TWI608381B - Encryption/decryption apparatus and power analysis protecting method thereof - Google Patents

Description

Encryption and decryption device and power analysis and defense method thereof

The present invention relates to an encryption and decryption technique, and more particularly to an encryption and decryption apparatus capable of defending against a power analysis attack and a power analysis and defense method thereof.

Encryption and decryption techniques are commonly used to confirm the security of message transmission. In a general encryption technique, a message (ie, plain text) is first encrypted on a transmitting end, and a message (ie, cipher text) is decrypted at a receiving end (decrypted). ) or decoded (decoded). Encryption or decryption of messages like this is a well-known encryption and decryption technique.

The encryption and decryption algorithm is widely used in wireless communication systems such as wireless local area networks, near field communication, data storage systems and banking systems, but there are also malicious means to crack them. Side-channel attack refers to the behavior of cracking the encryption and decryption system by analyzing the physical analysis and implementation of the system. For example, information such as power consumption, electromagnetic waves, time difference, etc. in the encryption and decryption system may provide information that is helpful for cracking the system.

The differential power analysis attack method is to use the power information leaked on the channel during hardware addition and decryption to derive a secret key. The differential power analysis attack can compile the power consumption (power signal) of the device by, for example, measuring a password, or a smart card, for example, drawing power from the outside, wherein the current consumption of the smart card can depend on the gate switching determined by the operation being performed. . The hacker can monitor the power consumption of the smart card and use statistical information to infer information about sensitive data while manipulating it. Therefore, how to effectively defend against power analysis attacks is one of the focuses of the technical field.

The invention provides an encryption and decryption device and a power analysis and defense method thereof, which can effectively defend against power analysis attacks without affecting the speed and performance of the encryption and decryption operation.

The encryption and decryption device of the present invention is suitable for performing encryption and decryption operations on digital data, including a data encryption and decryption unit, a random number generator, and a power analysis and defense circuit. The data encryption and decryption unit receives the digital data, and performs encryption and decryption operations on the digital data. The random number generator is used to generate random data, the random data has N bits, and N is a positive integer. The power analysis and defense circuit generates M different power signals according to the metadata in the random data when the random data is received, and M is the Nth power of 2.

In an embodiment of the invention, when the data encryption/decryption unit does not perform the encryption and decryption operation, the encryption and decryption device controls the random number generator to disable, so that the power analysis defense circuit stops operating.

The power analysis and defense method of the present invention is applicable to an encryption and decryption device. The method comprises: generating random data, the random data has N bits, N is a positive integer; and starting the power analysis and defense circuit according to the random data, so that the power analysis and defense circuit is based on the random data when receiving the random data. M different kinds of power signals are generated for each meta-data, and M is 2 N powers.

Based on the above, the encryption/decryption apparatus of the present invention can dynamically change the power consumption (power signal) generated during the encryption/decryption operation for each clock cycle by using the fluctuation of the random number data, thereby making it difficult for the attacker to rely on the power. Consumption to derive information about sensitive data (such as keys, etc.). Furthermore, the power analysis and defense circuit is configured independently of the data encryption and decryption unit to avoid affecting the speed and performance of the encryption and decryption operation, and can appropriately stop the operation of the power analysis and defense circuit according to the execution of the encryption/decryption operation, and reduce the operation. Necessary power consumption.

The above described features and advantages of the invention will be apparent from the following description.

First, please refer to FIG. 1. FIG. 1 is a schematic diagram of an encryption and decryption apparatus according to an embodiment of the present invention. In this embodiment, the encryption and decryption device 100 can be, for example, a cryptographic chip, including a data encryption and decryption unit 110, a random number generator 120, and a power analysis defense circuit 130. When the digital data D1 is input to the encryption/decryption apparatus 100, the data encryption/decryption unit 110 can receive the digital data D1 and perform encryption and decryption operations on the digital data D1. The encryption and decryption operation here is, for example, an operation conforming to an encryption standard such as a data encryption standard (DES), a 3-DES, or an Advanced Encryption Standard (AES). The data encryption/decryption unit 110 generates a power signal SP1 in the process of the encryption and decryption operation.

For example, FIG. 2 is a schematic diagram of a data encryption and decryption unit according to an embodiment of the present invention. In FIG. 2, the data encryption/decryption unit 110 includes a logical operation unit 200 and a storage unit 210. The logic operation unit 200 can receive the key K1 and the digital data D1, and perform logical operations on the digital data D1 according to the key K1, and can replace the digital data D1 by using the digital data replacement table stored in the storage unit 210. Perform encryption and decryption operations. It should be noted that the structure and operation of the above data encryption and decryption unit are merely exemplary embodiments, and the present invention is not limited thereto.

Returning to Figure 1, the random number generator 120 can be used to generate different hash data D2 at each clock cycle. The random number data D2 is, for example, a real random number data, and each random number data D2 has N bits (N is a positive integer). The power analysis defense circuit 130 is coupled to the random number generator 120 and can receive the random number data D2 from the random number generator 120. The power analysis and defense circuit 130 can generate M different sizes of power signals SP2 according to the bit data in the random number data D2 when receiving the random number data D2 (M is equal to ). Among them, the size of N depends on the actual demand / decision, the greater the N, the higher the defense reliability for power analysis attacks, but the higher the cost.

When the attacker performs the power consumption measurement on the encryption/decryption device 100 of the embodiment, the measured power signal SP3 is the sum of the power signal SP1 and the power signal SP2, so the power signal SP3 in each clock cycle. Also mixed Different size changes, which makes it difficult for an attacker to use power consumption to derive information about sensitive data (such as keys, etc.).

For example, FIG. 3 is a schematic diagram of a power analysis and defense circuit according to an embodiment of the present invention. In FIG. 3, the power analysis and defense circuit 130 may include N power signal generators 300_1 300 300_N, and each power signal generator 300_1 300 300_N receives each bit data D2_1 D D2_N of the random data D2, respectively, and may generate Power signals at different power levels. Taking the power signal generator 300_1 as an example, when the received bit data D2_1 is logic 0, the power signal generator 300_1 can stop operating without generating any power signal. When the received bit data D2_1 is logic 1, the power signal generator 300_1 can generate a power signal of a specific size (ie, unit power UPx1).

The power signals generated by the power signal generators 300_1~300_N have a certain proportional relationship. In detail, the power signals generated by the power signal generators 300_1 300 300_N can be set to multiply the unit power UP by a power of two. That is, the power signal (unit power UPx2) generated by the power signal generator 300_2 may be twice as large as the power signal (unit power UPx1) generated by the power signal generator 300_1, and is used as the nth power signal generator. The power signal generated by 300_n can be unit power UP Multiple (n is a positive integer and 1≦n≦N). In other words, each of the power signal generators 300_1~300_N in the power analysis and defense circuit 130 can determine whether to be activated according to whether the received bit data D2_1~D2_N is logic 0 or logic 1, respectively, and generate respective when activated. Power signal at a specific power level. In addition, when the data encryption/decryption unit 110 does not perform the encryption and decryption operation, the encryption/decryption device 100 can control the random number generator 120 to be disabled, for example, by disabling the signal, so that each of the power signal generators 300_1~300_N is not activated. The power analysis defense circuit 130 is stopped to reduce unnecessary power consumption.

To further illustrate the present embodiment, Table (1) below describes the startup situation of the power signal generators 300_1 300 300_3 in the power analysis defense circuit 130 when N is equal to 3 and the generated power signal SP2. Table 1)         <TABLE border="1" borderColor="#000000" width="85%"><TBODY><tr><td> Random data D2 (D2_3, D2_2, D2_1) </td><td> Power of startup Signal Generator</td><td> Power Signal SP2 </td></tr><tr><td> 000 </td><td> None</td><td> 0 </td></ Tr><tr><td> 001 </td><td> 300_1 </td><td> Unit Power UPx1 </td></tr><tr><td> 010 </td><td> 300_2 </td><td> Unit Power UPx2 </td></tr><tr><td> 011 </td><td> 300_1, 300_2 </td><td> Unit Power UPx3 </td>< /tr><tr><td> 100 </td><td> 300_3 </td><td> Unit Power UPx4 </td></tr><tr><td> 101 </td><td> 300_1, 300_3 </td><td> Unit Power UPx5 </td></tr><tr><td> 110 </td><td> 300_2, 300_3 </td><td> Unit Power UPx6 </ Td></tr><tr><td> 111 </td><td> 300_1, 300_2, 300_3 </td><td> Unit Power UPx7 </td></tr></TBODY></TABLE >

As can be seen from the table (1), the power analysis defense circuit 130 can generate 8 according to the 3-bit random data D2 ( A power signal SP2 of different size combinations. By analogy, the power analysis defense circuit 130 can generate the N-bit random data D2 in each clock cycle. A power signal SP2 of different size combinations.

It should be noted that, in this embodiment, the random number generator 120 and the power analysis and defense circuit 130 in the encryption and decryption apparatus 100 are completely independent from the data encryption and decryption unit 110, so that the data encryption/decryption unit 110 can be avoided. Speed and performance. From another point of view, the random number generator 120 and the power analysis and defense circuit 130 of the present embodiment are applicable to integration in any kind of encryption and decryption apparatus, and have high portability.

FIG. 4 is a diagram showing the relationship between the probability and the power level in the analysis and defense circuit according to an embodiment of the invention. The horizontal axis of FIG. 4 is the power level of the power signal SP2 generated by the analysis defense circuit 130, and the vertical axis is the probability of the power level. When the analysis defense circuit 130 is triggered to be triggered by the random data D2, as shown in FIG. 4, the analysis defense circuit 130 can generate Power level of different size combinations (ie 0, UP~ UP), and the probability of generating each power level is .

Please refer to FIG. 5. FIG. 5 is a schematic diagram of an embodiment of a power signal generator according to an embodiment of the present invention. The power signal generators 300_1 300 300_N may employ, for example, a structure of a ring oscillator. As shown in FIG. 5, the power signal generator 300_1 can be included as an example, and may include a ring oscillator 500. The ring oscillator 500 can include an inverse gate 510, a first inverter 520, and a second inverter 530. The first input end of the inverse gate 510 receives one of the bit data D2_1 corresponding to the random number data D2. The input end of the first inverter 520 is coupled to the output of the anti-gate 510. The input end of the second inverter 530 is coupled to the output end of the first inverter 520, and the output end of the second inverter 530 is coupled to the second input end of the anti-gate. The ring oscillator 500 can generate a power signal of unit power UP through the trigger of the bit data D2_1.

On the other hand, the power signal generated by the power signal generator 300_2 is twice as large as the power signal generated by the power signal generator 300_1. Therefore, the power signal generator 300_2 may include two ring oscillators 500. The two ring oscillators 500 are connected to each other in parallel with the bit data D2_1 to generate a power signal of two unit powers UP through the trigger of the bit data D2_1. By analogy, the nth power signal generator 300_n (n is a positive integer, and 1≦n≦N) may include a ring oscillator 500 connected in parallel with each other to generate Power signal of unit power UP.

In addition, the random number generator 120 can also be, for example, a ring oscillator based random number generator. If the random number generator 120 and the power analysis and defense circuit 130 are mainly composed of a ring type oscillator, the design on the process can be facilitated to reduce the cost.

FIG. 6 is a flow chart of a power analysis and defense method according to an embodiment of the present invention. The power analysis and defense method of the embodiment of the present invention is applicable to the encryption and decryption apparatus 100 of FIG. Referring to FIG. 1 and FIG. 6 simultaneously, when the encryption/decryption apparatus 100 performs the encryption/decryption operation, the random number generator 120 generates the random number data D2 in step S610. The random number data D2 has N bits, and N is a positive integer. In step S620, the encryption/decryption apparatus 100 starts the power analysis and defense circuit 130 according to the random number data D2, so that the power analysis and defense circuit 130 generates the random data D2 according to the metadata D2_1~D2_N in the random number data D2. M power signals of different sizes, M is the Nth power of 2.

In addition, in the above-mentioned FIG. 6, the implementation details of the execution steps of the power analysis defense method are described in detail in the foregoing various embodiments and various embodiments, and will not be further described below.

In summary, the encryption and decryption apparatus and the power analysis and defense method thereof of the present invention can utilize the fluctuation of the random number data to mix power consumption of different power levels in each clock cycle, thereby making it difficult for an attacker to rely on the power. Consumption to derive information about sensitive data (such as keys, etc.). Structurally configuring the power analysis defense circuit independently of the data encryption and decryption unit can avoid affecting the speed and performance of the encryption and decryption operation, and the invention also has the function of appropriately stopping the power analysis and defense circuit when not in use to reduce unnecessary The function of power consumption.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention, and any one of ordinary skill in the art can make some changes and refinements without departing from the spirit and scope of the present invention. The scope of the invention is defined by the scope of the appended claims.

100: encryption and decryption device 110: data encryption and decryption unit 120: random number generator 130: power analysis defense circuit 200: logic operation unit 210: storage unit 300_1~300_N: power signal generator 500: ring oscillator 510: anti-gate 520: first inverter 530: second inverter D1: digital data D2: random data D2_1~D2_N: bit data K1: key SP1, SP2, SP3: power signal S610, S620: steps

FIG. 1 is a schematic diagram of an encryption and decryption apparatus according to an embodiment of the present invention. 2 is a schematic diagram of a data encryption and decryption unit according to an embodiment of the present invention. 3 is a schematic diagram of a power analysis and defense circuit according to an embodiment of the present invention. FIG. 4 is a diagram showing the relationship between the probability and the power level in the analysis and defense circuit according to an embodiment of the invention. FIG. 5 is a schematic diagram of a power signal generator according to an embodiment of the invention. FIG. 6 is a flow chart of a power analysis and defense method according to an embodiment of the present invention.

100: encryption and decryption device 110: data encryption and decryption unit 120: random number generator 130: power analysis and defense circuit D1: digital data D2: random data K1: key SP1, SP2, SP3: power signal

Claims (9)

An encryption and decryption device is adapted to perform encryption and decryption operations on a digital data, the encryption and decryption device comprising: a data encryption and decryption unit, receiving the digital data, and performing encryption and decryption operations on the digital data; a random number generator, To generate a random number of data, the random number data has N bits, N is a positive integer; and a power analysis defense circuit is coupled to the random number generator, and according to the random number data when receiving the random number data The power data of the different types of power is generated, and M is a power of 2 N, wherein the power analysis and defense circuit includes N power signal generators, and each of the power signal generators respectively receives the random data. The metadata of each element is used to generate power signals of different power levels. The encryption/decryption device of claim 1, wherein the encryption/decryption device controls the random number generator to disable when the data encryption/decryption unit does not perform an encryption/decryption operation, so that the power analysis defense circuit stops operating. The encryption and decryption device of claim 1, wherein the data encryption and decryption unit comprises: a logic operation unit, receiving a key and the digital data, and performing encryption and decryption operations on the digital data according to the key. The encryption/decryption device of claim 1, wherein the power signal generator stops operating when the received bit data is logic 0. The encryption and decryption device of claim 1, wherein the power signal generated by the nth power signal generator is 2 to 1 power of 2 unit power, wherein n is a positive integer, and 1 ≦n≦N. The encryption and decryption apparatus of claim 5, wherein the nth power signal generator comprises 2 n-1 power ring oscillators, and each of the ring oscillators generates a power signal of the unit power. . The encryption and decryption device of claim 6, wherein the ring oscillator comprises: a reverse gate, the first input end receiving one of the corresponding bit data in the random data; a first inversion The input end is coupled to the output of the anti-gate; and a second inverter having an input coupled to the output of the first inverter and an output coupled to the second of the anti-gate Input. A power analysis and defense method is applicable to an encryption and decryption device, and the method includes: generating a random number data, the random number data has N bits, and N is a positive integer; and starting a power analysis and defense circuit according to the random number data, The power analysis and defense circuit includes N power signal generators; and each of the power signal generators respectively receives the metadata of the random data and generates power signals of M different power levels, where M is 2. Nth power. The power analysis defense method according to claim 8, wherein the generation of the random number data is stopped when the encryption/decryption operation is not performed, so that the power analysis defense circuit stops operating.