KR20170134946A - Electronic circuit performing encryption/ decryption operation to prevent side-channel analysis attack, and electronic device including the same - Google Patents

Abstract

The present invention relates to an electronic circuit which comprises an encryption operator, and a controller. The encryption operator performs encryption and decryption operations using a plurality of logic gates. The controller controls an operation of the encryption operator to allow each of the logic gates to output a first logic value during a first time period, and to allow the number of logic gates outputting the first logic value during a second time period and the number of logic gates outputting a second logic value to be constantly maintained on the basis of a control value related to the encryption and decryption operations, and a clock signal. When the control value indicates that the encryption and decryption operations are not performed, the logic gates are operated in one of the first and second time periods. According to the present invention, the amount of power consumed by an encryption and decryption circuit is reduced, and operation performance and a security level of the encryption and decryption circuit are improved.

Description

TECHNICAL FIELD [0001] The present invention relates to an electronic circuit for performing an encryption / decryption operation for preventing a subchannel analysis attack, and an electronic device including the electronic circuit. [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to electronic circuits and electronic devices, and more particularly to electronic circuit and electronic device configurations and operations that perform Encryption / Decryption operations.

Various types of electronic devices have been used in recent years. The electronic device performs its functions according to the operations of the one or more electronic circuits included therein. The operation of the electronic circuit is performed as the electronic form of data is input to or output from the electronic circuit.

The input or output data may be exposed to an entity outside the electronic device. As an example, an attacker (e.g., a hacker) with respect to an electronic device may manipulate data input to the electronic device to obtain control of the electronic device. By way of example, an attacker may manipulate data output from an electronic device to arbitrarily change data or impair the security attributes of the data. In these instances, the security levels and reliability of the electronic device and the electronic circuit can be significantly degraded.

For this reason, the electronic device may include encryption / decryption circuitry for encrypting the input or output data and for decrypting the encrypted data. The encryption / decryption circuit can encrypt / decrypt data according to an encryption / decryption algorithm using a key. If the key is not known, it can be difficult for the attacker to determine the key based solely on the input / output data, and thus it may be difficult for the attacker to determine the original version of the encrypted data. Therefore, encryption / decryption operations can improve the security level and reliability of electronic devices and electronic circuits.

However, some encryption / decryption circuits may still be attacked by attackers. The attacker may conduct a "Side-channel Analysis Attack" instead of directly manipulating input or output data. In a subchannel analysis attack, an attacker can collect incidental information such as the amount of power consumed by the encryption / decryption circuit, the waveform of the electromagnetic wave generated by the encryption / decryption circuit, and the like. The attacker may attack the encryption / decryption circuit to determine the key used in the encryption / decryption circuit based on the collected information.

Embodiments of the present invention may provide configurations and operations of electronic circuitry and electronic devices that perform cryptographic computation and / or decryption operations to prevent subchannel analysis attacks. The electronic circuit and the electronic device according to the embodiments of the present invention may adaptively use a clock signal necessary for performing cryptographic operation and / or decryption operation.

An electronic circuit according to an embodiment of the present invention may include an encryption calculator and a controller. The encryption operator may perform at least one of encryption and decryption operations using a plurality of logic gates. Wherein the controller is configured to output a first logic value for each of the plurality of logic gates during a first time interval and a plurality of logic gates for a second time interval during a second time interval based on a control value associated with performing at least one of encryption and decryption operations and a clock signal, The operation of the encryption calculator can be controlled such that the number of logic gates outputting the first logic value and the number of logic gates outputting the second logic value in the logic gates are kept constant. If the control value indicates that at least one of the encryption and decryption operations is not performed, the plurality of logic gates may operate in one of the first time interval and the second time interval under the control of the controller.

The electronic circuit according to the embodiment of the present invention may include an encryption calculator, an encryption controller, and a section controller. The encryption operator may include a plurality of logic gates. The encryption controller can output a control value associated with the execution of at least one of encryption and decryption operations by the encryption operator. The interval controller can generate an activation signal based on the control value and the clock signal. During the first time interval, each of the plurality of logic gates may output a first logic value in response to an inactivation value of the activation signal. During the second time interval, the number of logic gates outputting the first logic value among the plurality of logic gates and the number of logic gates outputting the second logic value may remain constant in response to the activation value of the activation signal.

An electronic device according to an embodiment of the present invention may include a data input / output device, an encryption / decryption circuit, and an interval controller. The encryption / decryption circuit may perform encryption and decryption operations for the data input / output device. The interval controller may generate an activation signal based on a clock signal and a control value indicating whether encryption and decryption operations are performed. When the control value indicates that the encryption and decryption operations are not performed, in response to the activation signal having one of the deactivation value and the activation value, the outputs from the encryption / decryption circuit are not changed and consumed by the encryption / decryption circuit The amount of power can be kept constant.

An electronic circuit according to an embodiment of the present invention may include an encryption calculator and a controller. The encryption operator may include a plurality of logic gates that operate based on the clock signal. The controller is responsive to the first logic value of the clock signal to cause the output values from the plurality of logic gates to be unchanged and in response to the second logic value of the clock signal, The number of logic gates and the number of logic gates outputting the second logic value are held constant. The length of the first time interval in which the clock signal has the first logic value may be shorter than the length of the second time interval in which the clock signal has the second logic value.

An electronic circuit according to an embodiment of the present invention may include a clock controller and an encryption calculator. The clock controller may generate a second clock signal based on the first clock signal. The encryption operator may include a plurality of logic gates that operate based on the second clock signal. The length of the first time interval in which the first clock signal has the first logic value may be equal to the length of the second time interval in which the first clock signal has the second logic value. The length of the third time interval in which the second clock signal has the first logic value may be shorter than the length of the fourth time interval in which the second clock signal has the second logic value. In response to the first logic value of the second clock signal, the output values from the plurality of logic gates may not change. In response to the second logic value of the second clock signal, the number of logic gates outputting the first logic value and the number of logic gates outputting the second logic value among the plurality of logic gates may be maintained constant.

An electronic device according to an embodiment of the present invention may include a data input / output device, a clock controller, and an encryption / decryption circuit. The clock controller can generate a clock signal. The encryption / decryption circuit may perform encryption and decryption operations for the data input / output device based on the clock signal. The length of the first time interval in which the clock signal has the first logic value may be shorter than the length of the second time interval in which the clock signal has the second logic value. In response to the first logical value of the clock signal, the output values from the encryption / decryption circuit may not change. In response to the second logical value of the clock signal, the amount of power consumed by the encryption / decryption circuit can be kept constant.

According to embodiments of the present invention, the amount of power consumed by the encryption / decryption circuit can be reduced. Furthermore, the operation performance and security level of the encryption / decryption circuit can be improved.

1 is a block diagram illustrating a computing device including electronic devices employing encryption / decryption circuits in accordance with embodiments of the present invention.
2 is a block diagram illustrating an exemplary configuration of the encryption / decryption circuit of FIG.
3 is a flow chart illustrating an exemplary encryption operation performed in the encryption / decryption circuit of FIG. 2;
4 is a block diagram illustrating an exemplary logic circuit included in the encryption / decryption circuit of FIG.
5 is a table for explaining the operation of the logic circuit of FIG.
FIG. 6 is a timing diagram illustrating time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit of FIG. 2. FIG.
7 is a block diagram showing an exemplary configuration included in the encryption / decryption circuit of FIG.
FIG. 8 is a timing diagram for explaining time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit including the interval controller of FIG. 7. FIG.
Figs. 9A and 9B are block diagrams showing exemplary configurations of the section controller of Fig. 7 with respect to the timing diagram of Fig.
FIG. 10 is a timing diagram for explaining time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit including the interval controller of FIG. 7. FIG.
Figs. 11A and 11B are block diagrams showing exemplary configurations of the section controller of Fig. 7 with respect to the timing diagram of Fig.
12 is a block diagram showing an exemplary configuration included in the encryption / decryption circuit of FIG.
FIG. 13 is a block diagram showing an exemplary configuration included in the encryption / decryption circuit of FIG. 2; FIG.
FIG. 14 is a timing diagram for explaining time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit of FIG. 2; FIG.
15 is a block diagram showing an exemplary configuration included in the encryption / decryption circuit of FIG.
16 is a block diagram illustrating an exemplary configuration of the clock controller of FIG.
FIG. 17 is a timing diagram illustrating time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit of FIG. 15 including the clock controller of FIG. 16;
18 is a block diagram illustrating an exemplary configuration of the clock controller of FIG.
19 is a timing diagram for illustrating time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit of FIG. 15 including the clock controller of FIG. 18;
Fig. 20 is a block diagram showing an exemplary configuration included in the encryption / decryption circuit of Fig. 2; Fig.
FIG. 21 is a timing diagram for explaining time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit including the initialization controller of FIG. 20; FIG.
FIGS. 22A and 22B are block diagrams showing exemplary configurations of the initialization controller of FIG. 20 with respect to the timing diagram of FIG.
23 is a block diagram showing an exemplary configuration included in the encryption / decryption circuit of Fig.
FIG. 24 is a block diagram showing an exemplary configuration of the initialization randomizer of FIG. 23. FIG.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the present embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. Will be explained.

1 is a block diagram illustrating a computing device that includes electronic devices employing Encryption / Decryption circuits in accordance with embodiments of the present invention. In some embodiments, computing device 1000 includes a processor device 1100, a working memory 1200, a storage device 1300, a communication block 1400, a user interface 1500, 1600, and a bus (Bus) 1700.

For example, the computing device 1000 may be a desktop computer, a laptop computer, a tablet computer, a workstation, a server, a digital television, a video game console, Phone, a wearable device, and the like, but the present invention is not limited to this example.

The processor device 1100 may control overall operations of the computing device 1000. The processor device 1100 may be configured to process various types of arithmetic and / or logic operations. To this end, the processor device 1100 may be implemented as a special-purpose logic circuit (e.g., a Field Programmable Gate Array (FPGA), Application Specific Integrated Circuits (ASICs), etc.) including one or more processor cores 1110 Can be implemented. By way of example, processor device 1100 may include a general-purpose processor, a dedicated processor, and / or an application processor.

By way of example, processor device 1100 may execute instruction sets of a program code using processor cores 1110. [ The one or more caches 1130 may temporarily store data that is generated by execution of the instruction set or data to be used to execute the instruction set.

The working memory 1200 may temporarily store data used in the operation of the computing device 1000. By way of example, working memory 1200 may store data to be processed or processed by processor device 1100 in one or more memories 1210. By way of example, the memories 1210 may include volatile memory such as Static Random Access Memory (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), and the like. The memory controller 1230 may control the memories 1210 to store the data or output the stored data.

The storage device 1300 can store data regardless of the power supply. The storage device 1300 may store system data used to operate the computing device 1000 and / or user data for a user of the computing device 1000 in one or more non-volatile memories 1310. For example, non-volatile memories 1310 may be implemented as non-volatile memories such as Flash memory, Phase-change RAM (PRAM), Magneto-resistive RAM (MRAM), Resistive RAM (REAM), Ferro- And < / RTI > memories. Memory controller 1330 may control non-volatile memories 1310 to store data or output stored data to non-volatile memories 1310. As an example, storage device 1300 may be a solid state drive (SSD) , A hard disk drive (HDD), a secure digital (SD) card, a multimedia card (MMC), and the like.

Communication block 1400 may communicate with an external device / system of computing device 1000 under the control of processor device 1100. By way of example, communication block 1400 may include at least one of a variety of wireline communication protocols such as Ethernet, Transfer Control Protocol / Internet Protocol (TCP / IP), Universal Serial Bus (USB) Term Evolution), WiMax (Global Interoperability for Microwave Access), GSM (Global System for Mobile communications), CDMA (Code Division Multiple Access), Bluetooth, Near Field Communication (NFC), Wireless Fidelity And / or the like, in accordance with at least one of the various wireless communication protocols.

The user interface 1500 may mediate communication between the user and the computing device 1000 under the control of the processor device 1100. For example, the user interface 1500 may process input from a keyboard, a mouse, a keypad, a button, a touch panel, a touch screen, a touch pad, a touch ball, a camera, a microphone, a gyroscope sensor, Further, the user interface 1500 can process output to a display device, a speaker, a motor, and the like.

In addition, the computing device 1000 may further include other devices 1600. [ By way of example, other devices 1600 may include various peripherals such as an image sensor, a graphics processing unit, a sound processor, a Global Positioning System (GPS) device, and the like.

Each of the processor device 1100, the working memory 1200, the storage device 1300, the communication block 1400, the user interface 1500, and other devices 1600 may be implemented as a chip level and / And may be mounted to the computing device 1100. Alternatively, each of the processor device 1100, the working memory 1200, the storage device 1300, the communication block 1400, the user interface 1500, and other devices 1600 may be implemented as independent electronic devices, May be assembled within the computing device 1100. The mounted or assembled components may be connected to each other via a bus 1700. [

The bus 1700 may provide a communication path between the components of the computing device 1000. The components of the computing device 1000 may exchange data with each other based on the bus format of the bus 1700. [ By way of example, the bus format may be one or more of the following: Peripheral Component Interconnect Express (PCIe), Nonvolatile Memory Express (NVMe), Small Computer System Interface (SCSI), Advanced Technology Attachment (ATA), Serial ATA, Parallel ATA, SAS Serial Attached SCSI), Universal Flash Storage (UFS), and the like.

Depending on the operation of the computing device 1000, data may be input to or output from the components of the computing device 1000. Each of the components of computing device 1000 may be referred to as a data input / output device.

The input or output data may be exposed to entities external to the computing device 1000. As an example, an attacker (e. G., A hacker) to the computing device 1000 may manipulate data input to the processor device 1100 to gain control of the processor device 1100 and the computing device 1000 Can be obtained. By way of example, an attacker may gain control of the processor device 1100 to halt the operation of the computing device 1000 or maliciously operate the computing device 1000.

By way of example, an attacker may manipulate data stored in working memory 1200 and / or storage device 1300 to arbitrarily alter data or impair security attributes of data. For example, an attacker may insert a malicious code into the data stored in the working memory 1200 or may crack the access password or DRM (Digital Right Management) attribute of the data stored in the storage device 1300 . In these instances, the security levels and reliability of the computing device 1000 and its components can be significantly degraded.

For this reason, the components of the computing device 1000 may include encryption / decryption circuitry for encrypting the input or output data and for decrypting the encrypted data. The encryption / decryption circuit may perform encryption and decryption operations for the data input / output device. In the encryption and decryption operations, the encryption / decryption circuit may encrypt / decrypt the data according to an encryption / decryption algorithm using a key. If the key is not known, it can be difficult for the attacker to determine the key based solely on the input / output data, and thus it may be difficult for the attacker to determine the original version of the encrypted data. Therefore, encryption and decryption operations can improve the security level and reliability of electronic devices and electronic circuits.

By way of example, processor device 1100 may use encryption / decryption circuitry 1150 to encrypt data output from processor cores 1110 and / or caches 1130. Further, the processor device 1100 may use the encryption / decryption circuit 1150 to decrypt the data to be input to the processor cores 1110 and / or the caches 1130. Understanding and analyzing data that is transformed by encryption and decryption operations can be difficult for an attacker. Thus, the control authority of the processor apparatus 1100 can be protected.

As an example, working memory 1200 may use encryption / decryption circuitry 1250 to encrypt data to be stored in memories 1210. Further, the working memory 1200 can decrypt the data output from the memories 1210 by using the encryption / decryption circuit 1250. Similarly, the storage device 1300 can encrypt the data to be stored in the non-volatile memories 1310 using the encryption / decryption circuit 1350. Further, the storage device 1300 can decrypt the data output from the non-volatile memories 1310 by using the encryption / decryption circuit 1350. Thus, arbitrarily changing or corrupting data stored in memories 1210 and / or non-volatile memories 1310 can be difficult for an attacker, and stored data can be safely protected.

1 shows that the encryption / decryption circuits 1150, 1250 and 1350 are included in the data input / output devices 1100, 1200 and 1300. However, in some cases, the encryption / decryption circuits 1150, 1250, 1350 may be implemented separately from the data input / output devices 1100, 1200, 1300. Further, some devices (e.g., 1400, 1500, 1600, etc.) and bus 1700 other than the data input / output devices 1100, 1200, and 1300 may also employ encryption / decryption circuits. The encryption / decryption circuit can be employed anywhere that data is on the path of input or output. FIG. 1 is provided for better understanding and is not intended to limit the present invention.

Hereinafter, exemplary configurations and operations of the encryption / decryption circuit 1350 will be described with reference to Figs. 2 to 24. Fig. However, the encryption / decryption circuits 1150 and 1250 and other unencrypted encryption / decryption circuits may also be constructed and operated in accordance with the following embodiments. The following examples are provided for better understanding and are not intended to limit the present invention.

2 is a block diagram illustrating an exemplary configuration of the encryption / decryption circuit of FIG. 1 and 2, the encryption / decryption circuit 1350 may be connected to the non-volatile memories 1310 and the memory controller 1330 in the storage device 1300. [ Decryption circuitry 1350 for non-volatile memories 1310 is described in this specification, the encryption / decryption circuitry 1350 may be implemented as volatile memory (e.g., buffer memory, cache memory, etc.) ).

In some embodiments, the encryption / decryption circuit 1350 includes a buffer 1351, an encryption operator 1352, a decryption operator 1353, a key manager 1354, an S-Box (Substitution-Box) 1355, And a decryption controller 1356. However, in some other embodiments, the encryption / decryption circuit 1350 may not include some of the components shown in FIG. 2, or may further include components not shown in FIG.

The buffer 1351 may temporarily store (e.g., buffer) data provided from the non-volatile memories 1310 and the memory controller 1330. [ The data buffered in the buffer 1351 may be provided to the encryption operator 1352 or the decryption operator 1353. [ That is, the buffer 1351 may store data to be subjected to the encryption operation and / or the decryption operation.

Encryption operator 1352 may perform an encryption operation on data to be stored in non-volatile memories 1310. [ Thus, the security level of the data stored in the non-volatile memories 1310 can be improved. The decryption operator 1353 can perform a decryption operation on the data read from the non-volatile memories 1310. [ Accordingly, the memory controller 1330 can receive the decoded data.

Some encryption and decryption operations may be performed using a Key. By way of example, some encryption and decryption operations may be performed on a given data and on a given key by performing a combinational logic operation (e.g., a logical sum (Or) operation, a logical product (And) operation, an exclusive logical operation, etc.) And the like. The key may be unknown to the external entity and may be uniquely selected in the encryption / decryption circuit 1350. Thus, encryption and decryption operations can protect data from attackers.

Key manager 1354 may manage the keys used for encryption and decryption operations. The key manager 1354 may include a memory for storing a key, or may be accessed by a key stored in another memory.

As will be described with reference to FIG. 3, the encryption operation (and / or decryption operation) is not performed only once, but may be repeated many times to increase the security level. Performing a cryptographic operation (and / or decryption operation) once may be referred to as a "round ". The number of iterations of the encryption operations (and / or decryption operations) may be managed based on the "round value ". By way of example, the key may be selected differently for each round. As an example, the key selected for the first round may be different from the key selected for the second round.

The key manager 1354 can manage a plurality of keys. The key manager 1354 may schedule a key to be selected in each round among a plurality of keys. Key manager 1354 may provide the scheduled key to cryptographic operator 1352 and / or decryption operator 1353 in response to requests of cryptographic operator 1352 and / or decryption operator 1353.

The S-Box 1355 may perform a substitution operation. In a permutation operation, S-Box 1355 may convert an m-bit input to an n-bit output (where each of m and n is an integer equal to or greater than 1 and m may be equal to or different from n has exist). As an example, the replacement operation of S-Box 1355 may be performed based on a Look-up Table that includes a correspondence between m-bit inputs and n-bit outputs.

For example, instead of directly performing encryption and decryption operations on data received from the buffer 1351, the encryption operator 1352 and the decryption operator 1353 may encrypt (decrypt) the data substituted by the S- Operation and decoding operation can be performed. The S-Box 1355 can convert the data buffered in the buffer 1351 into other data for the cryptographic operation unit 1352 and the decryption operation unit 1353. Since the S-Box 1355 changes the data on which the encryption and decryption operations are to be performed, the security level of the data can be further improved.

In some cases, the S-Box 1355 may also perform a substitution operation on the key selected by the key manager 1354. If both the data and the key are changed, encryption and decryption operations can safeguard the data more securely.

Each of the encryption operation unit 1352, decryption operation unit 1353, and S-Box 1355 may include a plurality of logic gates. The encryption operation unit 1352, the decryption operation unit 1353, and the S-Box 1355 can perform encryption operation, decryption operation, and replacement operation using the logic gates, respectively.

The logic gates of the encryption operator 1352 may operate based on the clock signal CLK1 to perform an encryption operation. The logic gates of the decryption operator 1353 may operate based on the clock signal CLK2 to perform a decryption operation. The logic gates of the S-Box 1355 may operate based on the clock signal CLK3 to perform a permutation operation. Each of the clock signals CLK1, CLK2 and CLK3 has a rising edge and a falling edge to have a first logic value (e.g., logic "0") and a second logic value Edge "). ≪ / RTI >

As an example, each of the clock signals (CLK1, CLK2, CLK3) may be provided from a clock generator internal or external to the encryption / decryption circuit 1350. By way of example, storage device 1300 and / or computing device 1000 may include a clock generator (s) for generating clock signals CLK1, CLK2, CLK3. As an example, the clock signals (CLK1, CLK2, CLK3) may be provided from separate clock generators, or from one clock generator.

2 shows that the encryption operator 1352, the decryption operator 1353, and the S-Box 1355 receive the separate clock signals CLK1, CLK2 and CLK3, respectively. However, in some embodiments, some or all of the encryption operator 1352, decryption operator 1353, and S-Box 1355 may share the same clock signal.

When the encryption operator 1352 is implemented separately from the decryption operator 1353, the encryption operation and the decryption operation can be performed in parallel, so that the performance of the encryption / decryption circuit 1350 can be improved. On the other hand, in some cases, the encryption operator 1352 and the decryption operator 1353 can be implemented as a single module, and thus the area of the encryption / decryption circuit 1350 can be reduced. In some cases, the encryption / decryption circuit 1350 may include a plurality of encryption operators and / or a plurality of decryption operators to achieve higher performance.

As shown in FIG. 2, the S-Box 1355 may be implemented as an independent module. However, in some cases, S-Box 1355 may be included in cryptographic operator 1352, decryption operator 1353, and / or key manager 1354. The encryption operator 1352, the decryption operator 1353, and the key manager 1354 may share the S-Box 1355 or use separate S-Boxes.

The encryption / decryption controller 1356 may control the operations of the components of the encryption / decryption circuit 1350. As an example, the encryption / decryption controller 1356 may control the operations of the buffer 1351, the encryption computer 1352, the decryption computer 1353, and the key manager 1354.

As an example, the encryption / decryption controller 1356 can start the encryption operation of the encryption operation unit 1352 and / or the decryption operation of the decryption operation unit 1353 in response to the request (REQ). The request REQ may be provided from an external component of the encryption / decryption circuit 1350 (e.g., memory controller 1330, processor device 1100, etc.) or may be generated within the encryption / decryption circuit 1350.

The encryption / decryption controller 1356 may include a register (Register) 1356a. The register 1356a may store the control value. The control value may be associated with performing at least one of encryption and decryption operations. By way of example, the control value may indicate whether or not a cryptographic operation is performed, or may indicate an environment (e.g., speed, security level, mode of operation, etc.) of the cryptographic operation.

The control value may be stored in register 1356a in response to a request (REQ) or based on a determination of encryption / decryption controller 1356. [ As an example, if memory controller 1330 provides a request (REQ) to initiate a cryptographic operation to encryption / decryption controller 1356, register 1356a may store a control value indicating that the cryptographic operation is to be performed . By way of example, the encryption / decryption controller 1356 refers to the control value stored in the register 1356a to control the operations of the buffer 1351, the encryption computer 1352, and the key manager 1354 so that the encryption operation is performed .

Although a "register" has been described with reference to Fig. 2, the present invention is not limited to Fig. Encryption / decryption controller 1356 may employ other types of memory than registers to store control values. Further, as described above, the blocks shown in FIG. 2 are provided for better understanding, and are not intended to limit the present invention. In other embodiments, some blocks may be combined into blocks of larger units, and one block may be divided into a plurality of blocks.

3 is a flow chart illustrating an exemplary encryption operation performed in the encryption / decryption circuit of FIG. 2;

By way of example, FIG. 3 illustrates that the encryption / decryption circuit 1350 performs encryption operations in accordance with an Advanced Encryption Standard (AES) established by the National Institute of Standards and Technology (NIST). The encryption operation may be performed by the encryption operator 1352 mainly under the control of the encryption / decryption controller 1356. The register 1356a may store control values indicating the execution of the encryption operation and the environment.

In operation S110, the encryption operator 1352 may perform an "AddRoundKey" operation. The "AddRoundKey" operation is a bitwise combinational logic operation (e.g., a logical sum operation, a logical product operation, an exclusive logical sum operation, etc.) on the data from the buffer 1351 and the key from the key manager 1354 And the like. Thus, the data from the buffer 1351 can be converted to other data based on the selected key.

In operation S120, S-Box 1355 may perform a permutation operation on the transformed data in operation S110, in response to a request from cryptographic operator 1352. [ In operation S122, the encryption operator 1352 may perform a "ShiftRows" operation on the state of the replaced data in operation S120. In the "ShiftRows" operation, the rows of the data state can be cyclically shifted. In operation S124, the encryption operator 1352 may perform a "MixColumns" operation on the shifted data state in operation S122. In the "MixColumns" operation, the columns of the data state can be mixed.

Thereafter, in operation S126, the encryption operator 1352 may perform an "AddRoundKey" operation on the transformed data having a mixed state in operation S124. The encryption operator 1352 may perform a combinational logic operation on a bit basis for the converted data and the key from the key manager 1354. [ In some embodiments, the encryption operator 1352 may omit the S126 operation and perform the S130 operation according to the settings.

According to operations S120 to S126, the data from the buffer 1351 may be converted to have different values from the original values. Therefore, an attacker may have difficulty in intentionally attacking the data, and the security level may be improved. Operations S120 to S126 may constitute one round. Key manager 1354 may select different keys for each round for the "AddRoundKey" operation of operation S126.

In operation S130, the encryption / decryption controller 1356 may determine whether the next round is the last round. The encryption / decryption controller 1356 can manage the round value, and can increase the round value by 1 each time one round is performed. For example, rounds may be repeated 10 times, 12 times, or 14 times depending on the size of the data (although the invention is not so limited), the encryption / decryption controller 1356 may determine, based on the round value, It can be determined whether or not the last round is the last round. By way of example, the round value may be stored in register 1356a as part of the control value.

If the next round is not the last round, the S120 operation may be performed again. In operation S120, S-Box 1355 may perform a permutation operation on the transformed data in operation S126 in response to a request from cryptographic operator 1352. [ On the other hand, if the next round is the last round, operation S140 may be performed.

In operation S140, S-Box 1355 may perform a permutation operation on the transformed data in operation S126 in response to a request from cryptographic operator 1352. [ In operation S142, the encryption operator 1352 may perform a "ShiftRows" operation on the state of the replaced data in operation S140. In operation S144, encryption operator 1352 may perform an "AddRoundKey" operation on the transformed data having the shifted state in operation S142. As an example, after the last round is completed, the round value may be initialized (e.g., to zero).

As the round is repeated, the value of the data can be gradually transformed. After the last round of operations S140 through S144 is completed, the finally converted data may be stored in the non-volatile memories 1310. [ Thus, it can be very difficult for the attacker to arbitrarily manipulate or damage the encrypted data of the non-volatile memories 1310. [

As an example, the encryption operation of FIG. 3 may be initiated in response to a request (REQ) from an external device or based on a determination of the encryption / decryption controller 1356. In some embodiments, the memory controller 1330 may provide a request (REQ) to the encryption / decryption controller 1356 to store the encrypted data in the non-volatile memories 1310. The encryption / decryption controller 1356 may control the encryption operator 1352 to perform the encryption operation in response to the request (REQ). The register 1356a may store a control value indicating, in response to the request (REQ), that the encryption operation is performed.

The encryption operation may be performed on data having an operation unit size. As an example, the operation unit size for the "MixColumns" operation may be 32 bits and the "MixColumns" operation may be performed on 32 bits of data. As an example, the operation unit size for the "ShiftRows" operation may be 128 bits and the "ShiftRows" operation may be performed on 128 bits of data.

In some embodiments, the encryption / decryption controller 1356 may monitor the size of the data stored in the buffer 1351. When the data stored in the buffer 1351 has the size of the operation unit of the encryption operation, the encryption / decryption controller 1356 can determine that the encryption operation is performed. For example, if the buffer 1351 completely stores 32-bit data for the "MixColumns" operation as data is gradually accumulated in the buffer 1351, the encryption / decryption controller 1356 causes the "MixColumns & It is possible to control the cryptographic operation unit 1352.

On the other hand, when the data stored in the buffer 1351 does not have the operation unit size of the encryption operation, the encryption / decryption controller 1356 can determine that the encryption operation is not performed. The register 1356a may store a control value indicating that the encryption operation is performed or not, depending on the determination of the encryption / decryption controller 1356. [

In some embodiments, the encryption / decryption controller 1356 may control the encryption operation based on the round value. If the round value corresponds to zero, the encryption operation may not be performed, and therefore the register 1356a may store a control value indicating that the encryption operation is not performed. On the other hand, when the round value does not correspond to 0 (for example, when the encryption / decryption controller 1356 increases the round value), a cryptographic operation may be performed and therefore the register 1356a instructs the cryptographic operation to be performed Can be stored.

The decryption operation of the decryption operator 1353 may be performed corresponding to the encryption operation of FIG. By way of example, the decryption operator 1353 may perform the encryption operations of FIG. 3 in reverse to decrypt the encrypted data. The register 1356a may store a control value indicating that the decryption operation is performed or not performed. Since the decoding operation can be well understood by the ordinary skilled artisan, detailed descriptions of the decoding operation will be omitted below. The decoded data may be provided to the memory controller 1330.

The encryption operations defined in the FIPS 197 document issued by NIST have been described with reference to FIG. However, FIG. 3 is provided for better understanding, and is not intended to limit the present invention. Encryption / decryption circuit 1350 may employ other types of standards for encryption / decryption operations. Alternatively, the encryption / decryption circuit 1350 may employ operations different from those shown in FIG. 3 to improve the security level.

4 is a block diagram illustrating an exemplary logic circuit included in the encryption / decryption circuit of FIG. 5 is a table for explaining the operation of the logic circuit of FIG.

Some encryption / decryption circuits may be attacked by a "Side-channel Analysis Attack ". In a subchannel analysis attack, an attacker can collect incidental information such as the amount of power consumed by the encryption / decryption circuit, the waveform of the electromagnetic wave generated by the encryption / decryption circuit, and the like. The attacker may attack the encryption / decryption circuit to determine the key used in the encryption / decryption circuit based on the collected information.

Accordingly, the encryption / decryption circuit 1350 according to the embodiment of the present invention may include a logic circuit (LGC) for preventing a subchannel analysis attack. Referring to FIG. 4, the logic circuit LGC may perform a combinational logic operation corresponding to an exclusive logical sum operation. In some examples, the cryptographic operator 1352 may include a logic circuit (LGC), and the logic circuit LGC may include an "AddRoundKey" operation (e.g., in the S110, S126, and S144 operations of FIG. 3) .

The logic circuit LGC can receive four inputs A, B, ~ A, ..., B. The input ~A may correspond to the inverted value of input A and the input ~B may correspond to the inverted value of input B. For example, if the logic circuit LGC is associated with an "AddRoundKey" operation, input A may correspond to bits contained in data from buffer 1351 and input B may correspond to bits from key manager 1354 May correspond to the bits included in the key of < / RTI > The logic circuit LGC may output the results corresponding to the exclusive logical sum of the inputs A and B and the inverse value of the exclusive logical sum.

The inputs A, B, ..., A through B may or may not pass through the logic gates P1, P2, P3 and P4, respectively, based on the clock signal CLK1. As an example, the inputs A, B, ..., A, ..., B are connected to logic gates P1, P2, P3, P4 while the clock signal CLK1 has a first logical value , And each of the logic gates P1, P2, P3, and P4 may output a first logic value (e.g., logic "0"). On the other hand, the inputs A, B, ..., A, B are connected to the logic gates P1, P2, P3, P4 while the clock signal CLK1 has a second logic value (I.e., the logic gates P1, P2, P3, and P4 may output values corresponding to the inputs A, B, ..., A, ..., respectively). Here, "passing" of a particular input may mean that the particular input has an active influence on generating the output of the logic gate.

The logic gates AND1, AND2, OR1, and OR2 may combine the values output from the logic gates P1, P2, P3, and P4. The logic gates OR3 and AND3 can combine the values output from the logic gates AND1, AND2, OR1, and OR2. Thus, the logic gates OR3 and AND3 can output the results corresponding to the exclusive logical sum of the inputs A and B and the inverse value of the exclusive logical sum.

5 shows the relationship between the outputs A and B of the logic circuit LGC and the outputs of the logic gates AND1, AND2, AND3, OR1, OR2 and OR3. Each of the logic gates AND1, AND2, AND3, OR1, OR2 and OR3 has a logic "0" regardless of the values of the inputs A, B when the clock signal CLK1 has a value of logic " Can be output. On the other hand, when the clock signal CLK1 has a value of logic "1 ", the logic gates AND1, AND2, AND3, OR1, OR2 and OR3 depend on the values of the inputs A and B, Can be output.

Referring to FIG. 5, it can be understood that while the clock signal CLK1 has a value of logic "1 ", the number of logic gates outputting the value of logic" 1 " is constant. As an example, in the logic circuit LGC of Fig. 4, the logic gates outputting the value of logic "1 " may be changed depending on the values of the inputs A and B. However, regardless of the values of the inputs A and B, one AND gate outputs a value of logic "1 " and two logic sum (OR) gates output values of logic & can do.

In the logic circuit LGC in Fig. 4, the number of logic gates outputting the value of logic "1" can be kept constant, and therefore the amount of total power consumed by the logic circuit LGC is kept constant . Therefore, even if the attacker collects additional information such as the amount of power consumed by the logic circuit LGC, the waveform of the electromagnetic wave generated by the logic circuit LGC, etc., Can be difficult to understand. As a result, the logic circuit (LGC) can enable protection from subchannel analysis attacks.

However, the configuration and operation of the logic circuit (LGC) described with reference to FIGS. 4 and 5 are only examples for better understanding, and are not intended to limit the present invention. The configuration and operation of the logic circuit (LGC) can be variously modified or changed. Furthermore, the logic circuit LGC is only an example of one of the various logic circuits included in the encryption / decryption circuit 1350. [ The encryption / decryption circuit 1350 may further include various other logic circuits having various configurations for performing encryption and decryption operations.

In embodiments of the present invention, the encryption / decryption circuit 1350 may include one or more logic circuits configured to consume a certain amount of power to prevent subchannel analysis attacks. These logic circuits may include a plurality of logic gates, and the number of logic gates outputting the value of logic "0 " and the number of logic gates outputting the value of logic" 1 " .

FIG. 6 is a timing diagram illustrating time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit of FIG. 2. FIG.

For better understanding, the clock signal CLK1 of FIGS. 2 and 4 will be described. The clock signal CLK1 may have a value of logic "0" and a value of logic "1 " While the clock signal CLK1 has a logic "1" value, the encryption / decryption circuit 1350 may perform a cryptographic operation and / or a decryption operation. By way of example, the logic circuit LGC of FIG. 4 can output an exclusive logical sum of the inputs A and B while the clock signal CLK1 has a value of logic "1 ".

On the other hand, while the clock signal CLK1 has a logic "0" value, the encryption / decryption circuit 1350 may not perform encryption and decryption operations. By way of example, the logic circuit LGC of FIG. 4 can output a value of logic "0" regardless of the values of the inputs A and B while the clock signal CLK1 has a value of logic & , So the encryption operation may not be performed. When the clock signal CLK1 has a value of logic "0 ", the state of the logic gates of the encryption / decryption circuit 1350 can be reset and the power consumed by these logic gates Can be minimized.

Changing (e.g., switching) the state and power consumption of the logic gates based on the clock signal CLK1 may make subchannel analysis attacks more difficult. Therefore, the alternation of the logical values of the clock signal CLK1 can improve the security level.

While the clock signal CLK1 has a value of logic "0 ", the state of the logic gates can be reset. The first time period in which the clock signal CLK1 has a value of logic "0 " may be referred to as an" initialization period ". Meanwhile, at least one of the encryption operation and the decryption operation can be performed while the clock signal CLK1 has the value of logic "1 ". The second time period in which the clock signal CLK1 has a value of logic "1 " may be referred to as an " operation interval ". In response to the alternation of the logical values of the clock signal CLK1, the initialization interval and the computation interval may alternately occur.

In some instances, one round of operations may be performed during an operation interval. In some other examples, several rounds of operations may be performed during an operation interval. In some other examples, one round of operations may be performed during several operation intervals. The relationship between the computation period and the round can be changed or modified due to various factors such as the hardware size of the encryption / decryption circuit 1350, computation performance, operation policy, and the like.

However, encryption and decryption operations may not be performed throughout the computation period. For example, when a request (REQ) is not provided from an external device, an encryption operation and a decryption operation may not be performed in an operation interval. For example, when the encryption / decryption controller 1356 determines that the encryption operation and the decryption operation are not performed (for example, when the size of the data stored in the buffer 1351 is smaller than the operation unit size) And the decoding operation may not be performed.

As an example, a cryptographic operation and / or a decryption operation may be performed between the time point TP1 and the time point TP2 based on the determination of the request (REQ) from the external device or the encryption / decryption controller 1356. [ In this case, the encryption operation and the decryption operation may not be performed in the time interval before the time point TP1 and the time interval after the time point TP2.

In some cases, although the encryption and decryption operations are not performed, the logical values of the clock signal CLK1 may alternate continuously. However, alternating the logical values of the clock signal CLK1 while the encryption and decryption operations are not performed can increase the amount of power consumed by the encryption / decryption circuit 1350. [ This is because the logic gates repeatedly output a logic "0" (in the initialization interval) and a logic "1" (in the calculation interval) (i.e., power can be consumed have).

In addition, as described above, the encryption and / or decryption operations can be performed only in the computation interval. Therefore, when the length of the initialization interval is long, the length of the calculation interval can be shortened, and therefore, the calculation performance of the encryption / decryption circuit 1350 may be deteriorated.

7 is a block diagram showing an exemplary configuration included in the encryption / decryption circuit of FIG. In some embodiments, the encryption / decryption circuit 2350 may include an encryption operator 2352, an encryption / decryption controller 2356, and an interval controller 2357.

The configurations and operations of the encryption operator 2352 and the encryption / decryption controller 2356 may each include configurations and operations of the encryption operator 1352 and the encryption / decryption controller 1356 of FIG. 7 only shows an exemplary configuration of the encryption / decryption circuit 2350, and the encryption / decryption circuit 2350 may further include components included in the encryption / decryption circuit 1350 of FIG. For ease of explanation, redundant descriptions of the encryption / decryption circuit 2350, the encryption computer 2352, and the encryption / decryption controller 2356 will be omitted below.

The encryption / decryption controller 2356 may output the control value EC and / or the inverse value (EC) of the control value EC. The control value EC may be related to performing an encryption operation. As an example, the control value EC may indicate whether or not a cryptographic operation is performed. As an example, the control value EC may be output from the register 1356a of Fig.

The section controller 2357 can receive the clock signal CLK1. The section controller 2357 may receive the control value EC from the encryption / decryption controller 2356. [ In some cases, the interval controller 2357 may receive the inverse value (~EC) of the control value EC with or in lieu of the control value EC.

The section controller 2357 can generate the activation signal ACT1 based on the control value EC (and / or the inversion value EC of the control value EC) and the clock signal CLK1. The encryption calculator 2352 can operate based on the activation signal ACT1 instead of directly receiving the clock signal CLK1. As an example, the encryption operator 2352 may perform an encryption operation based on the activation signal ACT1.

Unlike the clock signal CLK1, the logic values of the activation signal ACT1 may not be alternated while the encryption operation is not performed. Thus, while the encryption operation is not performed, the outputs from the logic gates included in the encryption operator 2352 may not be changed. Further, while the encryption operation is not performed, the amount of power consumed by the logic gates of the encryption operator 2352 can be kept constant. The activation signal ACT1 will be further described with reference to Figs. 8 and 10. Fig.

In some embodiments, some or all of the interval controller 2357 may be included in the encryption / decryption controller 2356. In some other embodiments, some or all of the interval controller 2357 may be provided outside the encryption / decryption circuit 2350. The exemplary configuration of FIG. 7 is provided for better understanding, and is not intended to limit the present invention. The configuration of the encryption / decryption circuit 2350 can be variously modified or modified.

FIG. 8 is a timing diagram for explaining time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit including the interval controller of FIG. 7. FIG.

The interval controller 2357 can receive the clock signal CLK1 alternately having a value of logic "0" and a value of logic "1 ". Furthermore, the interval controller 2357 may receive a control value EC indicating whether the encryption operation and / or the decryption operation is performed or not.

By way of example, the control value EC of logic "0 " may indicate that the encryption and / or decryption operation is not performed. As an example, when a request (REQ) from an external device is not provided, the control value EC may have a value of logic "0. " By way of example, if the data stored in the buffer 1351 of FIG. 2 does not have an operation unit size, the control value EC may have a value of logic "0. " By way of example, when the round value corresponds to zero, the control value EC may have a value of logic "0 ".

As an example, the encryption operation and the decryption operation may not be performed in the time interval before the time point TP1 and the time interval after the time point TP2. Therefore, in the time period before the time point TP1 and the time period after the time point TP2, the control value EC has a value of logic "0" to indicate that the encryption and / .

By way of example, the control value EC of logic "1 " may indicate that a cryptographic operation and / or a decryption operation is performed. As an example, when a request (REQ) is provided from an external device, the control value EC may have a value of logic "1 ". As an example, when the data stored in the buffer 1351 has an operation unit size, the control value EC may have a value of logic "1 ". As an example, if the round value does not correspond to zero (e.g., increased by one or more), the control value EC may have a value of logic "1 ".

As an example, at least one of a cryptographic operation and a decryption operation may be performed in a time interval between timings TP1 and TP2. Thus, in the time interval between the points in time TP1 and TP2, the control value EC may have a value of logic "1 " to indicate that a cryptographic operation and / or a decryption operation is performed.

It is to be understood, however, that the above examples are provided for better understanding and are not intended to limit the present invention. In some other instances, a control value EC of logic " 0 "may indicate that a cryptographic operation and / or a decryption operation is performed and a control value EC of logic & Can not be performed.

The activation signal ACT1 may have an inactive value and an activation value based on the clock signal CLK1 and the control value EC. To facilitate a better understanding, it will be assumed that the deactivation value of the activation signal ACT1 corresponds to a logic "0 ", and the activation value of the activation signal ACT1 corresponds to a logic" 1 ". However, the present invention is not limited to this assumption, and the logic value corresponding to the inactivation value and the logic value corresponding to the activation value may be interchanged.

The activation signal ACT1 can be maintained at an inactive value (e.g., logic "0") without alternation, while the control value EC has a value of logic "0 ". As described above, the encryption operator 2352 can operate based on the activation signal ACT1 instead of the clock signal CLK1. Therefore, when the control value EC indicates that the encryption operation and / or the decryption operation is not performed, the outputs from the logic gates of the encryption operator 2352 may not be changed. By way of example, the logic circuit LGC of FIG. 4 may receive the deactivation value of the activation signal ACT1 instead of the clock signal CLK1, and each of the logic gates of the logic circuit LGC may be deactivated May output a first logic value (e.g., logic "0") in response to the value.

While the encryption and / or decryption operations are not performed, the logic gates of the encryption operator 2352 may operate in a first time interval (e.g., an initialization interval) based on the deactivation value of the activation signal ACT1. During the initialization period, since the outputs from the logic gates of the encryption operator 2352 are not changed, the amount of power consumed by the logic gates can be kept constant. Furthermore, since the outputs from the logic gates do not change, power consumption due to switching of output values can be prevented.

On the other hand, while the control value EC has a value of logic "1 ", the activation signal ACT1 may alternately have the inactive value and the activation value in response to the clock signal CLK1. Therefore, when the control value EC indicates that a cryptographic operation and / or a decryption operation is to be performed, the logic gates of the cryptographic operation unit 2352 are switched to the alternate (i.e., the inactive value and the alternate activation value) of the activation signal ACT1 (E.g., an initialization interval) and a second time interval (e.g., an arithmetic interval) in response to the response signal.

In the computation period, the encryption operator 2352 can perform encryption operations (and / or decryption operations) using the logical gates. The encryption operation and / or the decryption operation may be performed in response to the activation value of the activation signal ACT1. During the computation period, as described with reference to Figures 4 and 5, the number of logic gates outputting the first logic value and the number of logic gates outputting the second logic value can be kept constant.

Figs. 9A and 9B are block diagrams showing exemplary configurations of the section controller of Fig. 7 with respect to the timing diagram of Fig.

Referring to FIG. 9A, the interval controller 2357 may include a combinational logic gate 2357a. The combinational logic gate 2357a may combine the clock signal CLK1 and the control value EC to generate the activation signal ACT1. By way of example, combinational logic gate 2357a may perform an AND operation on the clock signal CLK1 and the control value EC.

In the example of FIG. 9A, combinational logic gate 2357a has a deactivation value < RTI ID = 0.0 > (e. G. (E.g., logic "0"). On the other hand, if the control value EC indicates that a cryptographic operation and / or a decryption operation is to be performed (e.g., has a value of logic "1"), combinational logic gate 2357a (I. E., Alternately having an inactive value and an active value).

Referring to FIG. 9B, the interval controller 2357 may include transistors 2357b and 2357c. The transistor 2357b may transmit the clock signal CLK1 as the activation signal ACT1 in response to the control value EC. The transistor 2357c may transfer the value of the logic "0" as the activation signal ACT1 in response to the inversion value ~EC of the control value EC.

In the example of Figure 9b, when the control value EC indicates that a cryptographic operation and / or a decryption operation is not to be performed (e.g., has a value of logic "0"), the transistor 2357c is deactivated , Logic "0"). On the other hand, if the control value EC indicates that a cryptographic operation and / or a decryption operation is to be performed (e. G., Having a value of logic "1"), then the transistor 2357b will respond to the clock signal CLK1 , An inactive value and an active value alternately).

When the section controller 2357 adopts the configuration shown in Fig. 9A or 9B, the section controller 2357 can generate the activation signal ACT1 described with reference to Fig. In this case, while the encryption and / or decryption operations are not performed, the output from the logic gates can be kept constant in the initialization period. Therefore, power consumption due to the switching of the output value can be prevented.

FIG. 10 is a timing diagram for explaining time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit including the interval controller of FIG. 7. FIG.

10, the activation signal ACT1 may be maintained at an activation value (e.g., logic "1 "), while the control value EC has a logic & . Thus, when the control value EC indicates that a cryptographic operation and / or a decryption operation is not performed, the logical gates of the cryptographic operator 2352 can operate in a second time interval (e.g., an operation interval). By way of example, while the encryption and / or decryption operations are not performed, the logic gates of the encryption operator 2352 may operate in the computation interval in response to the activation value of the activation signal ACT1.

If the encryption operation and / or the decryption operation is not performed, the data input to the encryption operation unit 2352 may not be changed. By way of example, while the encryption and / or decryption operations are not performed, the encryption operator 2352 can constantly receive data of a default value or data used in a previous (previous) operation. Therefore, even if the encryption operator 2352 operates in the operation interval, the outputs from the logic gates of the encryption operator 2352 may not be changed. As a result, even if the calculation period is maintained, the amount of power consumed by the logic gates can be kept constant, and the power consumption due to switching of the output value can be prevented.

In some cases, while the encryption and / or decryption operations are not performed, the data input to the encryption operator 2352 may be changed. As an example, the encryption operator 2352 may receive data or register setting values to be used in the next operation. In this case, the outputs from the logic gates of the encryption operator 2352 may be changed once. However, while the encryption operation and / or the decryption operation is not performed, the data input to the encryption operation unit 2352 may not be changed many times. Therefore, even if the arithmetic section is maintained, the power consumption due to the switching of the output value can be minimized.

On the other hand, while the control value EC has a value of logic "1 ", the activation signal ACT1 may alternately have the inactive value and the activation value in response to the clock signal CLK1. This may correspond to the time interval between the time points TP1 and TP2 described with reference to FIG. For convenience of description, redundant descriptions will be omitted below.

Figs. 11A and 11B are block diagrams showing exemplary configurations of the section controller of Fig. 7 with respect to the timing diagram of Fig.

Referring to FIG. 11A, the interval controller 2357 may include a combinational logic gate 2357d. The combinational logic gate 2357d can generate the activation signal ACT1 by combining the clock signal CLK1 and the inverted value EC of the control value EC. By way of example, combinational logic gate 2357d may perform a logic sum operation on the clock signal (CLK1) and the inverted value (~EC) of the control value (EC).

In the example of FIG. 11A, combinational logic gate 2357d is configured to compare the activation value < RTI ID = 0.0 > (e. G. (E.g., logic "1"). On the other hand, if the control value EC indicates that a cryptographic operation and / or a decryption operation is to be performed (e.g., has a value of logic "1"), combinational logic gate 2357d (I. E., Alternately having an inactive value and an active value).

Referring to FIG. 11B, the section controller 2357 may include transistors 2357e and 2357f. The transistor 2357e can transfer the value of logic "1" as the activation signal ACT1 in response to the inversion value ~EC of the control value EC. The transistor 2357f may transmit the clock signal CLK1 as the activation signal ACT1 in response to the control value EC.

In the example of FIG. 11B, when the control value EC indicates that a cryptographic operation and / or a decryption operation is not performed (e. G., Having a value of logic & , Logic "1"). On the other hand, if the control value EC indicates that a cryptographic operation and / or a decryption operation is to be performed (e. G., Having a value of logic "1"), then transistor 2357f will respond to the clock signal CLK1 , An inactive value and an active value alternately).

When the section controller 2357 adopts the configuration shown in Fig. 11A or 11B, the section controller 2357 can generate the activation signal ACT1 described with reference to Fig. In such a case, while the encryption and / or decryption operations are not performed, the output from the logic gates may remain constant in the computation interval or may change once. Therefore, the power consumption due to the switching of the output value can be prevented or minimized.

Figs. 12 and 13 are block diagrams showing exemplary configurations included in the encryption / decryption circuit of Fig.

Referring to FIG. 12, in some embodiments, the encryption / decryption circuit 2350 may further include an interval controller 2358. The encryption / decryption controller 2356 can output the control value DC and / or the inverse value (DC) of the control value DC. The control value DC may be related to performing a decryption operation. By way of example, the control value DC may indicate whether a decryption operation is performed or not. As an example, the control value DC may be output from the register 1356a of Fig.

The interval controller 2358 can receive the clock signal CLK2. The interval controller 2358 may receive the control value DC from the encryption / decryption controller 2356. [ In some cases, the interval controller 2358 may receive the inverse value (~ DC) of the control value DC with or instead of the control value DC.

The section controller 2358 can generate the activation signal ACT2 based on the control value DC (and / or the inversion value DC of the control value DC) and the clock signal CLK2. The decryption operator 2353 can operate based on the activation signal ACT2 instead of directly receiving the clock signal CLK2. As an example, the decryption operator 2353 can perform a decryption operation based on the activation signal ACT2.

Unlike the clock signal CLK2, the logic values of the activation signal ACT2 may not be alternated while the decryption operation is not performed. Similar to those described with reference to FIGS. 8 and 10, when a decryption operation is not performed, the control value DC may indicate that a decryption operation is not performed. While the decryption operation is not performed, the activation signal ACT2 may be held at one of the deactivation value and the activation value. To this end, the interval controller 2358 may include a configuration similar to that shown in Figs. 9A, 9B, 11A, or 11B.

While the decryption operation is not performed, the logic gates of decryption operator 2353 may operate in a first time period (e.g., an initialization period) in response to the deactivation value of activation signal ACT2. Alternatively, while the decryption operation is not performed, the logic gates of decryption operator 2353 may operate in a second time interval (e.g., an operation interval) in response to the activation value of activation signal ACT2. Therefore, the outputs from the logic gates included in the decryption operator 2353 may not be changed, and power consumption due to switching of output values may be prevented or minimized.

Referring to FIG. 13, in some embodiments, the encryption / decryption circuit 2350 may further include a section controller 2359. The encryption / decryption controller 2356 may output the control value SC and / or the inverse value (SC) of the control value SC. The control value SC may be related to performing a permutation operation. By way of example, the control value SC may indicate whether a substitution operation is performed or not. As an example, the control value SC may be output from the register 1356a of Fig.

The interval controller 2359 can receive the clock signal CLK3. The section controller 2359 can receive the control value SC from the encryption / decryption controller 2356. [ In some cases, the section controller 2359 may receive the inverse value (~ SC) of the control value SC together with the control value SC or instead of the control value SC.

The section controller 2359 can generate the activation signal ACT3 based on the control value SC (and / or the inversion value SC of the control value SC) and the clock signal CLK3. The S-Box 2355 can operate based on the activation signal ACT3 instead of directly receiving the clock signal CLK3. As an example, the S-Box 2355 may perform a permutation operation based on the activation signal ACT3.

Unlike the clock signal CLK3, the logic values of the activation signal ACT3 may not be alternated while the replacement operation is not performed. Similar to those described with reference to Figs. 8 and 10, when the replacement operation is not performed, the control value SC may indicate that the replacement operation is not performed. While the replacement operation is not performed, the activation signal ACT3 may be maintained at one of the inactivation value and the activation value. To this end, the interval controller 2359 may include a configuration similar to that shown in Figs. 9A, 9B, 11A, or 11B.

While the replacement operation is not performed, the logic gates of S-Box 2355 may operate in a first time period (e.g., an initialization period) in response to the deactivation value of activation signal ACT3. Alternatively, while the permutation operation is not performed, the logic gates of S-Box 2355 may operate in a second time period (e.g., a computation period) in response to an activation value of activation signal ACT3. Therefore, the outputs from the logic gates included in the S-Box 2355 may not be changed, and the power consumption due to switching of the output values may be prevented or minimized.

In some embodiments, some or all of the interval controllers 2358 and 2359 may be included in the encryption / decryption controller 2356. In some other embodiments, some or all of the interval controllers 2358 and 2359 may be provided outside of the encryption / decryption circuit 2350. The exemplary configurations of Figures 12 and 13 are provided for better understanding and are not intended to limit the present invention. The configuration of the encryption / decryption circuit 2350 can be variously modified or modified.

FIG. 14 is a timing diagram for explaining time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit of FIG. 2; FIG.

As described above, the encryption / decryption circuit 1350 may perform an encryption operation and / or a decryption operation in an operation interval. On the other hand, in the initialization period, the state of the logic gates of the encryption / decryption circuit 1350 can be reset. Therefore, encryption and decryption operations may not be performed in the initialization period. As a result, if the length of the initialization period is long, the length of the encryption section may be shortened, and therefore the computing performance of the encryption / decryption circuit 1350 may be deteriorated.

In some embodiments, the modified clock signal CCLK1 of FIG. 14 may replace the clock signal CLK1 of FIG. 6 and FIG. When the changed clock signal CCLK1 is compared with the clock signal CLK1, the length of the time interval in which the changed clock signal CCLK1 has the value of logic "1 " is obtained when the clock signal CLK1 has a value of logic & Is longer than the length of the time interval. On the other hand, it can be understood that the length of the time interval in which the changed clock signal CCLK1 has a value of logic "0 " is shorter than the length of the time interval in which the clock signal CLK1 has a value of logic" 0 ".

That is, the duty ratio or the duty cycle of the changed clock signal CCLK1 may be different from the duty ratio or the duty cycle of the clock signal CLK1. The length of the time period (e.g., the initialization period) in which the changed clock signal CCLK1 has the first logical value (e.g., logic "0") due to the change or the adjustment of the duty ratio, May be shorter than the length of a time period (e.g., an arithmetic section) having two logical values (e.g., logic "1").

Therefore, when the changed clock signal CCLK1 is employed in place of the clock signal CLK1, the length of the initialization period may be shortened and the length of the calculation period may be long. In this case, more cryptographic operations and / or decryption operations may be performed during the extended computation period. As a result, the computing performance of the encryption / decryption circuit 1350 can be improved. Each of the clock signals CLK2 and CLK3 of FIGS. 2, 12 and 13 may also be replaced by a modified clock signal CCLK1.

The modified clock signal CCLK1 may be provided from a clock generator internal or external to the encryption / decryption circuit 1350. This clock generator may be redesigned to produce a modified clock signal CCLK1 having a duty ratio or duty cycle that is different than that of the clock signal CLK1. In some embodiments, the duty ratio or duty cycle of the modified clock signal CCLK1 may be Programmable or Adjustable to adaptively control the computational performance of the encryption / decryption circuit 1350 .

On the other hand, in some embodiments, the modified clock signal CCLK1 may be implemented without redesigning the clock generator. These embodiments will be described with reference to Figs. 15 to 19. Fig.

15 is a block diagram showing an exemplary configuration included in the encryption / decryption circuit of FIG. In some embodiments, the encryption / decryption circuit 3350 may include an encryption operator 3352, an encryption / decryption controller 3356, and a clock controller 3357.

The configurations and operations of the encryption operator 3352 and the encryption / decryption controller 3356 may each include configurations and operations of the encryption operator 1352 and the encryption / decryption controller 1356 of FIG. FIG. 15 only shows an exemplary configuration of the encryption / decryption circuit 3350, and the encryption / decryption circuit 3350 may further include components included in the encryption / decryption circuit 1350 of FIG. For convenience of explanation, the redundant description of the encryption / decryption circuit 3350, the encryption computer 3352, and the encryption / decryption controller 3356 will be omitted below.

Clock controller 3357 may receive a first clock signal (e.g., clock signal CLK1). The first clock signal may correspond to the clock signal CLK1 described with reference to Figs. The length of the time interval in which the clock signal CLK1 has the first logical value (e.g., logic "0") is equal to the length of the time interval in which the clock signal CLK1 has the second logical value Can be the same. Thus, the clock signal CLK1 can be understood as a general clock signal.

The clock controller 3357 may generate a second clock signal (e.g., a modified clock signal CCLK1) based on the first clock signal. The second clock signal may correspond to the modified clock signal CCLK1 described with reference to Fig. In some embodiments, the modified clock signal CCLK1 may be generated from the clock signal CLK1 by the clock controller 3357 instead of being generated from the redesigned clock generator.

The modified clock signal CCLK1 may be provided to the encryption calculator 3352. [ The logic gates of the encryption operator 3352 can operate based on the changed clock signal CCLK1 instead of the clock signal CLK1. As shown in Fig. 14, in the changed clock signal CCLK1, the length of the calculation interval may be longer than the length of the initialization interval. Therefore, the operation performance of the encryption operator 3352 can be improved.

In some embodiments, some or all of the clock controller 3357 may be included in the encryption / decryption controller 3356. In some other embodiments, some or all of the clock controller 3357 may be provided external to the encryption / decryption circuit 3350. The exemplary configuration of FIG. 15 is provided for better understanding, and is not intended to limit the present invention. The configuration of the encryption / decryption circuit 3350 can be variously modified or modified.

In some embodiments, the encryption / decryption circuit 3350 may employ a clock controller 3357 in conjunction with the interval controller 2357 of FIG. For example, the interval controller 2357 may receive the clock signal CCLK1 changed from the clock controller 3357 instead of the clock signal CLK1. In this example, the section controller 2357 generates the activation signal ACT1 based on the control value EC (and / or the inverted value EC of the control value EC) and the changed clock signal CCLK1 . The activation signal ACT1 may correspond to the changed clock signal CCLK1 while the cryptographic operation and / or the decryption operation is performed while having a constant value while the encryption operation and the decryption operation are not performed.

Fig. 15 shows that the modified clock signal CCLK1 is provided to the encryption calculator 3352. Fig. In some embodiments, the decryption operator 1353 of FIG. 2 may receive the modified clock signal CCLK1 instead of the clock signal CLK2. Alternatively, the decryption operator 1353 can receive the activated clock signal CCLK1 and the activation signal ACT2 generated based on the control value DC in Fig. 12.

In some embodiments, the S-Box 1355 of FIG. 2 may receive the modified clock signal CCLK1 instead of the clock signal CLK3. Alternatively, the S-Box 1355 can receive the activated clock signal CCLK1 and the activation signal ACT3 generated based on the control value EC in Fig. The embodiments of the present invention are not limited by the above description, and may be variously modified or modified in order to adopt an activation signal or a modified clock signal instead of a general clock signal.

16 is a block diagram illustrating an exemplary configuration of the clock controller of FIG. FIG. 17 is a timing diagram illustrating time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit of FIG. 15 including the clock controller of FIG. 16;

16, the clock controller 3357 may include a buffer 3357a and a combinational logic gate 3357b. The clock controller 3357 may receive the clock signal CLK1. The buffer 3357a can delay the clock signal CLK1. Therefore, the buffer 3357a can output the delayed clock signal dCLK1.

Fig. 17 shows the clock signal CLK1 and the delayed clock signal dCLK1. The buffer 3357a can delay the clock signal CLK1 and output the delayed clock signal dCLK1. The length of the time interval in which the delayed clock signal dCLK1 has a value of logic "0 " may be equal to the length of the time interval in which the clock signal CLK1 has a value of logic" 0 ". The length of the time interval in which the delayed clock signal dCLK1 has the value of logic "1 " may be equal to the length of the time interval in which the clock signal CLK1 has the value of logic" 1 ".

Referring again to FIG. 16, combinational logic gate 3357b may receive clock signal CLK1 and delayed clock signal dCLK1. Combination logic gate 3357b may generate a modified clock signal CCLK1 based on the clock signal CLK1 and the delayed clock signal dCLK1. By way of example, combinational logic gate 3357b may perform a logical sum operation on the clock signal CLK1 and the delayed clock signal dCLK1.

Referring back to Fig. 17, when both the clock signal CLK1 and the delayed clock signal dCLK1 have a logic "0" value, the modified clock signal CCLK1 may have a value of logic "0 ". On the other hand, when at least one of the clock signal CLK1 and the delayed clock signal dCLK1 has a value of logic "1 ", the changed clock signal CCLK1 may have a value of logic" 1 ". Therefore, the length of the initialization period in which the changed clock signal CCLK1 has the value of logic "0 " may be shorter than the length of the computation interval in which the changed clock signal CCLK1 has the value of logic" 1 ". This modified clock signal CCLK1 can improve the calculation performance.

If the delay of the clock signal CLK1 is excessively long, the length of the initialization period of the changed clock signal CCLK1 may be longer than the length of the calculation period of the changed clock signal CCLK1. On the other hand, when the delay of the clock signal CLK1 is too short, the logical value of the changed clock signal CCLK1 may not be alternated. Therefore, the buffer 3357a can appropriately delay the clock signal CLK1 so that the length of the initialization period of the changed clock signal CCLK1 is shorter than the length of the computation period of the changed clock signal CCLK1. In some cases, the delay of buffer 3357a may be programmable or adjustable.

18 is a block diagram illustrating an exemplary configuration of the clock controller of FIG. 19 is a timing diagram for illustrating time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit of FIG. 15 including the clock controller of FIG. 18;

Referring to FIG. 18, the clock controller 3357 may include a divider 3357c and a combinational logic gate 3357d. The clock controller 3357 can receive the fast clock signal fCLK1. The frequency divider 3357c can divide the fast clock signal fCLK1. Accordingly, the frequency divider 3357c can output the clock signal CLK1. By way of example, divider 3357c may include logic circuits such as counter registers, shift registers, and the like.

19 shows the fast clock signal fCLK1 and the clock signal CLK1. The clock signal CLK1 may have a frequency used to perform cryptographic operation and / or decryption operation in the encryption / decryption circuit. Thus, the clock signal CLK1 can be understood as a general clock signal. The frequency of the fast clock signal fCLK1 may be higher than the frequency of the clock signal CLK1. In the embodiment of Figures 18 and 19, a clock generator may be provided that outputs a fast clock signal fCLK1 to generate a clock signal CLK1.

The divider 3357c divides the fast clock signal fCLK1 and can output the divided clock signal CLK1. The length of the time interval in which the divided clock signal CLK1 has a value of logic "0 " may differ from the length of the time interval in which the fast clock signal fCLK1 has a value of logic" 0 ". The length of the time interval in which the divided clock signal CLK1 has a value of logic "1 " may differ from the length of the time interval in which the fast clock signal fCLK1 has a value of logic" 1 ".

Referring again to FIG. 18, combinational logic gate 3357d may receive the fast clock signal fCLK1 and the divided clock signal CLK1. Combination logic gate 3357d may generate a modified clock signal CCLK1 based on the fast clock signal fCLK1 and the divided clock signal CLK1. By way of example, combinational logic gate 3357d may perform a logic sum operation on the fast clock signal fCLK1 and the divided clock signal CLK1.

19, if both the fast clock signal fCLK1 and the divided clock signal CLK1 have a logic "0" value, the modified clock signal CCLK1 may have a value of logic "0" . On the other hand, when at least one of the fast clock signal fCLK1 and the divided clock signal CLK1 has a value of logic "1 ", the changed clock signal CCLK1 may have a value of logic" 1 ". Therefore, the length of the initialization period in which the changed clock signal CCLK1 has the value of logic "0 " may be shorter than the length of the computation interval in which the changed clock signal CCLK1 has the value of logic" 1 ". This modified clock signal CCLK1 can improve the calculation performance.

Fig. 20 is a block diagram showing an exemplary configuration included in the encryption / decryption circuit of Fig. 2; Fig. In some embodiments, the encryption / decryption circuit 4350 may include an encryption operator 4352, an encryption / decryption controller 4356, and an initialization controller 4357.

The configurations and operations of the encryption operator 4352 and the encryption / decryption controller 4356 may each include the configurations and operations of the encryption operator 1352 and the encryption / decryption controller 1356 of FIG. 20 only shows an exemplary configuration of the encryption / decryption circuit 4350, and the encryption / decryption circuit 4350 may further include components included in the encryption / decryption circuit 1350 of FIG. For ease of explanation, redundant descriptions of the encryption / decryption circuit 4350, the encryption computer 4352, and the encryption / decryption controller 4356 will be omitted below.

The encryption / decryption controller 4356 may output the control value IEN and / or the inverse value (IEN) of the control value IEN. The control value IEN may be related to the speed mode of the encryption operation. As an example, the control value IEN may indicate whether the encryption operation of the encryption operator 4352 is performed in a low-speed mode or a high-speed mode.

6 and 14, when the time interval (for example, the initialization period) in which the clock signal CLK1 has the first logical value (e.g., logic "0") becomes longer, ) May be degraded. When the initialization interval is completely omitted, the operation performance of the encryption operator 4352 can be maximized.

The control value IEN may affect the occurrence and omission of the initialization period. For example, if the control value IEN indicates that the encryption operation is performed in the fast mode, the initialization interval may be omitted and only the computation interval may occur. Therefore, in the fast mode, the operation performance of the encryption operator 4352 can be maximized. On the other hand, when the control value IEN indicates that the encryption operation is performed in the low-speed mode, the initialization interval and the computation interval may alternately occur.

The control value IEN may be provided from a user of the computing device 1000 of FIG. Alternatively, depending on the policy of the computing device 1000, the control value IEN may be provided from the processor device 1100 and / or the memory controller 1330 of FIG. The control value IEN may have one of the logical values indicating the low speed mode and the fast mode, in accordance with the requirements for the performance of the encryption operation and / or the decryption operation.

By way of example, the control value IEN may be stored in register 1356a of FIG. The encryption / decryption controller 4356 may manage the encryption operation of the encryption operator 4352 based on the control value IEN stored in the register 1356a and the initialization controller 4357 may receive the control value IEN).

In some cases, the initialization controller 4357 may receive the inverse value IEN of the control value IEN with or in lieu of the control value IEN. Further, the initialization controller 4357 can receive the clock signal CLK1. The initialization controller 4357 can generate the controlled clock signal TCLK1 based on the control value IEN (and / or the inverted value IEN of the control value IEN) and the clock signal CLK1 have.

The encryption operator 4352 can operate based on the controlled clock signal TCLK1 instead of directly receiving the clock signal CLK1. As an example, the encryption operator 4352 may perform an encryption operation based on the controlled clock signal TCLK1.

When the control value IEN indicates that the encryption operation is to be performed in the low speed mode, the controlled clock signal TCLK1 has a first logic value (e.g., logic "0") and a second logic Value (e. G., Logic "1"). Therefore, the initialization interval and the computation interval may alternately occur.

On the other hand, when the control value IEN indicates that the encryption operation is performed in the fast mode, the value of the controlled clock signal TCLK1 may be maintained at the second logic value. Therefore, the encryption operator 4352 can perform the encryption operation steadily in the operation interval without the initialization interval, and the computation performance can be maximized. The controlled clock signal TCLK1 will be further described with reference to FIG.

In some embodiments, some or all of the initialization controller 4357 may be included in the encryption / decryption controller 4356. In some other embodiments, some or all of the initialization controller 4357 may be provided external to the encryption / decryption circuit 4350. The exemplary configuration of FIG. 20 is provided for better understanding, and is not intended to limit the present invention. The configuration of the encryption / decryption circuit 4350 can be variously modified or modified.

In some embodiments, the encryption / decryption circuit 4350 may employ an initialization controller 4357 in conjunction with the interval controller 2357 of FIG. As an example, the interval controller 2357 may receive the clock signal TCLK1 controlled by the initialization controller 4357 instead of the clock signal CLK1. In this example, the section controller 2357 generates the activation signal ACT1 based on the control value EC (and / or the inversion value EC of the control value EC) and the controlled clock signal TCLK1 can do. This activation signal ACT1 may have a constant value while the encryption operation and the decryption operation are not performed, and may enable one of the low speed mode and the high speed mode while the encryption operation and / or the decryption operation is performed.

In some embodiments, the encryption / decryption circuit 4350 may employ an initialization controller 4357 in conjunction with the clock controller 3357 of FIG. As an example, the clock controller 3357 may receive the clock signal TCLK1 controlled by the initialization controller 4357 instead of the clock signal CLK1. In this example, the controlled clock signal TCLK1 may enable either the low speed mode or the high speed mode. Further, in the low speed mode, the length of the initialization period in which the controlled clock signal TCLK1 has a first logic value (e.g., logic "0") is determined by the fact that the controlled clock signal TCLK1 has a second logic value 1 ").

20 shows that the controlled clock signal TCLK1 is provided to the encryption calculator 4352. [ In some embodiments, the decryption operator 1353 of FIG. 2 may receive the clock signal TCLK1 instead of the clock signal CLK2. Alternatively, the decryption operator 1353 can receive the activated clock signal TCLK1 and the activation signal ACT2 generated based on the control value DC of FIG. 12.

In some embodiments, the S-Box 1355 of FIG. 2 may receive the clock signal TCLK1 instead of the clock signal CLK3. Alternatively, the S-Box 1355 can receive the activated clock signal TCLK1 and the activation signal ACT3 generated based on the control value EC in Fig. The embodiments of the present invention are not limited by the above description, and may be variously modified or modified in order to employ an activation signal or a controlled clock signal instead of a general clock signal.

FIG. 21 is a timing diagram for explaining time intervals of an exemplary encryption / decryption operation performed in the encryption / decryption circuit including the initialization controller of FIG. 20; FIG.

By way of example, a control value IEN with a first logical value (e.g., logic "0") may indicate that the encryption and / or decryption operation is performed in a low speed mode. By way of example, a control value IEN with a second logical value (e.g., logic "1") may indicate that the encryption and / or decryption operation is performed in a fast mode. However, the present invention is not limited to these examples, and the logical value corresponding to the low-speed mode and the logical value corresponding to the high-speed mode may be mutually exchanged.

While the control value IEN has a value of logic "1 ", the encryption / decryption circuit 4350 may perform encryption and / or decryption operations in the low speed mode. In the low speed mode, the controlled clock signal TCLK1 may alternately have a value of logic "0 " and a value of logic" 1 "corresponding to the clock signal CLK1. Therefore, the logic gates of the encryption / decryption circuit 4350 can be reset in the initialization period, and can perform encryption and / or decryption operations in the computation period.

While the control value IEN has a value of logic "0 ", the encryption / decryption circuit 4350 may perform encryption and / or decryption operations in the fast mode. In the high speed mode, the value of the controlled clock signal TCLK1 may be held at a value of logic "1 ". Therefore, the encryption / decryption circuit 4350 can perform the encryption operation steadily in the operation period without the initialization section. Therefore, in the fast mode, the computation performance can be maximized.

FIGS. 22A and 22B are block diagrams showing exemplary configurations of the initialization controller of FIG. 20 with respect to the timing diagram of FIG.

Referring to FIG. 22A, initialization controller 4357 may include combinational logic gate 4357a. Combinational logic gate 4357a may combine the clock signal CLK1 and the inverted value IEN of the control value IEN to produce a controlled clock signal TCLK1. By way of example, combinational logic gate 4357a may perform a logical sum operation on the clock signal (CLK1) and the inverted value (~ IEN) of the control value (IEN).

In the example of FIG. 22A, combinational logic gate 4357a receives a control clock CLK1 corresponding to the clock signal CLK1 when the control value IEN indicates a low speed mode (for example, Signal TCLK1. If, on the other hand, the control value IEN indicates a fast mode (e.g., has a value of logic "0"), combinational logic gate 4357a outputs a controlled clock signal TCLK1 having a value of logic ≪ / RTI >

Referring to FIG. 22B, initialization controller 4357 may include transistors 4357b and 4357c. The transistor 4357b may transfer a value of logic "1" as the controlled clock signal TCLK1 in response to the inverse value of the control value IEN. Transistor 4357c may transmit clock signal CLK1 as a controlled clock signal TCLK1 in response to control value IEN.

In the example of Fig. 22B, when the control value IEN indicates a low speed mode (e.g., has a value of logic "1"), transistor 4357b outputs a controlled clock signal TCLK1). On the other hand, when the control value IEN indicates a high speed mode (e.g., having a value of logic "0"), the transistor 4357c generates a controlled clock signal TCLK1 having a value of logic & can do.

When the initialization controller 4357 adopts the configuration shown in Fig. 22A or 22B, the initialization controller 4357 can generate the controlled clock signal TCLK1 described with reference to Fig. In this case, in the high-speed mode, the encryption / decryption circuit 4350 can perform the encryption operation steadily in the calculation interval without the initialization interval. Therefore, in the fast mode, the computation performance can be maximized.

23 is a block diagram showing an exemplary configuration included in the encryption / decryption circuit of Fig. FIG. 24 is a block diagram showing an exemplary configuration of the initialization randomizer of FIG. 23. FIG.

Referring to Figure 23, in some embodiments, the encryption / decryption circuit 5350 may include an encryption operator 5352, an encryption / decryption controller 5356, and an initialization renderer 5357. Referring to Figure 24, in some embodiments, initialization renderer 5357 may include a random value generator 5357a and combinational logic gate 5357b.

The configurations and operations of the encryption computer 5352 and the encryption / decryption controller 5356 may each include the configurations and operations of the encryption computer 1352 and the encryption / decryption controller 1356 of FIG. 23 and 24 only illustrate an exemplary configuration of the encryption / decryption circuit 5350 and the encryption / decryption circuit 5350 may further include components included in the encryption / decryption circuit 1350 of FIG. 2 . For convenience of explanation, redundant explanations regarding the encryption / decryption circuit 5350, the encryption computer 5352, and the encryption / decryption controller 5356 will be omitted below.

If the clock signal CLK1 alternately has a first logical value (e.g., logic "0") and a second logical value (e.g., logic "1") alternately, Can be predicted.

On the other hand, if the initialization interval is controlled to occur randomly or not, it may be difficult to predict when the initialization interval occurs and when the calculation interval occurs. This is because, if the initialization interval occurs randomly or does not occur, the operation interval in which the encryption operation and / or the decryption operation is performed can be randomly variable.

Accordingly, when the initialization interval occurs randomly or does not occur, the attacker may be difficult to align the starting point of the encryption operation and / or the decryption operation to be attacked by the attacker. As a result, subchannel analysis attacks can be difficult and the level of security can be improved.

Referring to FIG. 23, the initialization renderer 5357 may receive the clock signal CLK1. The clock signal CLK1 may be a generic clock signal that alternately has a first logic value (e.g., logic "0") and a second logic value (e.g., logic "1").

The initializer 5357 can generate the randomized clock signal RCLK1 based on the clock signal CLK1. The randomized clock signal RCLK1 may or may not have a value of logic "0" randomly, instead of having the value of logic "0" and the value of logic "1 "

Referring to FIG. 24, the random value generator 5357a may randomly generate a value of logic "0 " and a value of logic" 1 ". The random value generator 5357a may operate using one or more of various randomization algorithms and simulation techniques. Since the randomization algorithms and simulation techniques can be well understood by those skilled in the art, a detailed description of how to randomly generate values of logic "0" and logic "1" Will be omitted below.

Combinational logic gate 5357b may receive the random value and the clock signal CLK1. The random value may be provided from the random value generator 5357a. The random value can have one of the values of logic "0" and the value of logic "1 "

Combination logic gate 5357b may generate a randomized clock signal RCLK1 based on the random value and the clock signal CLK1. To this end, combinational logic gate 5357b may perform a logic operation on the random value and the clock signal CLK1. By way of example, combinational logic gate 5357b may perform a logic sum operation on the random value and the clock signal CLK1, thereby producing a randomized clock signal RCLK1.

Referring to FIG. 23, instead of directly receiving the clock signal CLK1, the encryption operator 5352 can operate based on the randomized clock signal RCLK1. As an example, the encryption operator 5352 may perform an encryption operation based on the randomized clock signal RCLK1.

For example, when the random value generator 5357a generates a random value with a value of logic "0 ", the randomized clock signal RCLK1 corresponds to the value of logic" 0 " Can alternately have a value of logic "1 ". Therefore, the initialization interval and the computation interval may alternately occur.

On the other hand, when the random value generator 5357a generates a random value having a value of logic "1 ", the randomized clock signal RCLK1 has a value of logic" 1 ", regardless of the clock signal CLK1 . Therefore, the initialization period may not occur, and only the computation period may occur.

In this way, if the random value has a value of logic "0" and a value of logic "1 " at random, the initialization interval may occur randomly or not. When the occurrence of the initialization period is randomized, it may be difficult to identify the time at which the encryption and / or decryption operation is started. Thus, the level of security can be improved. To increase the randomization level of the random value, the seed value used to generate the random value may be programmable or variable.

In some embodiments, some or all of the initialization renderer 5357 may be included in the encryption / decryption controller 5356. In some other embodiments, some or all of the initialization renderer 5357 may be provided outside the encryption / decryption circuit 5350. The initializer 5357 may include various configurations to combine the clock signal and the random value. 23 and 24 are provided for better understanding and are not intended to limit the present invention. The configuration of the encryption / decryption circuit 5350 can be variously modified or modified.

In some embodiments, the encryption / decryption circuit 5350 may employ an initialization renderer 5357 along with the interval controller 2357 of FIG. As an example, the interval controller 2357 may receive the randomized clock signal RCLK1 from the initializer 5357 instead of the clock signal CLK1. In this example, the section controller 2357 outputs the activation signal ACT1 based on the control value EC (and / or the inverted value EC of the control value EC) and the randomized clock signal RCLK1 Can be generated.

In some embodiments, the encryption / decryption circuit 5350 may employ an initialization renderer 5357 in conjunction with the clock controller 3357 of FIG. In some embodiments, the encryption / decryption circuit 5350 may employ an initialization renderer 5357 with the initialization controller 4357 of FIG. As an example, each of the clock controller 3357 and the initialization controller 4357 may receive the randomized clock signal RCLK1 from the initializer 3357 instead of the clock signal CLK1.

23 shows that the randomized clock signal RCLK1 is provided to the encryption calculator 5352. [ In some embodiments, the decryption operator 1353 of FIG. 2 may receive the randomized clock signal RCLK1 instead of the clock signal CLK2. Alternatively, the decryption operator 1353 may receive the randomized clock signal RCLK1 and the activation signal ACT2 generated based on the control value DC of FIG. 12.

In some embodiments, the S-Box 1355 of FIG. 2 may receive a randomized clock signal RCLK1 instead of a clock signal CLK3. Alternatively, the S-Box 1355 can receive the randomized clock signal RCLK1 and the activation signal ACT3 generated based on the control value EC in Fig. The embodiments of the present invention are not limited by the above description and may be variously modified or modified in order to employ an activation signal or a randomized clock signal instead of a general clock signal.

The above description is a concrete example for realizing the technical idea of the present invention. The technical spirit of the present invention will include embodiments that can be obtained not only from the embodiments described above, but also from a simple design change or an easy modification. In addition, the technical idea of the present invention includes techniques that can be easily modified and implemented based on the embodiments described above.

1000: computing device 1700: bus
2350, 3350, 4350, 5350: Encryption / decryption circuit

Claims (20)

An encryption calculator configured to perform at least one of encryption and decryption operations using a plurality of logic gates; And
And a control value associated with the performance of at least one of the encryption and decryption operations and a clock signal, wherein each of the plurality of logic gates outputs a first logic value during a first time interval and the plurality And a controller configured to control the operation of the encryption operator so that the number of logic gates outputting the first logic value and the number of logic gates outputting a second logic value among the logic gates of the first and second logic gates are kept constant,
If the control value indicates that at least one of the encryption and decryption operations is not performed, the plurality of logic gates are operated under one of the first time interval and the second time interval under the control of the controller An electronic circuit comprising: The method according to claim 1,
Wherein said plurality of logic gates are controlled in said first time interval and said second time interval based on said clock signal in accordance with control of said controller if said control value indicates that at least one of said encryption and decryption operations is performed, And further configured to operate alternately. The method according to claim 1,
If the control value indicates that at least one of the encryption and decryption operations is not performed, the outputs from the plurality of logic gates do not change and the amount of power consumed by the plurality of logic gates remains constant Electronic circuit. The method according to claim 1,
Wherein the controller is configured to store the control value indicating that the encryption and decryption operations are performed or not performed in response to a request from an external device. The method according to claim 1,
Wherein the at least one of the encryption and decryption operations is configured to store data to be performed. 6. The method of claim 5,
Wherein the control value indicates that at least one of the encryption and decryption operations is not performed if the data stored in the buffer does not have at least one of the encryption and decryption operations,
Wherein the control value indicates that at least one of the encryption and decryption operations is performed when the data stored in the buffer has the operation unit size. The method according to claim 1,
Wherein the controller is further configured to manage a round value for the number of iterations of at least one of the encryption and decryption operations. 8. The method of claim 7,
If the round value corresponds to zero, the control value indicates that at least one of the encryption and decryption operations is not performed,
Wherein the control value indicates that at least one of the encryption and decryption operations is performed if the round value does not correspond to zero. An encryption calculator including a plurality of logic gates;
An encryption controller configured to output a control value associated with the execution of at least one of encryption and decryption operations by the encryption operator; And
And an interval controller configured to generate an activation signal based on the control value and the clock signal,
During a first time interval, each of the plurality of logic gates outputs a first logic value in response to an inactivation value of the activation signal,
During the second time interval, the number of logic gates outputting the first logic value and the number of logic gates outputting the second logic value among the plurality of logic gates are kept constant in response to the activation value of the activation signal Electronic circuit. 10. The method of claim 9,
Wherein the activation signal has the deactivation value and the plurality of logic gates are configured to operate in the first time interval when the control value indicates that at least one of the encryption and decryption operations is not performed. 10. The method of claim 9,
Wherein the interval controller includes a combinational logic gate,
The combinational logic gate comprises:
Combining the control signal and the clock signal indicating that at least one of the encryption and decryption operations is not performed to generate the activation signal having the deactivation value;
And to combine the clock signal and the control value indicating that at least one of the encryption and decryption operations is performed to generate the activation signal corresponding to the clock signal. 10. The method of claim 9,
Wherein the activation signal has the activation value and the plurality of logic gates are configured to operate in the second time interval when the control value indicates that at least one of the encryption and decryption operations is not performed. 10. The method of claim 9,
Wherein the interval controller includes a combinational logic gate,
The combinational logic gate comprises:
Generating the activation signal having the activation value by combining the clock signal and the inversion value of the control value indicating that at least one of the encryption and decryption operations is not performed;
And to generate the activation signal corresponding to the clock signal by combining the clock signal and an inverted value of the control value indicating that at least one of the encryption and decryption operations is performed. 10. The method of claim 9,
Wherein the activation signal alternates between the deactivation value and the activation value in response to the clock signal when the control value indicates that at least one of the encryption and decryption operations is performed. 15. The method of claim 14,
Wherein when said control value indicates that at least one of said encryption and decryption operations is performed, said plurality of logic gates alternately operate in said first time interval and said second time interval in response to an alternation of said activation signal, ≪ / RTI > A data input / output device;
An encryption / decryption circuit configured to perform encryption and decryption operations for the data input / output device; And
And an interval controller configured to generate an activation signal based on a control value indicating whether the encryption and decryption operations are performed and a clock signal,
Decryption circuitry, wherein the control value indicates that the encryption and decryption operations are not performed, in response to the activation signal having one of an inactive value and an activation value, the outputs from the encryption / Wherein the amount of power consumed by the circuit is held constant. 17. The method of claim 16,
Wherein the activation signal alternates between the deactivation value and the activation value in response to the clock signal when the control value indicates that the encryption and decryption operations are performed. 17. The method of claim 16,
Wherein a length of a time interval in which the clock signal has a first logic value is shorter than a length of a time interval in which the clock signal has a second logic value. 17. The method of claim 16,
Wherein the control value further indicates whether the encryption and decryption operations are performed in a low speed mode or a fast mode,
Wherein the clock signal alternates between a first logic value and a second logic value when the control value indicates that the encryption and decryption operations are performed in the low speed mode,
Wherein the value of the clock signal is maintained at the second logic value when the control value indicates that the encryption and decryption operations are performed in the fast mode. 17. The method of claim 16,
To generate the clock signal based on a random value having one of a first logic value and a second logic value randomly and a general clock signal alternating between the first logic value and the second logic value And an initialization renderer (Randomizer) configured.

Images