumed by the logic gates can be kept constant. Furthermore, because the outputs from the logic gates do not change, power consumption due to switching of output values can be prevented.

Meanwhile, while the control value EC has a logic value of “1”, the activation signal ACT1 may alternately have a deactivation value and an activation value in response to the clock signal CLK1. Accordingly, when the control value (EC) indicates that an encryption operation and/or a decryption operation is performed, the logic gates of the encryption operator 2352 respond to the alternation of the activation signal (ACT1) (i.e., the alternation of the deactivation value and the activation value). In response, it may alternately operate in the first time interval (eg, initialization interval) and the second time interval (eg, calculation interval).

In the operation section, the encryption operator 2352 may perform an encryption operation (and/or a decryption operation) using logic gates. The encryption operation and/or decryption operation may be performed in response to the activation value of the activation signal ACT1. During the operation period, as described with reference to FIGS. 4 and 5 , the number of logic gates outputting the first logic value and the number of logic gates outputting the second logic value may be maintained constant.

FIGS. 9A and 9B are block diagrams showing example configurations of the section controller of FIG. 7 in relation to the timing diagram of FIG. 8.

Referring to FIG. 9A, the section controller 2357 may include a combinational logic gate 2357a. The combination logic gate 2357a may generate an activation signal (ACT1) by combining the clock signal (CLK1) and the control value (EC). As an example, the combinational logic gate 2357a may perform an logical multiplication operation on the clock signal CLK1 and the control value EC.

In the example of FIG. 9A , if the control value EC indicates that encryption and/or decryption operations are not performed (e.g., has a value of logic “0”), combinational logic gate 2357a is set to a disabled value. An activation signal (ACT1) having a logic value (eg, logic “0”) may be generated. On the other hand, when the control value (EC) indicates that an encryption operation and/or a decryption operation is performed (e.g., has a value of logic “1”), the combinational logic gate 2357a is connected to the clock signal CLK1. An activation signal (ACT1) (that is, having an inactivation value and an activation value alternately) may be generated.

Referring to FIG. 9B, the section controller 2357 may include transistors 2357b and 2357c. The transistor 2357b may transmit the clock signal CLK1 as the activation signal ACT1 in response to the control value EC. The transistor 2357c may transmit a value of logic “0” as the activation signal ACT1 in response to the inversion value (˜EC) of the control value EC.

In the example of FIG. 9B , if the control value EC indicates that encryption and/or decryption operations are not performed (e.g., has a value of logic “0”), transistor 2357c is set to an inactive value (e.g., , an activation signal (ACT1) having logic “0”) can be transmitted. On the other hand, when the control value EC indicates that an encryption operation and/or a decryption operation is performed (e.g., has a value of logic “1”), the transistor 2357b is connected to the clock signal CLK1 (i.e. , an activation signal (ACT1) having a deactivation value and an activation value alternately may be transmitted.

When the section controller 2357 adopts the configuration shown in FIG. 9A or 9B, the section controller 2357 may generate the activation signal ACT1 described with reference to FIG. 8. In this case, while encryption and/or decryption operations are not performed, the output from the logic gates may remain constant in the initialization period. Accordingly, power consumption due to switching of output values can be prevented.

FIG. 10 is a timing diagram for explaining time sections of an example encryption/decryption operation performed in an encryption/decryption circuit including the section controller of FIG. 7.

Unlike the timing diagram of FIG. 8, referring to FIG. 10, while the control value EC has a value of logic “0”, the activation signal ACT1 may be maintained at an activation value (e.g., logic “1”). . Accordingly, when the control value EC indicates that the encryption operation and/or the decryption operation are not performed, the logic gates of the encryption operator 2352 may operate in the second time period (eg, operation period). For example, while the encryption operation and/or the decryption operation are not performed, the logic gates of the encryption operator 2352 may operate in the operation period in response to the activation value of the activation signal ACT1.

If the encryption operation and/or decryption operation is not performed, data input to the encryption operator 2352 may not be changed. For example, while an encryption operation and/or a decryption operation are not performed, the encryption operator 2352 may constantly receive data of a default value or data used in a previous operation. Accordingly, even if the encryption operator 2352 operates in the calculation section, outputs from the logic gates of the encryption operator 2352 may not change. As a result, even if the operation section is maintained, the amount of power consumed by the logic gates can be maintained constant, and power consumption due to switching of the output value can be prevented.

In some cases, data input to the encryption operator 2352 may be changed while the encryption and/or decryption operation is not performed. As an example, the cryptographic operator 2352 may receive data or register settings to be used in the next operation. In this case, the outputs from the logic gates of the cryptographic operator 2352 may be changed once. However, while the encryption operation and/or decryption operation is not performed, the data input to the encryption operator 2352 may not be changed multiple times. Therefore, even if the calculation section is maintained, power consumption due to switching the output value can be minimized.

Meanwhile, while the control value EC has a logic value of “1”, the activation signal ACT1 may alternately have a deactivation value and an activation value in response to the clock signal CLK1. This may correspond to the time interval between the time points TP1 and TP2 described with reference to FIG. 8 . For convenience of explanation, overlapping descriptions will be omitted below.

FIGS. 11A and 11B are block diagrams showing example configurations of the section controller of FIG. 7 in relation to the timing diagram of FIG. 10.

Referring to FIG. 11A, the section controller 2357 may include a combinational logic gate 2357d. The combination logic gate 2357d may generate an activation signal (ACT1) by combining the clock signal (CLK1) and the inverted value (˜EC) of the control value (EC). As an example, the combinational logic gate 2357d may perform a logical sum operation on the clock signal CLK1 and the inverted value (˜EC) of the control value (EC).

In the example of FIG. 11A , when the control value (EC) indicates that encryption and/or decryption operations are not performed (e.g., has a value of logic “0”), combinational logic gate 2357d has an activated value. An activation signal (ACT1) having a logic value (e.g., logic “1”) may be generated. On the other hand, when the control value (EC) indicates that an encryption operation and/or a decryption operation is performed (e.g., has a value of logic “1”), the combinational logic gate 2357d is connected to the clock signal CLK1. An activation signal (ACT1) (that is, having an inactivation value and an activation value alternately) may be generated.

Referring to FIG. 11B, the section controller 2357 may include transistors 2357e and 2357f. The transistor 2357e may transmit a value of logic “1” as the activation signal ACT1 in response to the inversion value (˜EC) of the control value (EC). The transistor 2357f may transmit the clock signal CLK1 as the activation signal ACT1 in response to the control value EC.

In the example of FIG. 11B, when the control value EC indicates that encryption and/or decryption operations are not performed (e.g., has a value of logic “0”), transistor 2357e is switched to an activation value (e.g., , an activation signal (ACT1) having logic “1”) can be transmitted. On the other hand, when the control value EC indicates that an encryption operation and/or a decryption operation is performed (e.g., has a value of logic “1”), the transistor 2357f is connected to the clock signal CLK1 (i.e. , an activation signal (ACT1) having a deactivation value and an activation value alternately may be transmitted.

When the section controller 2357 adopts the configuration shown in FIG. 11A or 11B, the section controller 2357 may generate the activation signal ACT1 described with reference to FIG. 10. In this case, while the encryption operation and/or decryption operation is not performed, the output from the logic gates may remain constant or change once in the operation period. Accordingly, power consumption due to switching of output values can be prevented or minimized.

12 and 13 are block diagrams showing example components included in the encryption/decryption circuit of FIG. 2.

Referring to FIG. 12 , in some embodiments, the encryption/decryption circuit 2350 may further include a section controller 2358. The encryption/decryption controller 2356 may output a control value (DC) and/or an inverted value (~DC) of the control value (DC). The control value (DC) may be related to the performance of the decryption operation. As an example, the control value DC may indicate whether a decryption operation is performed or not. As an example, the control value DC may be output from register 1356a in FIG. 2.

The section controller 2358 may receive a clock signal (CLK2). The section controller 2358 may receive a control value (DC) from the encryption/decryption controller 2356. In some cases, section controller 2358 may receive an inverse value (˜DC) of the control value (DC) along with or instead of the control value (DC).

The section controller 2358 may generate an activation signal ACT2 based on the control value DC (and/or the inverted value of the control value DC (˜DC)) and the clock signal CLK2. The decryption operator 2353 may operate based on the activation signal ACT2 instead of directly receiving the clock signal CLK2. As an example, the decryption operator 2353 may perform a decryption operation based on the activation signal ACT2.

Unlike the clock signal CLK2, the logic values of the activation signal ACT2 may not alternate while a decryption operation is not performed. Similar to those described with reference to FIGS. 8 and 10 , when the decryption operation is not performed, the control value DC may indicate that the decryption operation is not performed. While a decryption operation is not performed, the activation signal ACT2 may be maintained at one of an inactive value and an active value. To this end, the section controller 2358 may include a configuration similar to that shown in FIGS. 9A, 9B, 11A, or 11B.

While the decryption operation is not performed, the logic gates of the decryption operator 2353 may operate in a first time period (eg, an initialization period) in response to the deactivation value of the activation signal ACT2. Alternatively, while the decryption operation is not performed, the logic gates of the decryption operator 2353 may operate in a second time period (eg, operation period) in response to the activation value of the activation signal ACT2. Accordingly, outputs from logic gates included in the decryption operator 2353 may not change, and power consumption due to switching of output values may be prevented or minimized.

Referring to FIG. 13, in some embodiments, the encryption/decryption circuit 2350 may further include a section controller 2359. The encryption/decryption controller 2356 may output a control value (SC) and/or an inverted value (˜SC) of the control value (SC). The control value (SC) may be related to performing a substitution operation. By way of example, the control value (SC) may indicate whether a substitution operation is performed or not performed. As an example, control value SC may be output from register 1356a in FIG. 2.

The section controller 2359 may receive a clock signal (CLK3). The section controller 2359 may receive a control value (SC) from the encryption/decryption controller 2356. In some cases, section controller 2359 may receive an inverted value (˜SC) of the control value (SC) along with or instead of the control value (SC).

The section controller 2359 may generate an activation signal (ACT3) based on the control value (SC) (and/or the inverted value (˜SC) of the control value (SC)) and the clock signal (CLK3). The S-Box 2355 may operate based on the activation signal ACT3 instead of directly receiving the clock signal CLK3. As an example, the S-Box 2355 may perform a substitution operation based on the activation signal ACT3.

Unlike the clock signal CLK3, the logic values of the activation signal ACT3 may not alternate while a substitution operation is not performed. Similar to those described with reference to FIGS. 8 and 10 , when the substitution operation is not performed, the control value SC may indicate that the substitution operation is not performed. While a substitution operation is not performed, the activation signal ACT3 may be maintained at one of an inactive value and an active value. To this end, the section controller 2359 may include a configuration similar to that shown in FIGS. 9A, 9B, 11A, or 11B.

While the substitution operation is not performed, the logic gates of the S-Box 2355 may operate in a first time period (eg, an initialization period) in response to the deactivation value of the activation signal ACT3. Alternatively, while the substitution operation is not performed, the logic gates of the S-Box 2355 may operate in a second time period (eg, operation period) in response to the activation value of the activation signal ACT3. Accordingly, outputs from logic gates included in the S-Box 2355 may not change, and power consumption due to switching of output values may be prevented or minimized.

In some embodiments, some or all of the section controllers 2358 and 2359 may be included in the encryption/decryption controller 2356. In some other embodiments, some or all of the section controllers 2358 and 2359 may be provided external to the encryption/decryption circuit 2350. The exemplary configurations in FIGS. 12 and 13 are provided to aid better understanding and are not intended to limit the present invention. The configuration of the encryption/decryption circuit 2350 can be changed or modified in various ways.

FIG. 14 is a timing diagram illustrating time sections of an exemplary encryption/decryption operation performed in the encryption/decryption circuit of FIG. 2.

As described above, the encryption/decryption circuit 1350 may perform encryption and/or decryption operations in the operation section. Meanwhile, in the initialization section, the states of logic gates of the encryption/decryption circuit 1350 may be reset. Therefore, encryption and decryption operations may not be performed in the initialization section. For this reason, if the length of the initialization section becomes long, the length of the encryption section may become short, and thus the computational performance of the encryption/decryption circuit 1350 may deteriorate.

In some embodiments, the modified clock signal CCLK1 of FIG. 14 may replace the clock signal CLK1 of FIGS. 6 and 7. Comparing the changed clock signal (CCLK1) with the clock signal (CLK1), the length of the time interval in which the changed clock signal (CCLK1) has a value of logic "1" is the length of the time section in which the changed clock signal (CLK1) has a value of logic "1". It can be understood that it is longer than the length of the time interval. On the other hand, it can be understood that the length of the time section in which the changed clock signal CCLK1 has a value of logic “0” is shorter than the length of the time section in which the clock signal CLK1 has a value of logic “0”.

That is, the duty ratio or duty cycle of the changed clock signal CCLK1 may be different from the duty ratio or duty cycle of the clock signal CLK1. Due to the change or adjustment of the duty ratio, the length of the time interval (e.g., initialization interval) in which the changed clock signal (CCLK1) has the first logic value (e.g., logic “0”) is changed to the first logic value (e.g., logic “0”). 2 It may be shorter than the length of a time interval (eg, calculation interval) having a logic value (eg, logic “1”).

Therefore, when the changed clock signal CCLK1 is used instead of the clock signal CLK1, the length of the initialization section may be shortened and the length of the calculation section may be long. In this case, more encryption operations and/or decryption operations may be performed during a longer operation period. As a result, the computational performance of the encryption/decryption circuit 1350 can be improved. The clock signals CLK2 and CLK3 of FIGS. 2, 12, and 13 may also be replaced with the changed clock signal CCLK1.

The changed clock signal CCLK1 may be provided from a clock generator inside or outside the encryption/decryption circuit 1350. This clock generator can be redesigned to generate a modified clock signal CCLK1 with a different duty ratio or duty cycle than that of clock signal CLK1. In some embodiments, in order to adaptively control the computational performance of the encryption/decryption circuit 1350, the duty ratio or duty cycle of the changed clock signal CCLK1 may be programmable or adjustable. .

Meanwhile, in some embodiments, the changed clock signal CCLK1 can be implemented without redesigning the clock generator. These embodiments will be described with reference to FIGS. 15 to 19.

FIG. 15 is a block diagram showing an example configuration included in the encryption/decryption circuit of FIG. 2. In some embodiments, the encryption/decryption circuit 3350 may include an encryption operator 3352, an encryption/decryption controller 3356, and a clock controller 3357.

The configurations and operations of the encryption operator 3352 and the encryption/decryption controller 3356 may include the configurations and operations of the encryption operator 1352 and the encryption/decryption controller 1356 of FIG. 2, respectively. FIG. 15 only shows an exemplary configuration of the encryption/decryption circuit 3350, and the encryption/decryption circuit 3350 may further include components included in the encryption/decryption circuit 1350 of FIG. 2. For convenience of explanation, redundant descriptions regarding the encryption/decryption circuit 3350, encryption operator 3352, and encryption/decryption controller 3356 will be omitted below.

The clock controller 3357 may receive a first clock signal (eg, clock signal CLK1). The first clock signal may correspond to the clock signal CLK1 described with reference to FIGS. 6 and 7. The length of the time interval in which the clock signal CLK1 has a first logic value (e.g., logic “0”) is the length of the time interval in which the clock signal CLK1 has a second logic value (e.g., logic “1”) may be the same. Accordingly, the clock signal CLK1 can be understood as a general clock signal.

The clock controller 3357 may generate a second clock signal (eg, changed clock signal CCLK1) based on the first clock signal. The second clock signal may correspond to the changed clock signal CCLK1 described with reference to FIG. 14. In some embodiments, the modified clock signal CCLK1 may be generated from the clock signal CLK1 by the clock controller 3357 instead of being generated from a redesigned clock generator.

The changed clock signal (CCLK1) may be provided to the cryptographic operator 3352. The logic gates of the cryptographic operator 3352 may operate based on the changed clock signal CCLK1 instead of the clock signal CLK1. As shown in FIG. 14, in the changed clock signal CCLK1, the length of the calculation section may be longer than the length of the initialization section. Accordingly, the calculation performance of the encryption calculator 3352 can be improved.

In some embodiments, some or all of clock controller 3357 may be included in encryption/decryption controller 3356. In some other embodiments, some or all of clock controller 3357 may be provided external to encryption/decryption circuitry 3350. The exemplary configuration in FIG. 15 is provided to aid better understanding and is not intended to limit the invention. The configuration of the encryption/decryption circuit 3350 can be changed or modified in various ways.

In some embodiments, the encryption/decryption circuit 3350 may employ a clock controller 3357 in conjunction with the interval controller 2357 of FIG. 7. For example, the section controller 2357 may receive a changed clock signal (CCLK1) from the clock controller 3357 instead of the clock signal (CLK1). In this example, the interval controller 2357 generates an activation signal (ACT1) based on the control value (EC) (and/or the inverse value (˜EC) of the control value (EC)) and the changed clock signal (CCLK1). You can. This activation signal (ACT1) may have a constant value while the encryption and decryption operations are not performed, but may correspond to a changed clock signal (CCLK1) while the encryption and/or decryption operations are performed.

Figure 15 shows that the changed clock signal (CCLK1) is provided to the encryption operator 3352. In some embodiments, the decoding operator 1353 of FIG. 2 may receive a modified clock signal CCLK1 instead of the clock signal CLK2. Alternatively, the decoding operator 1353 may receive the changed clock signal CCLK1 and the activation signal ACT2 generated based on the control value DC of FIG. 12.

In some embodiments, the S-Box 1355 of FIG. 2 may receive a changed clock signal CCLK1 instead of the clock signal CLK3. Alternatively, the S-Box 1355 may receive the changed clock signal CCLK1 and the activation signal ACT3 generated based on the control value EC of FIG. 13. Embodiments of the present invention are not limited by the above descriptions, and may be variously changed or modified to employ an activation signal or a modified clock signal instead of a general clock signal.

FIG. 16 is a block diagram showing an exemplary configuration of the clock controller of FIG. 15. FIG. 17 is a timing diagram illustrating time intervals of an example encryption/decryption operation performed in the encryption/decryption circuit of FIG. 15 including the clock controller of FIG. 16.

Referring to FIG. 16, the clock controller 3357 may include a buffer 3357a and a combinational logic gate 3357b. The clock controller 3357 may receive a clock signal (CLK1). The buffer 3357a may delay the clock signal CLK1. Accordingly, the buffer 3357a can output the delayed clock signal dCLK1.

Figure 17 shows a clock signal (CLK1) and a delayed clock signal (dCLK1). The buffer 3357a may delay the clock signal CLK1 and output the delayed clock signal dCLK1. The length of the time section in which the delayed clock signal dCLK1 has a value of logic “0” may be equal to the length of the time section in which the clock signal CLK1 has a value of logic “0”. The length of the time section in which the delayed clock signal dCLK1 has a value of logic “1” may be equal to the length of the time section in which the clock signal CLK1 has a value of logic “1”.

Referring again to FIG. 16, the combinational logic gate 3357b may receive the clock signal CLK1 and the delayed clock signal dCLK1. The combinational logic gate 3357b may generate a changed clock signal CCLK1 based on the clock signal CLK1 and the delayed clock signal dCLK1. As an example, the combinational logic gate 3357b may perform a logical sum operation on the clock signal CLK1 and the delayed clock signal dCLK1.

Referring to FIG. 17 again, when both the clock signal CLK1 and the delayed clock signal dCLK1 have a value of logic “0”, the changed clock signal CCLK1 may have a value of logic “0”. On the other hand, when at least one of the clock signal CLK1 and the delayed clock signal dCLK1 has a value of logic “1”, the changed clock signal CCLK1 may have a value of logic “1”. Accordingly, the length of the initialization section in which the changed clock signal CCLK1 has a logic value of "0" may be shorter than the length of the calculation section in which the changed clock signal CCLK1 has a logic value of "1". This changed clock signal (CCLK1) can improve computational performance.

If the delay of the clock signal CLK1 is too long, the length of the initialization section of the changed clock signal CCLK1 may be longer than the length of the calculation section of the changed clock signal CCLK1. Meanwhile, if the delay of the clock signal CLK1 is too short, the logic values of the changed clock signal CCLK1 may not alternate. Accordingly, the buffer 3357a can appropriately delay the clock signal CLK1 so that the length of the initialization period of the changed clock signal CCLK1 is shorter than the length of the calculation period of the changed clock signal CCLK1. In some cases, the delay of buffer 3357a may be programmable or adjustable.

FIG. 18 is a block diagram showing an example configuration of the clock controller of FIG. 15. FIG. 19 is a timing diagram illustrating time intervals of an example encryption/decryption operation performed in the encryption/decryption circuit of FIG. 15 including the clock controller of FIG. 18.

Referring to FIG. 18, the clock controller 3357 may include a divider 3357c and a combination logic gate 3357d. The clock controller 3357 can receive a fast clock signal (fCLK1). The divider 3357c can divide the fast clock signal (fCLK1). Accordingly, the divider 3357c can output the clock signal CLK1. As an example, divider 3357c may include logic circuitry such as a counter register, shift register, etc.

Figure 19 shows a fast clock signal (fCLK1) and a clock signal (CLK1). The clock signal CLK1 may have a frequency used to perform encryption and/or decryption operations in the encryption/decryption circuit. Accordingly, the clock signal CLK1 can be understood as a general clock signal. The frequency of the fast clock signal (fCLK1) may be higher than the frequency of the clock signal (CLK1). 18 and 19, a clock generator that outputs a fast clock signal fCLK1 may be provided to generate the clock signal CLK1.

The divider 3357c may divide the fast clock signal (fCLK1) and output the divided clock signal (CLK1). The length of the time section in which the divided clock signal CLK1 has a value of logic “0” may be different from the length of the time section in which the fast clock signal fCLK1 has a value of logic “0”. The length of the time section in which the divided clock signal CLK1 has a value of logic “1” may be different from the length of the time section in which the fast clock signal fCLK1 has a value of logic “1”.

Referring again to FIG. 18, the combinational logic gate 3357d may receive a fast clock signal (fCLK1) and a divided clock signal (CLK1). The combinational logic gate 3357d may generate a changed clock signal CCLK1 based on the fast clock signal fCLK1 and the divided clock signal CLK1. As an example, the combinational logic gate 3357d may perform a logical sum operation on the fast clock signal fCLK1 and the divided clock signal CLK1.

Referring again to FIG. 19, when both the fast clock signal (fCLK1) and the divided clock signal (CLK1) have a value of logic “0”, the changed clock signal (CCLK1) may have a value of logic “0”. . On the other hand, when at least one of the fast clock signal fCLK1 and the divided clock signal CLK1 has a value of logic “1”, the changed clock signal CCLK1 may have a value of logic “1”. Accordingly, the length of the initialization section in which the changed clock signal CCLK1 has a logic value of "0" may be shorter than the length of the calculation section in which the changed clock signal CCLK1 has a logic value of "1". This changed clock signal (CCLK1) can improve computational performance.

FIG. 20 is a block diagram showing an example configuration included in the encryption/decryption circuit of FIG. 2. In some embodiments, the encryption/decryption circuit 4350 may include an encryption operator 4352, an encryption/decryption controller 4356, and an initialization controller 4357.

The configurations and operations of the encryption operator 4352 and the encryption/decryption controller 4356 may include the configurations and operations of the encryption operator 1352 and the encryption/decryption controller 1356 of FIG. 2, respectively. FIG. 20 only shows an example configuration of the encryption/decryption circuit 4350, and the encryption/decryption circuit 4350 may further include components included in the encryption/decryption circuit 1350 of FIG. 2. For convenience of explanation, redundant descriptions of the encryption/decryption circuit 4350, encryption operator 4352, and encryption/decryption controller 4356 will be omitted below.

The encryption/decryption controller 4356 may output a control value (IEN) and/or an inverted value (˜IEN) of the control value (IEN). The control value (IEN) may be related to the speed mode of the cryptographic operation. As an example, the control value IEN may indicate whether the encryption operation of the encryption operator 4352 is performed in a low-speed mode or a high-speed mode.

As described with reference to FIGS. 6 and 14 , when the time interval (e.g., initialization interval) in which the clock signal CLK1 has the first logic value (e.g., logic “0”) becomes long, the encryption operator 4352 )'s computational performance may deteriorate. If the initialization section is completely omitted, the computational performance of the encryption operator 4352 can be maximized.

The control value (IEN) can affect the occurrence and omission of the initialization section. As an example, if the control value (IEN) indicates that the encryption operation is performed in high-speed mode, the initialization section may be omitted and only the operation section may occur. Therefore, in high-speed mode, the computational performance of the encryption operator 4352 can be maximized. On the other hand, when the control value (IEN) indicates that the encryption operation is performed in a low-speed mode, the initialization section and the operation section may occur alternately.

The control value (IEN) may be provided by a user of computing device 1000 of FIG. 1 . Alternatively, depending on the policy of computing device 1000, the control value (IEN) may be provided from processor device 1100 and/or memory controller 1330 of FIG. 1. The control value (IEN) may have one of logical values indicating a low-speed mode and a high-speed mode, suitable for the performance requirements of encryption and/or decryption operations.

As an example, the control value (IEN) may be stored in register 1356a in FIG. 2. The encryption/decryption controller 4356 may manage the encryption operation of the encryption operator 4352 based on the control value (IEN) stored in the register 1356a, and the initialization controller 4357 may control the control value (IEN) from the register 1356a. IEN) can be received.

In some cases, the initialization controller 4357 may receive an inverted value (IEN) of the control value (IEN) along with or instead of the control value (IEN). Furthermore, the initialization controller 4357 may receive a clock signal (CLK1). The initialization controller 4357 may generate a controlled clock signal (TCLK1) based on the control value (IEN) (and/or the inverted value (˜IEN) of the control value (IEN)) and the clock signal (CLK1). there is.

The cryptographic operator 4352 may operate based on the controlled clock signal TCLK1 instead of directly receiving the clock signal CLK1. As an example, the encryption operator 4352 may perform an encryption operation based on the controlled clock signal TCLK1.

When the control value IEN indicates that the cryptographic operation is performed in low-speed mode, the controlled clock signal TCLK1 has a first logic value (e.g., logic “0”) and a second logic identical to the clock signal CLK1. It may have alternating values (e.g., logical “1”). Therefore, the initialization section and the calculation section may occur alternately.

On the other hand, when the control value IEN indicates that the encryption operation is performed in a high-speed mode, the value of the controlled clock signal TCLK1 may be maintained at the second logic value. Therefore, the encryption operator 4352 can continuously perform encryption operations in the operation section without an initialization section, and operation performance can be maximized. The controlled clock signal TCLK1 will be further explained with reference to FIG. 21.

In some embodiments, some or all of the initialization controller 4357 may be included in the encryption/decryption controller 4356. In some other embodiments, some or all of the initialization controller 4357 may be provided external to the encryption/decryption circuitry 4350. The exemplary configuration in FIG. 20 is provided to aid better understanding and is not intended to limit the invention. The configuration of the encryption/decryption circuit 4350 can be changed or modified in various ways.

In some embodiments, the encryption/decryption circuit 4350 may employ an initialization controller 4357 in conjunction with the section controller 2357 of FIG. 7 . For example, the section controller 2357 may receive the controlled clock signal TCLK1 from the initialization controller 4357 instead of the clock signal CLK1. In this example, interval controller 2357 generates an activation signal (ACT1) based on the control value (EC) (and/or the inversion of the control value (EC) (˜EC)) and the controlled clock signal (TCLK1). can do. This activation signal (ACT1) may have a constant value while the encryption and decryption operations are not performed, and may enable one of a low-speed mode and a high-speed mode while the encryption and/or decryption operations are performed.

In some embodiments, the encryption/decryption circuit 4350 may employ an initialization controller 4357 in conjunction with the clock controller 3357 of Figure 15. For example, the clock controller 3357 may receive the controlled clock signal TCLK1 from the initialization controller 4357 instead of the clock signal CLK1. In this example, controlled clock signal TCLK1 can enable either a low-speed mode or a high-speed mode. Furthermore, in the low-speed mode, the length of the initialization period in which the controlled clock signal TCLK1 has a first logic value (e.g., logic “0”) is the length of the initialization period in which the controlled clock signal TCLK1 has a second logic value (e.g., logic “0”). It may be shorter than the length of the calculation section with 1").

Figure 20 shows that the controlled clock signal TCLK1 is provided to the cryptographic operator 4352. In some embodiments, the decoding operator 1353 of FIG. 2 may receive the controlled clock signal TCLK1 instead of the clock signal CLK2. Alternatively, the decoding operator 1353 may receive the controlled clock signal TCLK1 and the activation signal ACT2 generated based on the control value DC of FIG. 12.

In some embodiments, the S-Box 1355 of FIG. 2 may receive the controlled clock signal TCLK1 instead of the clock signal CLK3. Alternatively, the S-Box 1355 may receive the controlled clock signal TCLK1 and the activation signal ACT3 generated based on the control value EC of FIG. 13. Embodiments of the present invention are not limited by the above descriptions, and may be variously changed or modified to employ an activation signal or a controlled clock signal instead of a general clock signal.

FIG. 21 is a timing diagram illustrating time sections of an example encryption/decryption operation performed in an encryption/decryption circuit including the initialization controller of FIG. 20.

As an example, a control value (IEN) having a first logical value (e.g., logic “0”) may indicate that the encryption operation and/or decryption operation are performed in a low-speed mode. As an example, a control value (IEN) having a second logical value (e.g., logic “1”) may indicate that the encryption operation and/or decryption operation are performed in a high-speed mode. However, the present invention is not limited to these examples, and the logic value corresponding to the low-speed mode and the logic value corresponding to the high-speed mode may be interchanged.

While the control value IEN has a logic value of “1”, the encryption/decryption circuit 4350 may perform encryption and/or decryption operations in a low-speed mode. In the low-speed mode, the controlled clock signal TCLK1 may alternately have a value of logic “0” and a value of logic “1”, corresponding to the clock signal CLK1. Accordingly, the logic gates of the encryption/decryption circuit 4350 may be reset in the initialization section and perform encryption and/or decryption operations in the operation section.

While the control value IEN has a value of logic “0”, the encryption/decryption circuit 4350 may perform encryption and/or decryption operations in a high-speed mode. In high-speed mode, the value of the controlled clock signal TCLK1 may be maintained at a logic “1” value. Therefore, the encryption/decryption circuit 4350 can continuously perform encryption operations in the calculation section without an initialization section. Therefore, in high-speed mode, computational performance can be maximized.

FIGS. 22A and 22B are block diagrams showing example configurations of the initialization controller of FIG. 20 in relation to the timing diagram of FIG. 21.

Referring to FIG. 22A, the initialization controller 4357 may include a combinational logic gate 4357a. The combination logic gate 4357a may generate the controlled clock signal TCLK1 by combining the clock signal CLK1 and the inverted value (˜IEN) of the control value IEN. As an example, the combinational logic gate 4357a may perform a logical sum operation on the clock signal CLK1 and the inverted value (~IEN) of the control value (IEN).

In the example of FIG. 22A , when control value IEN indicates a low speed mode (e.g., has a value of logic “1”), combinational logic gate 4357a operates on a controlled clock corresponding to clock signal CLK1. A signal (TCLK1) can be generated. On the other hand, when the control value (IEN) indicates a high-speed mode (e.g., has a value of logic “0”), the combinational logic gate 4357a generates a controlled clock signal (TCLK1) with a value of logic “1”. can be created.

Referring to FIG. 22B, the initialization controller 4357 may include transistors 4357b and 4357c. The transistor 4357b may transmit a value of logic “1” as the controlled clock signal TCLK1 in response to the inversion value (˜IEN) of the control value IEN. The transistor 4357c may transmit the clock signal CLK1 as the controlled clock signal TCLK1 in response to the control value IEN.

In the example of FIG. 22B, when the control value IEN indicates a low speed mode (e.g., has a value of logic “1”), transistor 4357b receives a controlled clock signal (CLK1) corresponding to the clock signal CLK1. TCLK1) can be transmitted. On the other hand, when the control value (IEN) indicates a high-speed mode (e.g., has a value of logic “0”), transistor 4357c generates a controlled clock signal (TCLK1) with a value of logic “1”. can do.

If the initialization controller 4357 employs the configuration shown in FIG. 22A or FIG. 22B, the initialization controller 4357 may generate the controlled clock signal TCLK1 described with reference to FIG. 21. In this case, in high-speed mode, the encryption/decryption circuit 4350 can continuously perform encryption operations in the operation section without an initialization section. Therefore, in high-speed mode, computational performance can be maximized.

FIG. 23 is a block diagram showing an example configuration included in the encryption/decryption circuit of FIG. 2. FIG. 24 is a block diagram showing an example configuration of the initialization randomizer of FIG. 23.

Referring to Figure 23, in some embodiments, the encryption/decryption circuit 5350 may include an encryption operator 5352, an encryption/decryption controller 5356, and an initialization randomizer 5357. Referring to Figure 24, in some embodiments, initialization randomizer 5357 may include a random value generator 5357a and a combinational logic gate 5357b.

The configurations and operations of the encryption operator 5352 and the encryption/decryption controller 5356 may include the configurations and operations of the encryption operator 1352 and the encryption/decryption controller 1356 of FIG. 2, respectively. 23 and 24 only show an example configuration of the encryption/decryption circuit 5350, and the encryption/decryption circuit 5350 may further include components included in the encryption/decryption circuit 1350 of FIG. 2. . For convenience of explanation, redundant descriptions of the encryption/decryption circuit 5350, encryption operator 5352, and encryption/decryption controller 5356 will be omitted below.

When the clock signal CLK1 regularly alternates between a first logic value (e.g., logic “0”) and a second logic value (e.g., logic “1”), an initialization period and an operation period occur. The timing can be predicted.

Meanwhile, when the initialization section is controlled to occur randomly or not, it may be difficult to predict when the initialization section occurs and when the calculation section occurs. This is because when the initialization section occurs randomly or does not occur, the operation section in which the encryption operation and/or decryption operation is performed may be randomly variable.

Therefore, if the initialization section occurs randomly or does not occur, it may be difficult for an attacker to align the timing at which the encryption and/or decryption operation that the attacker wishes to attack begins. As a result, side-channel analysis attacks can become difficult and the security level can be improved.

Referring to FIG. 23, the initialization randomizer 5357 may receive a clock signal (CLK1). The clock signal CLK1 may be a general clock signal that regularly alternates between a first logic value (eg, logic “0”) and a second logic value (eg, logic “1”).

The initialization randomizer 5357 may generate a randomized clock signal RCLK1 based on the clock signal CLK1. The randomized clock signal RCLK1 may or may not randomly have a value of logic “0” instead of regularly alternating between logic “0” and logic “1” values.

Referring to FIG. 24, the random value generator 5357a can randomly generate a value of logic “0” and a value of logic “1”. The random value generator 5357a may operate by employing one or more of various randomization algorithms and simulation techniques. Since randomization algorithms and simulation techniques can be well understood by a person skilled in the art, a detailed description of how to randomly generate a value of logic "0" and a value of logic "1" based on a seed value These will be omitted below.

The combinational logic gate 5357b can receive a random value and a clock signal (CLK1). The random value may be provided from random value generator 5357a. The random value may randomly have one of a value of logical “0” and a value of logical “1”.

The combinational logic gate 5357b may generate a randomized clock signal RCLK1 based on the random value and the clock signal CLK1. To this end, the combinational logic gate 5357b can perform logic operations on random values and the clock signal CLK1. As an example, combinational logic gate 5357b may perform a logical sum operation on a random value and a clock signal CLK1, thereby generating a randomized clock signal RCLK1.

Referring to FIG. 23, the encryption operator 5352 may operate based on the randomized clock signal RCLK1 instead of directly receiving the clock signal CLK1. As an example, the encryption operator 5352 may perform an encryption operation based on the randomized clock signal RCLK1.

As an example, when the random value generator 5357a generates a random value with a value of logic “0”, the randomized clock signal RCLK1 corresponds to the clock signal CLK1 with a value of logic “0” and It can alternately have the value of logical “1”. Therefore, the initialization section and the calculation section may occur alternately.

On the other hand, when the random value generator 5357a generates a random value with a value of logic “1”, the randomized clock signal RCLK1 will have a value of logic “1” regardless of the clock signal CLK1. You can. Therefore, the initialization section may not occur, and only the calculation section may occur.

In this way, if the random value randomly has a value of logic “0” and a value of logic “1”, the initialization interval may or may not occur randomly. If the occurrence of the initialization section is randomized, it may be difficult to identify the point in time when the encryption operation and/or decryption operation begins. Therefore, the security level can be improved. To increase the level of randomization of the random values, the seed value used to generate the random values can be programmable or variable.

In some embodiments, some or all of the initialization randomizer 5357 may be included in the encryption/decryption controller 5356. In some other embodiments, some or all of the initialization randomizer 5357 may be provided external to the encryption/decryption circuitry 5350. The initialization randomizer 5357 may include various configurations to combine clock signals and random values. The exemplary configurations of FIGS. 23 and 24 are provided to aid better understanding and are not intended to limit the present invention. The configuration of the encryption/decryption circuit 5350 can be changed or modified in various ways.

In some embodiments, the encryption/decryption circuit 5350 may employ an initialization randomizer 5357 along with the interval controller 2357 of FIG. 7. For example, the section controller 2357 may receive a randomized clock signal RCLK1 from the initialization randomizer 5357 instead of the clock signal CLK1. In this example, section controller 2357 generates an activation signal (ACT1) based on the control value (EC) (and/or the inversion of the control value (EC) (˜EC)) and the randomized clock signal (RCLK1). can be created.

In some embodiments, the encryption/decryption circuit 5350 may employ an initialization randomizer 5357 in conjunction with the clock controller 3357 of Figure 15. In some embodiments, the encryption/decryption circuit 5350 may employ an initialization randomizer 5357 in conjunction with the initialization controller 4357 of FIG. 20. As an example, each of the clock controller 3357 and the initialization controller 4357 may receive a randomized clock signal (RCLK1) from the initialization randomizer 5357 instead of the clock signal (CLK1).

Figure 23 shows that the randomized clock signal (RCLK1) is provided to the cryptographic operator 5352. In some embodiments, the decoding operator 1353 of FIG. 2 may receive a randomized clock signal RCLK1 instead of the clock signal CLK2. Alternatively, the decoding operator 1353 may receive the activated signal ACT2 generated based on the randomized clock signal RCLK1 and the control value DC of FIG. 12.

In some embodiments, the S-Box 1355 of FIG. 2 may receive a randomized clock signal RCLK1 instead of the clock signal CLK3. Alternatively, the S-Box 1355 may receive an activation signal (ACT3) generated based on the randomized clock signal (RCLK1) and the control value (EC) of FIG. 13. Embodiments of the present invention are not limited by the above descriptions, and may be variously changed or modified to employ an activation signal or a randomized clock signal instead of a general clock signal.

The contents described above are specific examples for implementing the technical idea of the present invention. The technical idea of the present invention will include not only the embodiments described above, but also embodiments that can be obtained by simply changing the design or easily changing the design. In addition, the technical idea of the present invention will include technologies that can be easily modified and implemented in the future based on the embodiments described above.

1000: computing device 1700: bus
2350, 3350, 4350, 5350: Encryption/decryption circuit

Claims (20)

An encryption operator including a plurality of logic gates that perform encryption or decryption of input data; and
A controller that controls the encryption operator based on a control value indicating whether the encryption or decryption of the input data is performed,
The controller is,
Based on a clock signal having a first logical value, controlling the encryption operator to operate in a first mode,
Based on the clock signal having a second logic value, controlling the encryption operator to operate in a second mode,
Based on the control value indicating that the encryption or decryption of the input data is not performed, the outputs from the plurality of logic gates are not changed and the amount of power consumed by the plurality of logic gates is not changed. Controlling the cryptographic operator to operate in the first mode without alternating based on the clock signal so that this is maintained constant,
In the first mode, each of the plurality of logic gates outputs the first logic value,
In the second mode, the number of first logic gates, each of which outputs the first logic value, among the plurality of logic gates, and the number of first logic gates, each of which outputs the second logic value, among the plurality of logic gates 2 An electronic circuit in which the number of logic gates is kept constant. The method of claim 1, wherein the controller:
An electronic circuit that controls the encryption operator to operate alternately in the first mode and the second mode when the control value indicates that the encryption or decryption of the input data is performed. delete According to claim 1,
The controller is an electronic circuit including a register that stores the control value in response to a request from an external device. According to claim 1,
An electronic circuit further comprising a buffer for storing data on which the encryption or decryption is to be performed. The method of claim 5, wherein the controller:
If the input data stored in the buffer does not have the operation unit size of the encryption or decryption, the control value is set to indicate that the encryption or decryption is not performed,
An electronic circuit that sets the control value to indicate that the encryption or decryption is performed when the input data stored in the buffer has the operation unit size. According to claim 1,
The controller is an electronic circuit that manages a round value related to the number of repetitions of the encryption or decryption. The method of claim 7, wherein the controller:
If the round value corresponds to 0, set the control value to indicate that the encryption or decryption of the input data is not performed,
If the round value does not correspond to 0, the control value is set to indicate that the encryption or decryption of the input data is performed. An encryption operator including a plurality of logic gates that perform encryption or decryption of input data;
an encryption controller outputting a control value indicating whether the encryption or decryption of the input data is performed by the encryption operator; and
Based on the control value indicating that the encryption or decryption of the input data is not performed, outputting an activation signal with a deactivation value without alternating based on a clock signal,
wherein the control value indicates that the encryption or decryption of the input data is performed, and based on the clock signal having the deactivation value, outputting the activation signal with the deactivation value;
The control value indicates that the encryption or decryption of the input data is performed, and based on the clock signal having an activation value, a section controller outputs the activation signal having the activation value,
The encryption operator is,
operating in a first mode based on the activation signal having the deactivation value;
Based on the activation signal having the activation value, operating in a second mode,
In the first mode, each of the plurality of logic gates sets the deactivation value so that outputs from the plurality of logic gates do not change and the amount of power consumed by the plurality of logic gates remains constant. Print it out,
In the second mode, the number of first logic gates, each of which outputs the deactivation value, among the plurality of logic gates, and the number of second logic gates, each of which outputs the activation value, among the plurality of logic gates An electronic circuit whose number remains constant. delete The method of claim 9, wherein the section controller:
comprising a combinational logic gate,
An electronic circuit that generates the activation signal by combining the control value and the clock signal. delete delete delete delete data input/output devices;
an encryption/decryption circuit including an encryption operator including a plurality of logic gates that perform encryption or decryption of input data for the data input/output device; and
Based on a control value indicating that the encryption or decryption of the input data is not performed, output an activation signal having an activation value without alternation based on a clock signal,
wherein the control value indicates that the encryption or decryption of the input data is performed, and based on the clock signal having a deactivation value, outputting the activation signal with the deactivation value;
The control value indicates that the encryption or decryption of the input data is performed, and based on the clock signal having the activation value, a section controller outputs the activation signal having the activation value,
The encryption operator is,
Operating in a first mode such that, based on the activation signal having the deactivation value, outputs from the plurality of logic gates do not change and the amount of power consumed by the plurality of logic gates remains constant. do,
Based on the activation signal having the activation value, operating in a second mode,
In the first mode, each of the plurality of logic gates outputs the deactivation value,
In the second mode, the number of first logic gates, each of which outputs the deactivation value, among the plurality of logic gates, and the number of second logic gates, each of which outputs the activation value, among the plurality of logic gates Electronic devices whose number remains constant. delete According to claim 16,
The length of the time section in which the clock signal has the deactivation value is shorter than the length of the time section in which the clock signal has the activation value. According to claim 16,
The control value further indicates whether the encryption or decryption of the input data is performed in low-speed mode or high-speed mode,
The electronic device further includes an initialization controller,
The initialization controller is,
When the control value indicates that the encryption or decryption of the input data is performed in the slow mode, generate the clock signal to alternately have the deactivation value and the activation value, and
An electronic device that generates the clock signal to maintain the activation value when the control value indicates that the encryption or decryption of the input data is performed in the high-speed mode. According to claim 16,
An initialization randomizer ( An electronic device further comprising a randomizer.

Images