RU2494471C1 - Device for encrypting data according to standards gost 28147-89 and aes - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: device for encrypting data includes a GOST 28147-89 conversion circuit, an AES conversion circuit, an AES key conversion unit, a first multiplexer, a second multiplexer, a data storage and a key storage; the output of the data storage is connected to the first input of the GOST 28147-89 conversion circuit and to the first input of the AES conversion circuit; the output of the key storage is connected to the second input of the GOST 28147-89 conversion circuit, the second input of the AES conversion circuit, the input of the AES key conversion unit and the second input of the second multiplexer; outputs of the GOST 28147-89 conversion circuit and the AES conversion circuit are connected to the first and second inputs of the first multiplexer, respectively; the output of the first multiplexer is connected to the input of the data storage; the output of the AES key conversion unit is connected to the first input of the second multiplexer; the output of the second multiplexer is connected to the input of the key storage; encryption algorithm selection signals are transmitted to the control inputs of the first and second multiplexers.

EFFECT: reducing the amount of memory required to encrypt data.

3 dwg

Description

Technical field

The present invention relates to encryption devices based on a data encryption standard, and more particularly to data encryption according to GOST 28147-89 and AES.

State of the art

The standard data encryption algorithm in the Russian Federation is GOST 28147-89. At the same time, in modern equipment it is often necessary to use the AES encryption algorithm adopted in the West.

Both algorithms have a similar structure. GOST 28147-89 is built on the basis of the Feistel network, AES based on the SP-network. Both structures are iterative and, from the point of view of hardware implementation, come down to the fact that the input data block, which needs to be encrypted / decrypted, is loaded into the drive and then subjected to a sequence of transformations (rounds).

The data after each round (Fig. 1) is copied to the drive and again subjected to round-robin conversion, and so n times, where n is the number of rounds required for a complete encryption / decryption cycle.

The most typical hardware implementation of both algorithms contains a data and key drive, as well as a functional part (round device), where data is converted. Figure 2 shows the data flow in the algorithms GOST 28147-89 and AES, respectively. Both of these algorithms are resource intensive and require significant hardware costs.

To increase productivity and to implement additional modes, in addition to the simple replacement mode, an additional buffer of the same size is required for each drive.

The table below shows the amount of data that must be stored in the device (including the buffer):

Data Key GOST 28147-89 128 (64 * 2) 512 (256 * 2) AES 256 (128 * 2) 512 (256 * 2) Total: 1408 (key + data)

The aim of the present invention is to develop a combined hardware implementation of data encryption according to GOST 28147-89 and AES, which will require less resources to work.

SUMMARY OF THE INVENTION

The technical result of the invention is to reduce the amount of memory needed to encrypt data according to GOST 28147-89 and AES, i.e. reduced hardware costs.

To reduce hardware costs, the data encryption device combines key and data from encryption devices according to GOST 28147-89 and AES standards.

The data encryption device according to GOST 28147-89 and AES standards contains: a conversion scheme according to GOST 28147-89, an AES conversion scheme, a key conversion unit according to AES, a first multiplexer, a second multiplexer, a data storage device and a key storage device. The output of the data storage device is connected to the first input of the conversion circuit according to GOST 28147-89 and to the first input of the conversion circuit according to AES. The output of the key storage device is connected to the second input of the conversion circuit according to GOST 28147-89, to the second input of the conversion circuit according to AES, to the input of the key conversion unit according to AES and to the second input of the second multiplexer. The outputs of the conversion circuit according to GOST 28147-89 and the conversion circuit according to AES are connected to the first and second inputs of the first multiplexer, respectively. The output of the first multiplexer is connected to the input of the data storage device. The output of the AES key conversion unit is connected to the first input of the second multiplexer. The output of the second multiplexer is connected to the input of the key drive. The control inputs of the first and second multiplexers receive signals to select the encryption algorithm.

The use of shared data and key drives in a combined data encryption device reduces the number of memory elements needed to store data and a key by half.

Brief Description of the Drawings

Figure 1 presents an exemplary hardware implementation for encrypting data according to GOST 28147-89 and AES.

Figure 2 shows the progress of data passage in encryption algorithms according to GOST 28147-89 and AES, respectively.

Figure 3 presents the functional diagram of the encryption device according to GOST 28147-89 and AES.

DETAILED DESCRIPTION OF THE INVENTION

In the proposed data encryption device, two joint drives are implemented: the first is responsible for data storage, the second for key storage. The size of the data and key drives is determined by the value IDS = max {DS (AES), DS (GOST)} and IKS = max {KS (AES), KS (GOST)}, respectively, where DS (i) determines the size required to store data Algorithm i, taking into account the buffer. KS (i) determines the size required to store the key of algorithm i, taking into account the buffer. With a hardware implementation, the data and key drives will be a register memory. Depending on which device is currently running, it will store its intermediate data from inter-round transformations in register memory.

The table below shows the amount of data that must be stored in the device (taking into account the buffer) when using the proposed drive pool:

Data Key GOST 28147-89 + AES 256 (128 * 2) 512 (256 * 2) Total: 768 (key + data)

Thus, the number of registers needed to store data and a key is halved. Given the combination parts of the algorithms, the gain in the equipment is about 1.5.

The data encryption device according to GOST 28147-89 and AES standards (Fig. 3) contains: a conversion scheme according to GOST 28147-8, AES conversion scheme, AES key conversion unit, first MX1 multiplexer, second MX2 multiplexer, IDS size data storage device and key drive in IKS size. The output of the data storage device is connected to the first input of the conversion circuit according to GOST 28147-89 and to the first input of the conversion circuit according to AES. The output of the key storage device is connected to the second input of the conversion circuit according to GOST 28147-89, to the second input of the conversion circuit according to AES, to the input of the key conversion unit according to AES and to the second input of the second multiplexer. The outputs of the conversion circuits according to GOST 28147-8 and AES are connected to the inputs of the first multiplexer. The output of the first multiplexer is connected to the input of the data storage device. The output of the AES key conversion unit is connected to the first input of the second multiplexer. The output of the second multiplexer is connected to the input of the key drive. The control inputs of the multiplexers (not shown in the figure) receive signals to select the encryption algorithm.

The data encryption device according to the standards GOST 28147-89 and AES (figure 3) works as follows. Data from the common storage is simultaneously transferred to the conversion schemes according to GOST 28147-89 and AES. After that, the data enters the MX1 multiplexer, in which the data for storing after conversion is selected. The choice is made depending on the conversion algorithm, which is set by the user before the start of the encryption / decryption process. The selected data is sent to the storage and used in the new round of conversion.

In the AES standard data encryption algorithm, the key is converted simultaneously with the data conversion, in the algorithm according to GOST 28147-89, no. Therefore, the key goes simultaneously to the AES conversion schemes, according to GOST 28147-89, to the second multiplexer and to the AES key conversion unit. The MX2 multiplexer selects either the converted key for the algorithm according to the AES standard, or the source key in case of conversion according to the GOST 28147-89 standard. The stored key is then used in a new round of conversion.

Claims (1)

A data encryption device according to GOST 28147-89 and AES standards, containing a conversion scheme according to GOST 28147-89, AES conversion scheme, AES key conversion unit, first multiplexer, second multiplexer, data storage and key storage; the output of the data storage device is connected to the first input of the conversion circuit in accordance with GOST 28147-89 and to the first input of the conversion circuit in accordance with AES; the key drive output is connected to the second input of the conversion circuit according to GOST 28147-89, to the second input of the conversion circuit according to AES, to the input of the key conversion unit according to AES and to the second input of the second multiplexer; the outputs of the conversion circuit according to GOST 28147-89 and the conversion circuit according to AES are connected to the first and second inputs of the first multiplexer, respectively; the output of the first multiplexer is connected to the input of the data storage device; the output of the key conversion unit via AES is connected to the first input of the second multiplexer; the output of the second multiplexer is connected to the input of the key drive; the control inputs of the first and second multiplexers receive signals to select the encryption algorithm.

Images