RU2765406C1 - Symmetrical data encryption apparatus using a strong authentication algorithm - Google Patents

Abstract

FIELD: data encryption.

SUBSTANCE: disclosed is a symmetrical data encryption apparatus (SDEA) implemented in the form of a system on chip (SOC), including a central processing unit, an internal switching unit, a frontend controller, a multiplexing unit, and an encryption apparatus including: a direct memory access controller, a computing module, a pseudo-random number generator, a timer, a general purpose register for storing the substitution table (ST GPR), a general purpose register for storing the secret encryption keys (SEK GPR), an additional SEK GPR, and a control unit; wherein the CPU is connected by a data bus (DB) with the internal switching unit and by a configuration interface with the direct memory access controller and the control unit; the internal switching unit is connected by data buses with the direct memory access controller, and by data buses with the memory access controller and the frontend controller; the memory access controller is connected with the memory, and the frontend controller is connected via a multiplexed data bus with the multiplexing unit also receiving signals from the control unit via the control bus by the multiplexing unit and having multiplexed frontend buses entering the SOC output; the computing module is interconnected with the ST GPR, SEK GPR, and additional SEK GPR, control unit, and receives signals from the direct memory access controller via a DB and the pseudo-random number generator; the control unit sends signals to the ST GPR, SEK GPR, and additional SEK GPR via a DB to the direct memory access controller and is interconnected with the timer.

EFFECT: ensured strong authentication between subscribers in the encryption procedure.

3 cl, 6 dwg

Description

The invention relates to the field of transmission of digital information and computer technology, data encryption devices. In particular, it can be used for hardware authentication in the control systems of subsea gas production complexes and built in the form of systems on a chip (SoC).

An invention is known according to patent RU 2 585 988 C1 (patent holder Open Joint Stock Company Baikal Electronics, IPC G06F 21/60, H04L 9/00), related to the field of encryption of data streams, containing an encryption device with which data can be encrypted or decrypted according to the algorithm of cryptographic transformation GOST 28147-89, while the scheme involves storing tables of substitutions, a secret key for encryption/decryption, an initialization vector of a sync message used for encryption in the gamma mode and gamma with feedback, an initialization vector of imitation insertion. The circuit also contains a central processor, an internal switching unit, an internal or external memory access controller (depending on the version). This solution is the closest to the claimed invention, but has a number of disadvantages:

a) Lack of technical ability to implement strong authentication according to GOST R ISO/IEC 9594-8-98 between subscribers in accordance with authentication schemes FIG. 1, Fig. 2, Fig. 3.

b) The use of only one key at a time in the encryption procedure in accordance with GOST 28147-89.

The objective of the invention is to create a device capable of implementing strong authentication according to GOST R ISO/IEC 9594-8-98 between subscribers and using two keys in the encryption procedure according to GOST 28147-89.

The claimed invention is a device for symmetric data encryption using the strong authentication algorithm (SSDA) according to GOST R ISO/IEC 9594-8-98 for authentication of hardware combined according to the scheme of FIG. 1, Fig. 2 or Fig. 3 (3 variants), using the symmetric cryptographic transformation algorithm GOST 28147-89 and implemented as a SoC with functional modules (3 variants). SoC (1) plays the role of a remote control device (server) in the control system, SoC (2.1…2.N) performs the functions of monitoring and control units (controllers) at the control object and can be connected to remote control devices (1.1…1.K) depending on the implementation variant of the data encryption device, only via multiplexed external interface buses (28.1…28.М), common external interface data bus (27) or via several types of buses simultaneously (27 and 28.1…28.М).

Brief description of the drawings

Fig. 1 - Device authentication scheme when using multiplexed data buses;

Fig. 2 - Device authentication scheme when using a common data transfer bus;

Fig. 3 - Device authentication scheme when using a combination of multiplexed and common data transmission buses;

Fig. 4 - USShD architecture with multiplexed data transmission buses;

Fig. 5 - Architecture USSHD with a common data bus;

Fig. 6 - USSHD architecture with a combination of multiplexed and common data transmission buses.

USSD is implemented in the form of SoC (1), can be made in three versions (Option 1 - Fig. 4, Option 2 - Fig. 5, Option 3 - Fig. 6) and contains the following functional blocks and components:

(2) - central processor;

(3) - internal switching unit;

(4) - direct memory access controller;

(5) - memory access controller;

(6) - memory;

(7) - encryption device;

(8) - computing module;

(10) - configuration interface;

(9), (11), (12), (13), (14), (20), (24) - internal address-data buses (SD);

(15) - pseudo-random number generator;

(16) - timer;

(17) - a general-purpose register for storing a table of replacements (RON TZ);

(18), (19) - general-purpose registers for storing secret encryption keys (RON KSh);

(21) - control unit;

(22) - external interface controller;

(23) - multiplexing unit;

(25) - multiplexed data bus;

(26) - control bus of the multiplexing unit;

(27) - common data bus of the external interface;

(28.1…28.M) - multiplexed external interface buses.

Links between SoC elements according to Option 1:

SoC (1) contains a central processor (2), a switching unit (3), a memory access controller (5), an external interface controller (22), a multiplexing unit (23) and an encryption device (7), which includes includes: direct memory access controller (4), computing module (8), pseudo-random number generator (15), timer (16), RON TZ (17), RON KSh (18, 19) and control unit (21). The memory (6) can be implemented both as part of the SoC (1) and be external to it, which does not affect the achievement of the technical result.

The central processor (2) is connected to the SD (9) with the internal switching unit (3), as well as the configuration interface (10) with the direct memory access controller (4) and the control unit (21).

The internal switching unit (3) is connected to the SD (11, 12) with the direct memory access controller, as well as the SD (20) and SD (24) to the memory access controller (5) and the external interface controller (22), respectively. The memory access controller (5) is connected to the memory (6), and the external interface controller (22) is connected via the multiplexed data bus (25) to the multiplexing unit (23), which also receives signals from the control unit (21) via the unit control bus multiplexing (26) and has multiplexed external interface buses (28.1…28.M) coming to the SNC output (1).

The computing module (8) is interconnected with RON TZ (17), RON KSh (18, 19), control unit (21) and receives signals from the internal switching unit through SD (13) and pseudo-random number generator (15).

The control unit (21) sends signals to RON TZ (17), RON KSh (18, 19), through SD (14) to the internal switching unit (4) and is interconnected with the timer (16).

Option 2 differs from Option 1 in the following ways:

1. There is no multiplexing unit and associated multiplexed data bus, multiplexing unit control bus, multiplexed external interface buses.

2. A common data bus of the external interface (27) has been introduced, which is fed from the external interface controller (22) to the output of the SoC (1).

Option 3 combines Options 1 and 2, and differs from Option 1 in that a common external interface data bus (27) is additionally introduced, which is fed from the external interface controller (22) to the SoC output (1).

The principle of operation of a symmetric data encryption device using a strong authentication algorithm.

Encryption device (7) operates in simple replacement mode. The data for transmission/reception via the external interface is stored in memory (6) and comes from it to the encryption device and in the opposite direction in blocks of 64 bits each. Thus, memory (6) plays the role of an external interface data buffer.

Data for encryption and encryption results are transmitted between the internal switching unit (3), the direct memory access controller (4) and the computing device (8) via internal buses (11), (12), (13), (14), (20 ) packets consisting of frames equal in size to the block of processed data (64 bits).

The internal switching unit (3) transmits data to the direct memory access controller (4) and receives them from it. To eliminate delays when working with external memory, data can be accumulated in the controller's built-in buffers (4).

The computing module (8) is used to implement the basic encryption cycle. The keys are stored in internal registers (18), (19) of the encryption device (7).

The process for implementing strong hardware authentication is as follows:

1) The secret key of the group "control device - actuators" K _{0 ... 511} is loaded into registers (18), (19), while the personal key of the information transfer initiator K _l \u003d K _{0 ... 255} is stored in register (18), and information receiver key Ko=K _256…511 - in register (19).

2) USSD implemented on SoC (1) and acting as a control unit (CU) is shown in Fig. 1 as (1) and in FIG. 2, Fig. 3 as (1.1…1.K). Because several such SoCs are used, the CU creates a non-repeating marker (random number) using a pseudo-random number generator (15), starts a timer (16), sends a message to the executive device (2.1... 2.N) or (2.1…2.M) formed according to the following law:

Xl_mast (№_sl, Xo_sl(CH_mast_N, Data)),

where Xl_mast(x) - encryption of information x using the private key of the information transfer initiator (control device) Kl=K _0…255 ;

Xo_sl(x) - encryption of information x using the private key of the information receiver (executive device) Ko=K _256…511 ;

№_sl - number of information receiver;

CH_mast-N - random number (non-repeating marker) generated by the initiator of the transfer, necessary for strong authentication during the exchange;

Data - data to be transferred.

3) The monitoring and control unit (CCU), which is the SOC (1) as an executive device, in Fig. 1 and FIG. 2 and FIG. 3 is shown as (2.1…2.N) for options with a common data bus and (2.1…2.M) for options with multiplexed data buses. The BCU decrypts the received data using the transmission initiator key Kl=K _0...255 and the information receiver key Kо=K _256...511 .

The authentication procedure continues only with the IM whose number #_sl corresponds to that specified in the message from the CU, and only such IM is able to decrypt CC_mast_N and Data.

4) BCU (2.1…2.N) or (2.1…2.M) creates a non-repeating marker (random number), starts the timer (16) of the BCU and sends a response, forming it according to the formula:

Xl_sl(№_mast, Xo_mast (Response, CH_mast_N, CH_sl_N)),

where Xl_sl(x) - encryption of information x using the private key of the information transfer initiator Kl=K _0…255 ;

Xo_mast(x) - encryption of information x using the key of the information receiver (control device) Kl=K _256…511 ;

№_mast - number of information transfer initiator;

Response - error code for receiving an order;

MF_ mast-N - random number (non-repeating marker) received from the initiator of the transfer;

CH_sl-N is a random number generated by the recipient of information (BCU) (2.1) or ... (2.N) and necessary for strong authentication during the exchange.

5) CU (1.1…1.K) decrypts the received message using the private key of the transmission initiator Kl=K _0…255 and then using the key of the information receiver, while comparing the received marker CC_mast-N with the created one. If they match, the authentication procedure continues according to clause 6, otherwise the actions are unauthorized, the authentication procedure is interrupted.

6) CU (1) sends an acknowledgment over the communication channel, formed as follows

Xl_mast (№_sl, MF_ sl_N).

7) BCU (2.1…2.N) or (2.1…2.M) decrypts the received data using the private key of the initiator of the transfer Kl=K _0…255 , compares the received marker MF_sl_N with the created one and, if they match, performs permitted actions with the data obtained in item 3.

The claimed device for symmetric data encryption using a strong authentication algorithm, operating as part of the system (Fig. 1, Fig. 2 or Fig. 3) and allowing to perform the strong authentication procedure in accordance with GOST R ISO / IEC 9594-8-98, using the algorithm cryptographic transformation GOST 28147-89 in the simple replacement mode instead of the RSA cryptosystem, which allows you to speed up the authentication process and to a greater extent protect the data transmitted over the channel in systems built according to the schemes of Fig. 1, Fig. 2, Fig. 3 includes an encryption device (7) that performs the encryption procedure, data decryption during the authentication process, a pseudo-random number generator (15) that creates a non-repeating message marker (number) for three steps of the strong authentication procedure (made in the form of a combinational circuit), a timer (16), limiting the waiting time when performing the data encryption / decryption procedure, (made in the form of a specialized microcircuit), external or internal with respect to the encryption device (7) storage device (6) with an access controller (5), which is a buffer for storage encrypted data transmitted over the channel, which guarantees the impossibility of extracting useful information and allows you to protect the system from unauthorized access to data (performed in the form of static RAM), a general-purpose central processing unit (2) executing the main program of the device (can be performed on a microprocessor chip) , internal switching unit (3), providing data exchange between system elements (made in the form of a combinational circuit), an external interface controller (22), organizing a data transfer interface for exchanging with external devices via a common (27) or multiplexed (25) bus (made in the form of specialized microcircuits), a block bus multiplexing (23) of the external data interface, switching the serial bus (25) to several multiplexed serial data buses (28.1), (28.2), ..., (28.M) (performed in the form of a combinational circuit with optoelectronic isolation). The common bus (27) can be made according to the CAN or RS-485 standard, the multiplexed one - according to the RS-232 standard. The memory access controller (5) may be integrated into the central processing unit (2).

The possibility of using two encryption keys and carrying out a strong authentication procedure in accordance with GOST R ISO / IEC 9594-8-98 is provided by: a central processor (2), a computing module (8), a pseudo-random number generator (15), a timer (16), RON TZ ( 17), RON KSh (18, 19), as well as an external interface controller (22) and/or a multiplexing unit (23), depending on the SoC variant.

The encryption device (7) includes a controller (4) for direct memory access (6), which ensures the transmission of encrypted data received via the bus (24) and stored in memory (6) (performed in the form of a specialized microcircuit), as well as the transmission of encrypted data from the encryption device to memory (6) at each stage of strong authentication, a computing module (8) that implements the GOST 28147-89 cryptographic conversion algorithm in the simple replacement mode and generates encrypted data packets for authentication, control registers (17) (512 bits) , into which the substitution table is loaded, register (18), into which the personal key of the information transfer initiator is loaded Kl=K _{0 ... 255} (256 bits), register (19), into which the common key of the information receiver is loaded Ko = K _{256 ... 511} , control unit (21) for synchronizing the operation of blocks of the encryption device (7), as well as selecting the current bus for sending an encrypted message of strong authentication (implemented in the form of a some automaton).

The device can be implemented in three versions: SoC with only multiplexed data transmission buses (Fig. 4), SoC with only a common data transmission bus (Fig. 5), SoC with a combination of multiplexed and common data transmission buses (Fig. 6), with this OCU is implemented according to the architecture of Fig. 4 (with the front-end bus multiplexer (23) missing) or the architecture of FIG. 5.

Commands (data) generated by the control device come from the internal registers of the processor (2) via buses (9), (12), (13) to the computing module (8), where messages are generated in the format described above, they are encrypted according to the GOST algorithm 28147-89 in easy swap mode. Encrypted messages arrive via buses (14), (20) into memory (6), from where they are transmitted via an external interface controller via one of the data transmission channels to BCU 2.1 or 2.N, depending on the required information receiver (BCU number) specified in message. In this case, the central processor (2) generates control signals for the internal switching unit (3), the direct memory access controller (4), as well as the control unit (21) of the encryption device (7) (via the configuration interface (10)), which determine the direction of transmission : to encryption device (7), from encryption device (7) to memory (6). The control unit (21) of the encryption device (7) sets signals to start the timer (16), start the encryption/decryption cycle, extract a random number from the pseudo-random number generation unit (15), reset the circuit to its initial state in case of receipt from the timer (16 ) overflow signal when waiting for a response message for a long time, and also sets the signal for selecting the current data transfer bus (27), (28.1), (28.2), ... or (28.M) via the configuration interface (26). The response (incoming) message arriving via the external bus 27, 28.1, 28.2, ... or 28.M by means of the external interface controller (22) to the memory (6) is transferred to the encryption device (7), where the message is decrypted according to the GOST 28147 algorithm -89, the formation of a response message (when a random number matches), its encryption and sending over a communication channel according to the procedure described above.

Thus, a device for symmetric data encryption using a strong authentication algorithm according to GOST 28147-89 is declared, implemented in the form of a SoC (1), including a central processor (2), interconnected with an internal switching unit (3) and also transmitting a signal to the control unit (21) and a direct memory access controller (4), which is interconnected with the internal switching unit (3) and transmits a signal to the computing module (8), the memory access controller (5) is interconnected with the internal switching unit (3) and memory ( 6), a computing module (8) with the ability to implement data encryption in accordance with the cryptographic conversion algorithm, interconnected with RON TK (17) and RON KSh (18), control unit (21) receiving a signal from the computing module (8) and transmitting signals to RON TZ (17) and RON KSh (18), while the device operates in accordance with GOST R ISO / IEC 9594-8-98, the external interface controller (22) and the multiplexing unit (2 3), the encryption device (7) also includes a pseudo-random number generator (15), an additional RON KSh (19) and a timer (16) interconnected with the control unit (21), which is connected via the control bus to the multiplexing unit (23) and connected to RON KSh (19) and a computing module (8), which is interconnected with RON KSh (19) and receives a signal from a pseudo-random number generator (15); the external interface controller (22) is connected to the internal switching unit (3), the multiplexing unit (23), which switches the multiplexed data bus connecting the external interface controller (22) to the multiplexing unit (23), as well as the multiplexed buses at the output of the multiplexing unit ( 23); as RAM, static memory is used, which stores only data encrypted in accordance with GOST 28147-89.

There are also options for a symmetric data encryption device using a strong authentication algorithm:

- with the inclusion of a common data bus at the output of the external interface controller.

- with the exception of the multiplexing unit and the multiplexed data bus associated with it, the control bus of the multiplexing unit and the multiplexed buses of the external interface, with the inclusion of a common data bus at the output of the external interface controller.

The technical result of the invention is a device capable of performing strong authentication according to GOST R ISO/IEC 9594-8-98 between subscribers and using two keys in the encryption procedure according to GOST 28147-89.

Claims (49)

1. A symmetric data encryption device (USSD), implemented as a system on a chip (SoC), including a central processor (2), an internal switching unit (3), an external interface controller (22), a multiplexing unit (23) and a device encryption (7), which includes: a direct memory access controller (4), a computing module (8), a pseudo-random number generator (15), a timer (16), a general-purpose register for storing a replacement table (RON TZ) (17 ), a general-purpose register for storing secret encryption keys (RON KSh) (18), an additional RON KSh (19) and a control unit (21); wherein the central processor (2) is connected by a data bus (SD) (9) with an internal switching unit (3), as well as a configuration interface (10) with a direct memory access controller (4) and a control unit; the internal switching unit (3) is connected by data buses (11), (12) to the direct memory access controller (4), as well as by data buses (20), (24) to the memory access controller (5) and the external interface controller ( 22); the memory access controller (5) is connected to the memory (6), and the external interface controller (22) is connected via the multiplexed data bus (25) to the multiplexing unit (23), which also receives signals from the control unit (21) via the unit control bus multiplexing (26) and has multiplexed external interface buses (28.1…28.M) coming to the SNC output (1); the computing module (8) is interconnected with RON TK (17), RON KSh (18) and additional RON KSh (19), control unit (21) and receives signals from the direct memory access controller through SD (13) and a pseudo-random number generator ( 15); the control unit (21) sends signals to RON TK (17), RON KSh (18) and additional RON KSh (19) through SD (14) to the direct memory access controller (4) and is interconnected with the timer (16); the encryption device (7) operates in the simple replacement mode, the data for transmission / reception via the external interface is stored in the memory (6) and comes from it to the encryption device and in the opposite direction in blocks of 64 bits each, thus the memory (6) plays the role external interface data buffer; data for encryption and encryption results are transmitted between the internal switching unit (3), the direct memory access controller (4) and the computing module (8) via internal buses in packets consisting of frames equal in size to the block of data being processed; the internal switching unit (3) transmits data to the direct memory access controller (4) and receives them from it; computing module (8), used to implement the basic encryption cycle; at the same time, the encryption device (7) performs the encryption procedure, data decryption during the authentication process, the pseudo-random number generator (15) creates a non-repeating message marker, which is a random number, the timer (16) limits the waiting time when performing the data encryption / decryption procedure, external or the storage device (6) internal to the encryption device (7) is a buffer for storing encrypted data transmitted over the channel, the external interface controller (22) organizes a data transfer interface for exchange with external devices, the bus multiplexing unit (23) of the external interface data transfer switches the serial bus (25) to several multiplexed serial data buses (28.1), (28.2), ..., (28.M); the computing module (8) implements the GOST 28147-89 cryptographic conversion algorithm in the simple replacement mode and generates encrypted data packets for authentication, the replacement table is loaded into the RON TZ (17), the control unit (21) ensures the synchronization of the operation of the encryption device blocks (7), as well as choosing the current bus for sending an encrypted strong authentication message; at the same time, in a control system containing symmetric data encryption devices implemented on the SoC (1) and acting as control devices, and monitoring and control units (CCU), which are symmetric data encryption devices implemented on the SoC (1), in the role of executive devices (ED), strong authentication is carried out as follows: 1) the secret key of the group "control device - actuators" K0 ... 511 is loaded into the register RON KSh (18) and additional RON KSh (19), while the personal key of the initiator of information transfer Kl = K0 ... 255 is stored in RON KSh (18) , and the key of the information receiver Ko=256...511 - in the additional RON KSh (19); 2) USSD, implemented on the SoC (1) and acting as a control device (CU) (1.1 ... 1.K), creates a non-repeating marker, which is a random number, using a pseudo-random number generator (15), starts the timer (16) , sends a message to the executive device via multiplexed buses (28.1 ... 28.M), formed according to the following law: Xl_mast(_sl, Xo_sl(CH_mast_N, Data)), where Xl_mast(x) - encryption of information x using the private key of the information transfer initiator, which is the control device, Kl=K0...255; Xo_sl(x) - encryption of information x using the private key of the information receiver, which is the executive device, Ko=K256...511; _sl - number of information receiver; CC_mast_N - a non-repeating token generated by the initiator of the transfer, necessary for strong authentication during the exchange; Data - data to be transmitted; 3) BCU decrypts the received data using the transmission initiator key Kl=K0...255 and the information receiver key Ko=K256...511; the authentication procedure continues only with the IM whose _sl number corresponds to that specified in the message from the CU, and only such IM is able to decrypt CC_mast_N and Data; 4) BCU creates a non-repeating marker, which is a random number, starts the timer (16) of the BCU and sends a response, forming it according to the formula: Xn_sl(_mast, Xo_mast(Response, MF_mast_N, MF_sl_N)), where Xn_sl(x) - encryption of information x using the private key of the information transfer initiator Kl=K0...255; Xo_mast(x) - encryption of information x using the key of the information receiver Ko=K256…511; _mast - number of information transfer initiator; Response - error code for receiving an order; CH_mast_N - non-repeating token received from the transfer initiator; СЧ_sl_N - a non-repeating marker generated by the recipient of information (BCU) and required for strong authentication during the exchange; 5) CU (1.1 ... 1.K) decrypts the received message using the private key of the initiator of the transmission Kl = K0 ... 255 and then using the key of the information receiver, while comparing the received marker CC_mast_N with the created one, if they match, the authentication procedure continues according to paragraph 6 ), otherwise the actions are unauthorized, the authentication procedure is interrupted; 6) CU (1) sends an acknowledgment via the communication channel, formed as follows: chl_mast (_sl, CH_sl_N); 7) BCU decrypts the received data using the private key of the initiator of the transmission Kl=K0...255, compares the received marker CC_sl_N with the created one, and if they match, performs permitted actions with the data received in paragraph 3); at the same time, the commands and data generated by the control device come from the internal registers of the processor (2) via buses to the computing module (8), where messages are generated in the format described above, they are encrypted according to the GOST 28147-89 algorithm in the simple replacement mode; encrypted messages arrive via buses to the memory (6), from where, by means of the external interface controller (22), they are transmitted via one of the data transmission channels to the BCU (2.1 ... 2.M), depending on the required information receiver specified in the message; at the same time, the central processor (2) generates control signals for the internal switching unit (3), the direct memory access controller (4), as well as the control unit (21) of the encryption device (7) via the configuration interface (10), which determine the transmission direction: in encryption device (7), from encryption device (7) to memory (6); the control unit (21) of the encryption device (7) sets signals to start the timer (16), start the encryption / decryption cycle, extract a random number from the pseudo-random number generator (15), reset the circuit to its initial state in case of receipt from the timer (16) overflow signal when waiting for a response message for a long time, and also sets the signal for selecting the current data transfer bus via the configuration interface (26); the incoming response message arriving via the external bus through the external interface controller (22) to the memory (6) is transferred to the encryption device (7), where the message is decrypted according to the GOST 28147-89 algorithm, the response message is formed when a random number matches, and it is encrypted and sending over a communication channel. 2. The device according to claim 1, characterized in that it includes a common data bus of the external interface (27) at the output of the external interface controller (22); at the same time, USSHD, acting as a control device (1.1 ... 1.K), additionally sends a message to the executive device (2.1 ... 2.N) via the common data bus of the external interface (27). 3. A symmetric data encryption device (USSD), implemented as a system on a chip (SoC), including a central processor (2), an internal switching unit (3), an external interface controller (22) and an encryption device (7), in which includes: a direct memory access controller (4), a computing module (8), a pseudo-random number generator (15), a timer (16), a general-purpose register for storing a replacement table (RON TZ) (17), a general-purpose register for storage of secret encryption keys (RON KSh) (18), additional RON KSh (19) and control unit (21); wherein the central processor (2) is connected by a data bus (SD) (9) with an internal switching unit (3), as well as a configuration interface (10) with a direct memory access controller (4) and a control unit; the internal switching unit (3) is connected by data buses (11), (12) to the direct memory access controller (4), as well as by data buses (20), (24) to the memory access controller (5) and the external interface controller ( 22); the memory access controller (5) is connected to the memory (6), and the external interface controller (22) sends the common data bus of the external interface (7) to the output of the SoC (1); the computing module (8) is interconnected with RON TZ (17), RON KSh (18) and additional RON KSh (19), control unit (21) and receives signals from the direct memory access controller through NTD (13) and a pseudo-random number generator ( 15); the control unit (21) sends signals to RON TK (17), RON KSh (18) and additional RON KSh (19) through SD (14) to the direct memory access controller (4) and is interconnected with the timer (16); the encryption device (7) operates in the simple replacement mode, the data for transmission / reception via the external interface is stored in the memory (6) and comes from it to the encryption device and in the opposite direction in blocks of 64 bits each, thus the memory (6) plays the role external interface data buffer; data for encryption and encryption results are transmitted between the internal switching unit (3), the direct memory access controller (4) and the computing module (8) via internal buses in packets consisting of frames equal in size to the block of data being processed; the internal switching unit (3) transmits data to the direct memory access controller (4) and receives them from it; computing module (8), used to implement the basic encryption cycle; at the same time, the encryption device (7) performs the encryption procedure, data decryption during the authentication process, the pseudo-random number generator (15) creates a non-repeating message marker, which is a random number, the timer (16) limits the waiting time when performing the data encryption / decryption procedure, external or the storage device (6) internal to the encryption device (7) is a buffer for storing encrypted data transmitted over the channel, the external interface controller (22) organizes a data transfer interface for exchanging with external devices via a common external interface data bus (27) ; the computing module (8) implements the GOST 28147-89 cryptographic conversion algorithm in the simple replacement mode and generates encrypted data packets for authentication, the replacement table is loaded into the RON TZ (17), the control unit (21) ensures the synchronization of the operation of the encryption device blocks (7), as well as choosing the current bus for sending an encrypted strong authentication message; at the same time, in a control system containing symmetric data encryption devices implemented on the SoC (1) and acting as control devices, and monitoring and control units (CCU), which are symmetric data encryption devices implemented on the SoC (1), in the role of executive devices (ED), strong authentication is carried out as follows: 1) the secret key of the group "control device - actuators" K0 ... 511 is loaded into the register RON KSh (18) and additional RON KSh (19), while the personal key of the initiator of information transfer Kl = K0 ... 255 is stored in RON KSh (18) , and the key of the information receiver Ko=256...511 - in the additional RON KSh (19); 2) USSD, implemented on the SoC (1) and acting as a control device (CU) (1.1 ... 1.K), creates a non-repeating marker, which is a random number, using a pseudo-random number generator (15), starts the timer (16) , sends a message to the executive device via the common data bus of the external interface (27), formed according to the following law: Xl_mast(_sl, Xo_sl(CH_mast_N, Data)), where Xl_mast(x) - encryption of information x using the private key of the information transfer initiator, which is the control device, Kl=K0...255; Xo_sl(x) - encryption of information x using the private key of the information receiver, which is the executive device, Ko=K256...511; _sl - number of information receiver; CC_mast_N - a non-repeating token generated by the initiator of the transfer, necessary for strong authentication during the exchange; Data - data to be transmitted; 3) BCU decrypts the received data using the transmission initiator key Kl=K0...255 and the information receiver key Ko=K256...511; the authentication procedure continues only with the IM whose _sl number corresponds to that specified in the message from the CU, and only such IM is able to decrypt MF_mast_N and Data; 4) BCU creates a non-repeating marker, which is a random number, starts the timer (16) of the BCU and sends a response, forming it according to the formula: Xl_sl(_mast, Xo_mast (Response, CH_mast_N, CH_sl_N)), where Xl_sl(x) - encryption of information x using the private key of the information transfer initiator Kl=K0...255; Xo_mast(x) - encryption of information x using the key of the information receiver Ko=K256…511; _mast - number of information transfer initiator; Response - error code for receiving an order; CH_mast_N - non-repeating token received from the transfer initiator; СЧ_sl_N - a non-repeating marker generated by the recipient of information (BCU) and required for strong authentication during the exchange; 5) CU (1.1 ... 1.K) decrypts the received message using the private key of the initiator of the transmission Kl = K0 ... 255 and then using the key of the information receiver, while comparing the received marker CC_mast_N with the created one, if they match, the authentication procedure continues according to paragraph 6 ), otherwise the actions are unauthorized, the authentication procedure is interrupted; 6) CU (1) sends an acknowledgment via the communication channel, formed as follows: chl_mast (_sl, CH_sl_N); 7) BCU decrypts the received data using the private key of the initiator of the transmission Kl=K0...255, compares the received marker CC_sl_N with the created one, and if they match, performs permitted actions with the data received in paragraph 3); at the same time, the commands and data generated by the control device come from the internal registers of the processor (2) via buses to the computing module (8), where messages are generated in the format described above, they are encrypted according to the GOST 28147-89 algorithm in the simple replacement mode; encrypted messages arrive via buses to the memory (6), from where, by means of the external interface controller (22), they are transmitted via the common data bus of the external interface to the BCU (2.1 ... 2.N), depending on the required information receiver specified in the message; at the same time, the central processor (2) generates control signals for the internal switching unit (3), the direct memory access controller (4), as well as the control unit (21) of the encryption device (7) via the configuration interface (10), which determine the transmission direction: in encryption device (7), from encryption device (7) to memory (6); the control unit (21) of the encryption device (7) sets signals to start the timer (16), start the encryption / decryption cycle, extract a random number from the pseudo-random number generator (15), reset the circuit to its initial state in case of receipt from the timer (16) overflow signal when waiting for a response message for a long time; the incoming response message arriving via the external bus through the external interface controller (22) to the memory (6) is transferred to the encryption device (7), where the message is decrypted according to the GOST 28147-89 algorithm, the response message is formed when a random number matches, and it is encrypted and sending over a communication channel.

Images