KR20190069763A - Lightweight encryption algorithm security apparatus based on hardware authentication chip - Google Patents

Abstract

The present invention relates to a lightweight encryption algorithm security apparatus based on a hardware authentication chip, comprising: a memory which is divided into a plurality of security partitions which store a plurality of second part key elements used for generating a symmetrical key which may be generated through a first part key element; a security acceleration chip which stores the first part key element, and performs encryption of a plain text or decryption of a cryptogram based on a symmetrical key generated by one of the first part key element and the plurality of second part key elements; and a processor which selects one of the plurality of security partitions in accordance with a request for encryption or decryption to bring the relevant second part key element and to provide it to the security acceleration chip. Accordingly, the present invention is able to manage a secret key used for a lightweight encryption algorithm and to strengthen security.

Description

TECHNICAL FIELD [0001] The present invention relates to a lightweight encryption algorithm security apparatus based on a hardware authentication chip,

The present invention relates to a lightweight encryption algorithm security technology, and more particularly, to a lightweight encryption algorithm security device based on a hardware authentication chip capable of enhancing security by managing a secret key used in a lightweight encryption algorithm.

The symmetric key encryption scheme uses the same key for encrypting and decrypting data to be transmitted. The symmetric key cryptosystem can provide faster processing speed than the public key cryptosystem, and the length of the cryptographic key used is relatively smaller than that of the public key cryptosystem, and is used for securing the confidentiality of general information. However, the symmetric key cryptosystem has a disadvantage in that it is inconvenient to manage a large number of keys because the same key must be shared among the information exchange parties, and special care is required so that the encryption key is not leaked when information is exchanged with various people. Typical symmetric key encryption algorithms include SEED, ARIA, LEA, HIGHT and AES, Blowfish, and Camelia.

Korean Patent Registration No. 10-0533154 (November 25, 2005) discloses an encryption / decryption method using a symmetric key in a digital rights management system and includes a random value generating step, a key identifier generating step, And a key recognizer for managing the cryptographic key in the digital rights management system is provided in comparison with the conventional technology, thereby enhancing the stability of the key management in the encryption and decryption.

Korean Patent No. 10-0898437 discloses a method for managing a symmetric key in a communication network, a communication device, and a device for processing data in a communication network, Means for decrypting the first symmetric key, wherein the encryption of the first symmetric key is performed with the aid of a second symmetric key, the memory comprising a second symmetric key common to all appliances of a given type of network, And means for decrypting the encrypted data received from the network with the aid of the first symmetric key.

Korean Patent No. 10-0533154 (November 25, 2005) Korean Patent No. 10-0898437 (2009.05.12)

An embodiment of the present invention is to provide a lightweight cryptographic algorithm security device based on a hardware authentication chip capable of enhancing security by managing a secret key used in a lightweight encryption algorithm.

One embodiment of the present invention is a lightweight cryptographic algorithm security device based on a hardware authentication chip capable of enhancing security by separating a plurality of partial key elements used for generating a symmetric key used in a lightweight algorithm into a memory and a security acceleration chip .

One embodiment of the present invention seeks to provide a lightweight cryptographic algorithm security device based on a hardware authentication chip that can minimize exposure of partial key elements by allowing only authorized access to each of a plurality of secure partitions contained in a memory.

Among embodiments, a lightweight cryptographic algorithm security device based on a hardware authentication chip comprises a plurality of security partitions for storing a plurality of second partial key elements used to generate a symmetric key that can be generated via a first partial key element A security memory for storing the first partial key element and performing a decryption of a plaintext or a ciphertext based on a symmetric key generated as one of the first partial key element and the second plurality of partial key elements, And a processor for selecting one of the plurality of security partitions according to a chip and an encryption or decryption request to obtain a corresponding second partial key element and providing the selected second partial key element to the security acceleration chip.

The memory may store only the plurality of second partial key elements except for the first partial key element

The secure acceleration chip may change the first partial key element under certain conditions.

The processor may update the entire plurality of second partial key elements when a change in the first partial key elements stored in the secure acceleration chip is detected.

The processor may select one of the plurality of secure partitions based on a random number obtained from a random number generator according to an encryption or decryption request.

The processor can obtain a random number by providing a current time to the random number generator as a seed.

The processor may retrieve the second partial key element stored in the secure partition by verifying that the selected secure partition is in an accessible state.

The processor may again select one of the plurality of secure partitions based on the new random number obtained from the random number generator if the secure partition is inaccessible.

The disclosed technique may have the following effects. It is to be understood, however, that the scope of the disclosed technology is not to be construed as limited thereby, as it is not meant to imply that a particular embodiment should include all of the following effects or only the following effects.

The lightweight encryption algorithm security device based on hardware authentication chip according to an embodiment of the present invention can secure a plurality of partial key elements used for generating a symmetric key used in a lightweight algorithm in a memory and a security acceleration chip to enhance security have.

The lightweight cryptographic algorithm security apparatus based on the hardware authentication chip according to an embodiment of the present invention can minimize the exposure of the partial key elements by allowing only authorized access to each of the plurality of secure partitions included in the memory.

FIG. 1 is a diagram for explaining a lightweight encryption algorithm security apparatus based on a hardware authentication chip according to an embodiment of the present invention.
Figure 2 is a block diagram illustrating the functional elements of the processor in Figure 1;
3 is a flowchart illustrating an encryption or decryption process performed in the security acceleration chip of FIG.
4 is a flowchart illustrating an encryption or decryption process performed in the processor shown in FIG.
5 is an exemplary diagram illustrating an encryption or decryption process performed using the LEA algorithm in the security acceleration chip of FIG.

The description of the present invention is merely an example for structural or functional explanation, and the scope of the present invention should not be construed as being limited by the embodiments described in the text. That is, the embodiments are to be construed as being variously embodied and having various forms, so that the scope of the present invention should be understood to include equivalents capable of realizing technical ideas. Also, the purpose or effect of the present invention should not be construed as limiting the scope of the present invention, since it does not mean that a specific embodiment should include all or only such effect.

Meanwhile, the meaning of the terms described in the present application should be understood as follows.

The terms "first "," second ", and the like are intended to distinguish one element from another, and the scope of the right should not be limited by these terms. For example, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" to another element, it may be directly connected to the other element, but there may be other elements in between. On the other hand, when an element is referred to as being "directly connected" to another element, it should be understood that there are no other elements in between. On the other hand, other expressions that describe the relationship between components, such as "between" and "between" or "neighboring to" and "directly adjacent to" should be interpreted as well.

It is to be understood that the singular " include " or "have" are to be construed as including the stated feature, number, step, operation, It is to be understood that the combination is intended to specify that it does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

In each step, the identification code (e.g., a, b, c, etc.) is used for convenience of explanation, the identification code does not describe the order of each step, Unless otherwise stated, it may occur differently from the stated order. That is, each step may occur in the same order as described, may be performed substantially concurrently, or may be performed in reverse order.

The present invention can be embodied as computer-readable code on a computer-readable recording medium, and the computer-readable recording medium includes all kinds of recording devices for storing data that can be read by a computer system . Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like. In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. Commonly used predefined terms should be interpreted to be consistent with the meanings in the context of the related art and can not be interpreted as having ideal or overly formal meaning unless explicitly defined in the present application.

Lightweight block cipher algorithms can be classified into SPN type and Feistel type according to their types. The SPN type satisfies Confusion and Diffusion using S-BOX and P-BOX. The SPN type feature is that parallel operation is possible and encryption and decryption modules are not the same. A typical example of the SPN type is the most widely used AES to date. The Feistel type is also known as ARX-based and uses modular Addition, Rotation, and XOR operations. A typical example of a Feistel type is DES. Domestic light block cipher algorithms include LEA, HIGHT, SEED, and ARIA.

The Lightweight Encryption Algorithm (LEA) is an algorithm for encrypting 128-bit data blocks of the GFN structure developed by the National Institute of Security Research in 2013, and can use 128/192/256 bit secret keys. . The LEA's round function consists of only 32-bit ARX operations, allowing it to operate at high speeds on a general purpose 32-bit software platform that supports these operations. Arrangement of ARX operations inside the round function ensures sufficient safety while eliminating the use of S-boxes and enabling lightweight implementation.

FIG. 1 is a diagram for explaining a lightweight encryption algorithm security apparatus based on a hardware authentication chip according to an embodiment of the present invention.

1, a lightweight encryption algorithm security device (hereinafter referred to as a lightweight encryption algorithm security device) 100 based on a hardware authentication chip includes a memory 110, a security acceleration chip 130, and a processor 150 can do.

The memory 110 may include an auxiliary storage device that is implemented as a non-volatile memory, such as a solid state disk (SSD) or a hard disk drive (HDD) And a main memory implemented with a volatile memory such as a RAM (Random Access Memory).

In one embodiment, the memory 110 may be divided into a plurality of secure partitions, and each secure partition may store a plurality of second partial key elements used to generate the symmetric key. In one embodiment, the memory 110 may store only a plurality of second partial key elements other than the first partial key elements.

The secure partition may correspond to a portion of the memory and may be accessible only under the management of the processor 150. Only a specific process that is in an accessible state for a particular secure partition can access the secure partition and read the second partial key element. A secure partition can only be accessed by a specific process in the accessible state, and can become inaccessible to the rest of the process. Each secure partition can store only one second partial key element and can not store redundant second partial key elements stored in another secure partition.

The security acceleration chip 130 may correspond to a hardware security chip that encrypts or decrypts a plain text or a cipher text using a cipher key or a decryption key. In one embodiment, the secure acceleration chip 130 may store a first partial key element. The first partial key element stored in the security acceleration chip 130 can not be accessed from the outside and can be used to generate a symmetric key used for encryption or decryption.

In one embodiment, the secure acceleration chip 130 may generate a symmetric key with one of the first partial key element and a plurality of second partial key elements stored in the memory 110. The symmetric key may correspond to a cryptographic key or a decryption key used to apply the lightweight cryptographic algorithm.

The symmetric key used in the lightweight cryptographic algorithm can be transformed into n partial key elements through the secret sharing scheme proposed by Shamir. The secret sharing scheme may correspond to a (k, n) -threshold scheme that distributes confidential information to n participants and restores confidential information when more than k of n participants gather. In the secret sharing scheme proposed by Shamir, the symmetric key can be transformed into n partial key elements using the following equation.

[Mathematical Expression]

The security acceleration chip 130 may generate a symmetric key using Lagrange Interpolation for k partial key elements among the n partial key elements converted by the secret sharing scheme proposed by Shamir. Here Lagrangian interpolation is a method of interpolating a polynomial from a given set of data points, which may correspond to a method of obtaining an n-th polynomial over n + 1 given points.

The security acceleration chip 130 may store k-1 partial key elements among the n partial key elements within the secure acceleration chip 130 as a first partial key element. The remaining n-k + 1 partial key elements other than the first partial key element among the n partial key elements may be respectively stored in the secure partition of the memory 110 as a second partial key element. The security acceleration chip 130 may generate a symmetric key using a total of k partial key elements, including k-1 first partial key elements and one of the second partial key elements stored in the memory 110 have.

In one embodiment, the secure acceleration chip 130 utilizes a total of at least k partial key elements, including at least one of k-1 first partial key elements and second partial key elements stored in the memory 110 So that a symmetric key can be generated. According to the secret sharing method proposed by Shamir, the original symmetric key can be restored when k or more partial key elements among the n partial key elements generated using the symmetric key are collected.

The security acceleration chip 130 may perform the encryption of the plaintext or the decryption of the ciphertext based on the symmetric key generated using the first partial key element and the second partial key element. More specifically, the security acceleration chip 130 may perform plaintext encryption or decryption of ciphertext through LEA block encryption using a symmetric key and a round function. The security acceleration chip 130 may be provided as input with a second partial key element along with a plain text or cipher text and may provide a ciphertext or plaintext as an output as a result of encryption or decryption.

In one embodiment, the secure acceleration chip 130 may change the first partial key element under certain conditions. For example, the secure acceleration chip 130 may change the entire first partial key element only when coupled to a specific device, separate from the lightweight cryptographic algorithm security device 100. [ The symmetric key used in the lightweight encryption algorithm can be changed by changing the entire first partial key element stored in the secure acceleration chip 130. [

The security acceleration chip 130 may correspond to a hardware security chip, and can not directly access the first partial key element from the outside and can not easily change it unless it is a special case. The first partial key element stored by the security acceleration chip 130 may correspond to information on a specific symmetric key used for encryption or decryption and may be designed so that direct access from the outside is impossible to enhance security for the symmetric key .

The processor 150 may execute the lightweight cryptographic algorithm security procedures of the lightweight cryptographic algorithm security device 100 and may manage the memory 110 that is read or written throughout the process, The synchronization time between the memory and the nonvolatile memory can be scheduled. The processor 150 may control the overall operation of the lightweight encryption algorithm security device 100 and may be electrically coupled to the memory 110 and the security acceleration chip 130 to control the data flow between them. The processor 150 may be embodied as a central processing unit (CPU) of the lightweight encryption algorithm security apparatus 100.

In one embodiment, the processor 150 may update a plurality of second partial key elements stored in the memory 110 when a change in the first partial key elements stored in the secure acceleration chip 130 is detected. The first partial key element and the second partial key element may be used together to generate the same one symmetric key and the first partial key element or the second partial key element alone can not generate the symmetric key. Thus, when the first partial key elements stored in the secure acceleration chip 130 are changed, the second partial key elements stored in the secure partition of the memory 110 may also need to be modified. In this case, the second partial key elements to be updated may be generated using the symmetric key used to generate the modified first partial key elements.

For example, the processor 150 receives the remaining partial key elements excluding the partial key elements stored in the security acceleration chip 130 as the first partial key elements among the n partial converted key elements through the secret sharing technique proposed by Shamir May be stored in each of the secure partitions of the memory 110 as second partial key elements. Specific functions of the processor 150 will be described in detail with reference to FIG.

Figure 2 is a block diagram illustrating the functional elements of the processor in Figure 1;

Referring to FIG. 2, the processor 150 may include a request receiver 210, a secure partition determination unit 230, a partial key element providing unit 250, and a controller 270.

The request receiving unit 210 may receive an encryption or decryption request. In one embodiment, the request receiving unit 210 can process the plaintext when the lightweight encryption algorithm security apparatus 100 receives plaintext from the outside, The request can be treated as received.

The secure partition determination unit 230 may select one of a plurality of security partitions included in the memory 110 when receiving the encryption or decryption request through the request receiving unit 210. [ The processor 150 may change the access right to the security partition selected by the security partition determining unit 230 to an accessible state by associating with the specific process.

In one embodiment, the secure partition determination unit 230 determines, based on a random number obtained from a random number generator (not shown in FIG. 2) according to an encryption or decryption request, one of a plurality of security partitions included in the memory 110 Can be selected. For example, the secure partition determination unit 230 may output a random number within a range of the number of security partitions included in the memory 110 through a random number generator, You can choose a partition.

In one embodiment, the secure partition determination unit 230 can obtain a random number by providing a current time to a random number generator as a seed. Here, the current time may correspond to the current time of the system. In another embodiment, the secure partition determination unit 230 may obtain a random number by providing various seeds to the random number generator in addition to the current time, and may determine a secure partition stored in the memory 110 based on the random number.

The partial key element providing unit 250 may fetch the second partial key element from the secure partition selected by the secure partition determining unit 230 and provide the second partial key element to the secure acceleration chip 130. [ The partial key element providing unit 250 accesses the corresponding secure partition through the process of obtaining the access right to the selected secure partition to obtain the second partial key element.

In one embodiment, the partial key factor providing unit 250 can obtain the second partial key element stored in the secure partition by confirming that the security partition selected by the secure partition determining unit 230 is in an accessible state. The partial key element providing unit 250 can access the security partition and fetch the second partial key element only when the corresponding security partition is in the accessible state. If the security key is in the inaccessible state, .

In one embodiment, the partial key factor providing unit 250 determines whether the security partition selected by the security partition determining unit 230 is inaccessible, based on the new random number acquired from the random number generator through the secure partition determining unit 230 To reselect one of the plurality of secure partitions. If the security partition is inaccessible, the partial key element providing unit 250 can wait until it is in an accessible state, generate a new random number from the random number generator through the secure partition determining unit 230, You can reselect the secure partition. In this case, access rights to the previously selected secure partition may be initiated by the processor 150. [

In one embodiment, if the security partition selected by the secure partition determination unit 230 is in an inaccessible state, the partial key element providing unit 250 can automatically wait for the waiting time calculated by the following equation (1) When the waiting time has elapsed, a new random number may be generated from the random number generator through the security partition determination unit 230 and the security partition associated with the random number may be selected again.

[Equation 1]

Here, T is the waiting time, k is a scaffold coefficient, P is the calculation load of the processor (150), C is an operation performance of the processor (150), N _P is the N _S number of the current process is a memory ( 110). ≪ / RTI >

The waiting time T, in which the partial key element providing unit 250 can wait until the security partition becomes accessible, is determined by the fact that the greater the computation load of the processor 150, the lower the computation performance of the processor 150, The smaller the number of processes, and the smaller the number of secure partitions included in the memory 110, the longer it can be.

If the computation load of the processor 150 is large or the computation performance is low, the random number acquisition operation through the random number generator may increase the computation load of the processor 150, so it is preferable to increase the waiting time to reduce additional computation . If the number of currently created processes is small, access to the new security partition may be easy through the new random number, so it may be desirable to shorten the waiting time and process the operation quickly. The lower the number of secure partitions included in the memory 110, the higher the probability that attempts to access the associated security partitions will be duplicated, so it may be desirable to increase the latency time to reduce access attempts of the secure partitions.

The control unit 270 may control the overall operation of the processor 150 and may manage the control flow and data flow between the request receiving unit 210, the secure partition determination unit 230 and the partial key factor providing unit 250.

3 is a flowchart illustrating an encryption or decryption process performed in the security acceleration chip of FIG.

Referring to FIG. 3, the secure acceleration chip 130 may receive a second partial key element from the partial key element providing part 250 (step S310). The security acceleration chip 130 uses the second partial key element received from the partial key element providing unit 250 and the plurality of first partial key elements stored in the hardware of the secure acceleration chip 130 to store the symmetric key (Step S330).

The security acceleration chip 130 may perform encryption of plain text or decryption of ciphertext using the generated symmetric key (step S350). The security acceleration chip 130 may apply the generated symmetric key to the lightweight encryption algorithm to perform encryption of plain text or decryption of ciphertext. For example, the security acceleration chip 130 may apply a LEA block cipher using a symmetric key and a round function to convert a plaintext into a ciphertext, or to convert a ciphertext into a plaintext to provide an output.

4 is a flowchart illustrating an encryption or decryption process performed in the processor shown in FIG.

Referring to FIG. 4, the processor 150 may receive an encryption or decryption request through the request receiver 210 (step S410). The processor 150 may select one of the plurality of security partitions included in the memory 110 through the secure partition determination unit 230 (step S430).

In one embodiment, the secure partition determination unit 230 may select at least one secure partition among a plurality of secure partitions included in the memory 110. [ More specifically, the secure partition determination unit 230 may select at least one secure partition by successively obtaining a random number from the random number generator.

The processor 150 may provide the second partial key element stored in the selected secure partition to the secure acceleration chip 130 through the partial key element providing unit 250 (step S450). In one embodiment, the partial key element providing unit 250 checks the accessible state of each security partition when the secure partition determining unit 230 selects at least one secure partition, to determine at least one second partial key element To the security acceleration chip 130.

In one embodiment, the secure acceleration chip 130 includes at least one second partial key element received from the partial key element providing part 250 and a plurality of second partial key elements received from the secure acceleration chip 130, 1 partial key elements may be used to generate the symmetric key. For example, the security acceleration chip 130 may perform a Lagrangian interpolation for at least k partial key elements, including at least one second partial key elements and first partial key elements within the secure acceleration chip 130, (Lagrange Interpolation) can be applied to generate a symmetric key.

5 is an exemplary diagram illustrating an encryption or decryption process performed using the LEA algorithm in the security acceleration chip of FIG.

5, when one of the plurality of security partitions included in the memory 510 is selected by the security partition determination unit 230 of the processor 150, The partial key element may be provided to the secure acceleration chip 530 by the partial key element providing part 250 of the processor 150. [ The security acceleration chip 530 uses the second partial key element provided by the partial key element providing part 250 and the first partial key elements 531 stored in the security acceleration chip 530 to generate the secret key 533 Can be generated.

The security acceleration chip 530 may apply the LEA encryption algorithm, which is one of the lightweight encryption algorithms, based on the secret key 533 (537 and 539). More specifically, the security acceleration chip 530 can generate a plurality of round keys by inputting the generated secret key 533 to the key scheduler, and encrypts the plain text using the round keys and the round function 535 A ciphertext is generated (537), or a ciphertext is decrypted to generate a plain text (539).

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims It can be understood that

100: Lightweight cryptographic algorithm security device based on hardware authentication chip
110: memory 130: security acceleration chip
150: Processor
210: request reception unit 230: security partition determination unit
250: partial key element providing unit 270:
510: memory 530: security acceleration chip
511: Security partition 531: First partial key element
533: secret key 535: round function
537: Encryption process 539: Decryption process

Claims (8)

A memory divided into a plurality of security partitions storing a plurality of second partial key elements used to generate a symmetric key that can be generated via a first partial key element;
A secure acceleration chip for storing the first partial key element and performing encryption of a plaintext or decryption of a ciphertext based on a symmetric key generated as one of the first partial key element and the plurality of second partial key elements; And
And a processor for selecting one of the plurality of security partitions according to an encryption or decryption request to obtain a corresponding second partial key element and providing the selected second partial key element to the security acceleration chip.
2. The apparatus of claim 1, wherein the memory
And stores only the plurality of second partial key elements except for the first partial key element.
The system of claim 1, wherein the secure acceleration chip
Wherein the first partial key element can be changed under specific conditions.
2. The apparatus of claim 1, wherein the processor
And updates the entirety of the plurality of second partial key elements when a change in the first partial key elements stored in the security acceleration chip is detected.
2. The apparatus of claim 1, wherein the processor
And selecting one of the plurality of security partitions based on a random number obtained from the random number generator according to an encryption or decryption request.
6. The apparatus of claim 5, wherein the processor
And the random number generator is provided with a current time as a seed to obtain a random number.
6. The apparatus of claim 5, wherein the processor
And the second partial key element stored in the secure partition is obtained by confirming that the selected security partition is in an accessible state.
8. The apparatus of claim 7, wherein the processor
And when the security partition is in an inaccessible state, selecting one of the plurality of security partitions based on a new random number obtained from the random number generator.

Images