WO2002086846A1

WO2002086846A1 - Enciphering / deciphering device, enciphering / deciphering method, data enciphering method, and ic card

Info

Publication number: WO2002086846A1
Application number: PCT/JP2002/002064
Authority: WO
Inventors: Masatoshi Takahashi
Original assignee: Renesas Technology Corp.; Hitachi Ulsi Systems Co., Ltd.
Priority date: 2001-04-16
Filing date: 2002-03-06
Publication date: 2002-10-31
Also published as: JP2002311826A; JP3844116B2

Abstract

A positive scramble signal processing in which either non-inverted data corresponding to processing unit data on plain or cipher text or the inverted data on all the bits are captured at random and is subjected to transposition/substitution corresponding to the non-inverted data and a negative scramble signal processing in witch the transposition/substitution corresponding to the inverted data is carried out are parallel conducted. The capturing either of the output signals corresponding to the respective processings in response to the data selection in the first signal processing is repeated a plurality of times, and the results of the final transposition/substitution are used as ciphered or deciphered data.

Description

Encryption / decryption device, encryption / decryption method, data encryption method, and Ic card

Technical field

The present invention relates to an encryption / decryption device, an encryption / decryption method, a data encryption method, and an IC card.

Using a cryptographic key including a CPU and memory like a chip microcomputer

It is related to technologies that perform data processing but are effective for security technology.

Background art

DES (Data Encryption Standard) is a widely used secret key block cipher. The DES algorithm can be roughly divided into plaintext data flow and key data flow. In the plaintext data flow, after transposition (replacement of signals) called IP, data is divided into upper and lower 3 bits each, and transposition and substitution processing is repeated 16 times. Integrating upper and lower respectively 3 2-bit data to the end, performs permutation called IP ^1, to obtain the ciphertext. With DES, encryption and decryption can be realized by the same process. However, key scheduling differs between encryption and decryption. The details of the key scheduling part are omitted, but 48-bit key scheduling data is output to each stage based on the key data.

The normal DES algorithm always performs the same internal operation on the same plaintext. As a result, since the internal signal changes depending on the input signal, D Easy statistical processing by PA (Diffrential Power Analysis) method. In other words, in the DPA method, the current consumption waveform is statistically processed to estimate the encryption key. I do. This process is repeated while changing the encryption key in various ways, and when the key is correct, the current waveform shows a large peak.

Japanese Patent Application Laid-Open No. 2000-066585 discloses an example of a countermeasure against the above-mentioned DPA decoding by DPA. According to the technology described in this publication, a pair of a mask a pattern and a bit-reversed mask pattern is provided, and each time encryption is performed, one of the pairs is randomly selected by a switch, and the result is written in plaintext inside the device. It masks the dependent bits and removes the effect of the mask a from the ciphertext by P before outputting the ciphertext.

According to the technique described in the above publication, the original data is masked, and the mask is released immediately before inputting to each S box. When this mask is released, there is a possibility that it will be decrypted by DPA, so the mask is released immediately before input to S box, input to S box with original data after unmasking, and mask of output from S box The operation is calculated in advance, stored as a table, and the calculation result is obtained by referring to the table.Therefore, the calculation of the exclusive OR for masking and the calculation of the exclusive OR for masking are performed. It is explained that it could not be decrypted by DPA because it would not be confused.

However, in the technique disclosed in the above publication, the calculation of the exclusive OR is stored in advance as a table, and the bits corresponding to the original data are set in order to sufficiently exert the function of the mask. Since the number of combinations is enormous, the circuit size of the table (storage circuit) that stores the operation results corresponding to the masks composed of such enormous combinations is large. It will be sharp. In addition, it is explained that in order to prevent angle reading by DPA, it is necessary to prevent the above mask from being biased to a specific pattern, but how to make a pattern of multiple bits not biased There is no specific description of what can be done, and the possibility of decryption by DPA remains. Therefore, the present invention provides an encryption / decryption device that realizes stable security enhancement with a simple configuration. It aims to provide an encryption / decryption method and an IC card. The above and other objects and novel features of the present invention will become apparent from the description of the present specification and the accompanying drawings. Disclosure of the invention

The following is a brief description of an outline of typical inventions disclosed in the present application. The input selection circuit randomly fetches either the non-inverted data corresponding to the processing unit data of the plaintext data or the ciphertext or the inverted data of all the bits, and passes the data through the input selection circuit. The transposition is transmitted to the non-inverted data transposition corresponding to the non-inverted data and the positive scrambling circuit for performing the substitution processing and the transposition corresponding to the inverted data and the negative scrambling circuit performing the substitution processing, and the output selection circuit performs the positive scrambling. One of the output signals transposed and replaced by the negative scramble circuit or the negative scramble circuit is taken out in accordance with the selection operation of the input selection circuit, and the output circuit outputs the output signal in the positive scramble circuit and the negative scramble circuit. Transpose multiple times ・ Finally transpose the result of substitution to obtain ciphertext or plaintext data.

The outline of other typical inventions disclosed in the present application will be briefly described as follows. Processing unit data of plaintext data or ciphertext Either the non-inverted data corresponding to the evening or the inverted data of all the bits thereof is taken in at random, and the data is transposed / substituted according to the non-inverted data. Processing and negative scramble signal processing for performing transposition and substitution processing corresponding to the above inverted data processing are performed in parallel, and one of the corresponding output signals is selected as data in the first signal processing. The extraction operation corresponding to the operation is performed a plurality of times, and the result of the last transposition / substitution is used as encrypted data or decrypted data. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a schematic block diagram showing an embodiment of an encryption / decryption device, an encryption / decryption method, and a DS encryption coprocessor adapted to an IC card according to the present invention;

FIG. 2 is a configuration diagram for explaining the algorithm of the DES encryption used in the present invention.

FIG. 3 is a block diagram for explaining the operation part in the algorithm of the DESS 喑 used in the present invention.

FIG. 4 is a configuration diagram for explaining the inside of S B〇 X in the algorithm of the DES encryption used in the present invention.

FIG. 5 is an explanatory diagram of an example of S 1 in how to create S BO X in the algorithm of the D E S B notation used in the present invention,

FIG. 6 is an explanatory diagram for logically explaining how to make the SBOX according to the present invention using S1 as an example.

FIG. 7 is an explanatory diagram for logically explaining another example of how to make the SBOX according to the present invention, taking S1 as an example,

FIG. 8 shows an embodiment of the basic structure (transposed part of plaintext transposition) for explaining the encryption / decryption device and the encryption / decryption method according to the present invention. FIG.

FIG. 9 is a block diagram for explaining another embodiment of the encryption / decryption device and the input selection circuit in the encryption / decryption method according to the present invention.

FIG. 10 is a block diagram for explaining the data flow of the operation / data inversion portion in the encryption / decryption device and the encryption / decryption method according to the present invention;

FIG. 11 is a block diagram for explaining the data flow of the SB0X output selection part in the encryption / decryption device and the encryption / decryption method according to the present invention;

FIG. 11 is a block diagram showing an embodiment of an encryption / decryption device and a circuit for forming a selection signal for inversion / non-inversion of data in an encryption / decryption method according to the present invention. ,

FIG. 13 is a block diagram showing one embodiment of a 0 Z 1 ratio correction circuit used in the present invention.

FIG. 14 is an external view showing an embodiment of the IC card according to the present invention.

0,

FIG. 15 is a schematic block diagram showing an embodiment of an IC card chip (microcomputer) mounted on the IC card according to the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

The present invention will be described in more detail with reference to the accompanying drawings.

FIG. 1 shows an outline of an embodiment of an encryption / decryption device, an encryption / decryption method, and a DES encryption coprocessor adapted to an IC card according to the present invention. A schematic block diagram is shown. In this embodiment, an internal operation signal 3 is obtained by adding a sign bit 1 of 1 bit to a plaintext signal (data) 1 in the DES encryption coprocessor. When the code bit is "0", the plaintext signal indicates positive (the signal value is the plaintext value itself). When the sign bit is "1", it indicates a negative (the inverted value of the signal value is a plaintext value). For the plaintext signal and code, all bits of the internal operation signal are inverted by exclusive OR 5 with the inversion random number signal 4 for each operation.

Two types of scramble circuits, 6 for the positive signal and 2 for the negative signal, are provided separately, and the output signal of the positive signal 6 and the negative signal 7 are selected using the selector 8 according to the value of the sign bit 2. select. After 16 repetitive operations in such a circuit, an exclusive OR 9 is placed before the output of the encrypted data, and if the sign bit 2 is "1", the encrypted data is inverted.

FIG. 2 is a configuration diagram for explaining an algorithm of the DES encryption, which is an encryption method processed by the present cryptographic coprocessor. The DES encryption / decryption operation uses 64 bits of plaintext (data to be encrypted).

) Or using a 64 bit ciphertext and a 56 bit key.

The DES algorithm can be roughly divided into plaintext data flow and key data flow. In the plaintext data flow, after performing the initial transposition (signal exchange) called IP, the data is divided into 32 bits for each of the upper and lower bits, and the transposition and substitution processing shown in Fig. 3 is performed. 1 Repeat 6 times. Integrating upper and lower respectively 3 2-bit data to the end, performs permutation called IP ^1, to obtain the ciphertext.

With DES, encryption and decryption can be realized by the same process. However, key scheduling differs between encryption and decryption. Although details are omitted for the key scheduling part, 48-bit key scheduling data is output to each stage based on the key data. The 16-time repetition operation shown in Fig. 3 consists of transposition, exclusive OR operation, and substitution processing called SBOX. SB OX is a 48-bit input and 32-bit output conversion process based on a conversion table. The conversion table of SBOX is defined in FIPS-46, ANSI-80, and ISO. As shown in FIG. 4, the inside of the SBOX is divided into eight substitution processing sections S1 to S8. Each substitution process is 6 bits input and 4 bits output. The problem with the hardware implementation of the DES algorithm as described above is that it is weak in current analysis using Differential Power Analysis (DPA). DPA attack is an analysis method that estimates the value of the encryption key from the current consumption waveform of the chip. In DP A, the attacker first gives the chip plaintext data and measures the current consumption waveform when processing the data. Next, assuming (part of) the value of the secret key stored in the chip, the prediction of the change in the signal line of interest (a slight increase in the current consumption) is applied to the actual current consumption waveform. If the assumed key is correct, the increase in current consumption will be amplified and peaked. DES encryption is an algorithm originally designed to be easily implemented in hardware. Therefore, when designing hardware for DES encryption, all products have a similar internal structure. This facilitates analysis with DPA.

As a method of making analysis by DPA difficult, there is a method of changing internal data and processing contents for each operation as described in Japanese Patent Application Laid-Open No. 2000-066585. A simple method of changing the internal data every time is to apply an exclusive OR to the plaintext with some scrambling code. However, with this method, the value of the scramble code in the data changes each time the transposition process is performed. Therefore, it is necessary to hold the value of the scramble code associated with the operation data overnight. The present invention employs a method of randomly determining whether to invert all bits of operation data. With this method, the current state of the computation data (inverted / non-inverted) can be maintained by simply adding one bit of code data to the computed data. Also, it is not affected by transposition and exclusive OR. However, since only SB OX has different conversion tables for inverted data and non-inverted data, there are two types, one for non-inverted data (normal S BOX) and one for inverted data added by the present application (SB0X—BAR). S BOX is prepared. The sign bit selects whether to use SBOX or SBOX-BAR. In other words, the output signal of one of the two SBOX and SBOX-BAR is taken out as valid.

The following describes how to make the above SBOX, taking S1 as an example. Fig. 5 shows the substitution structure of S1 based on the DES standard. In Fig. 5 (a), the horizontal direction is a number represented by 4 bits out of 6 bits (0 to 5), the vertical direction is the remaining 2 bits of input (0 to 3), and the written number is Represents the output 4 bits (0 to 15) for that input. The inverted data S1 BAR is logically created by inverting both the input and output of S1 as shown in Fig. 6 (b). Fig. 5 (b) shows the substitution of S1-BAR. FIG. 5 (a) “14” in the upper left represents the output value when the input is “0000 000”. The S 1—BAR corresponding to this output corresponds to “1”, which is the inverted version of “14”, in the lower right of FIG. 5 (b) (corresponding to the input “1 1 1 1 1 1 1”).

Incorporation into the actual coprocessor is the recalculated substitution configuration as shown in Fig. 5 (b). In other words, as shown in Fig. 6 (b), for the SBOX corresponding to the non-inverted data in Fig. 6 (a), an inverter circuit is provided for the input and output for the same SBOX. Such logic is not used directly. As a modified example of the present invention, an SB〇X in which an inverter circuit is provided only on the input side as shown in FIG. 7 (a), or an inverter circuit only on the output side as shown in FIG. 7 (b) It is also possible to use a pair of SBOXs that use a substitution structure (Table) equivalent to an SBOX with a.

FIG. 8 is a block diagram showing one embodiment of a basic structure (transposed part of plaintext transposition processing) for explaining the encryption / decryption device and the zero-code / decryption method according to the present invention. Have been. IP, IP- ¹ and key scheduling are the same as the basic algorithm of DES described with reference to FIGS. 2 to 4, and therefore description thereof is omitted. In FIG. 8, the portion represented by A is a portion for randomly determining whether or not the operation data is inverted in FIG. 1, and the portion represented by B is a portion for selecting the outputs of two SB〇X. . In FIG. 8, it is shown that the portion A is output by a multiplexer controlled by the selection signal, and the inverted signal passed through the inverter circuit and its input signal are shown in FIG. As described above, an equivalent circuit can be formed by using an exclusive OR that commonly receives a 1-bit selection signal. That is, if the selection signal is logic 0, the 33-bit input data including the sign bit is output as it is, and if the selection signal is logic 1, the 33-bit input signal is inverted and output. Regardless of the case where the inverter circuit and the multiplexer are used as shown in FIG. 8 or the case where an exclusive OR circuit is used as shown in FIG. There is no big difference in choosing either one because it can be composed of the same circuit elements.

FIG. 10 is a block diagram for explaining the data flow of the operation data inversion portion. FIG. 10 (a) shows the operation when the value of the selection signal, that is, the value of the random number signal for determining the inversion / non-inversion of the data is "0". FIG. 10 (b) shows the operation when the selection signal is "1". If the data coming from the previous stage is M, when the selection signal is "0", As shown in Fig. 10 (a), M is selected as the data that enters the enlarged transposition E. When the selection signal is "1", as shown in FIG. 10 (b), MB (8 is the inverted signal of FIG. 10 (b)) as the data to enter into the enlarged transposition E. ) Is selected. The output of the expanded transpose E is E (M) and E (MB), respectively. E (MB) is equal to E (M) B because the extended transpose E is a signal reordering process. After all, the output of the expanded transposition E with respect to M is an inverted value of E (M) when the selection signal is “0”, and E (M) when the selection signal is “1”.

FIG. 11 is a block diagram for explaining the data toughness of the SBOX output selection portion. The output is selected by the sign bit of the data entering the SBOX. As shown in Fig. 11 (a), when the data input to the SBOX is X (code signal-"0"), the output of the SBOX for non-inverted data is selected. As shown in Fig. 11 (b), when the input signal is XB (inverted data of X, code signal = "1"), the output of S BOX-BAR for inverted data is selected.

FIG. 12 is a block diagram showing one embodiment of a circuit for forming a selection signal for inverted Z non-inverted data. In this embodiment, an asynchronous oscillation signal of a random number generator mounted on an IC card is used as a selection signal. However, since the output of the asynchronous oscillation signal is biased by temperature and voltage, it is used after passing through the correction circuit. With the correction circuit, even if the asynchronous oscillation signal skips to 0 or 1, a signal with a ratio of 0/1 close to 50% can be used as a selection signal.

FIG. 13 is a block diagram showing one embodiment of the 0/1 ratio correction circuit used in the present invention. In this embodiment, eight stages of shift registers are connected in a ring. An exclusive OR of the output signal of the first stage circuit B1 of the shift register and the output signal of the last stage B8 is taken to the input signal and Is done. The output signal of the second stage B2 is exclusive ORed with the output of the asynchronous oscillation signal supplied from the random number generator, and is used as the input signal of the third stage B3. Hereinafter, the information is sequentially transmitted from the third stage B3 to the last stage B8. Then, although not particularly limited, the output signal of the sixth stage B6 is used as the selection signal.

In this embodiment, when the bits stored in the shift registers B2 to B8 successively have the same value, the bits are appropriately inverted by an exclusive OR process in B1, and a random number generator is used. Even if the asynchronous oscillation signal from is continuously biased to logic 0 or 1, the occurrence ratio of logic 0 and logic 1 is reduced by 50% by appropriately inverting between shift stages B2 and B3. It is to be corrected every time.

In the present invention, it is the inversion / non-inversion selection signal that determines the DPA resistance. By making the 0/1 appearance ratio of the chip internal signal close to 50%, it becomes possible to make analysis by DPA difficult. In other words, as described above, the DPA measures the current consumption waveform when processing data and searches for peaks by a statistical method.Therefore, by setting the above 0/1 appearance ratio to 50%, Since the current consumption in the statistical processing is averaged and the peak disappears, it becomes difficult to decode by such DPA. In this embodiment, as described above, a sign bit is added to the plaintext data so that it has both positive and negative states. Data is changed randomly for each code at the time of repeated operation in encryption. Operations that are not affected by the sign (exclusive OR, etc.) are performed without regard to the sign. For operations that are affected by the sign (eg, operations using a conversion table), a positive operation circuit and a negative operation circuit are provided, and a mechanism is used to select the output of the operation circuit according to the data sign.

According to this embodiment, the cryptographic operation time does not increase. For example, there is a method of extending the operation time and performing disturbance, such as performing a dummy operation. Because the internal processing contents are different each time the calculation is performed,

The time required for one operation is the same as when no measures are taken. In this embodiment, since the DPA countermeasures are included in the hardware, no extra load is imposed on the user as in the case where countermeasures are taken by software. FIG. 14 is an external view of an embodiment of an IC card to which the present invention is applied. The IC card has a card 101 made of a plastic case, and a chip for IC chip consisting of a one-chip microcomputer (not shown) mounted inside the card 101. The IC card further has a plurality of contacts (electrodes) 10 connected to external terminals of the IC card chip. The plurality of contacts 102 are connected to a power supply terminal VCC, a power supply reference potential terminal VSS, a reset input terminal RES bar, a clock terminal CLK, and a data terminal I / 0-1 as described later with reference to FIG. / 1 RQ bar, I / O-2 / 1 RQ bar. IC power over de receives the power supply from an external coupling device such as a reader-writer (not shown) through such contacts 1 0 2, also intends fi ¹ communication of data with an external coupling device.

FIG. 15 is a schematic block diagram of one embodiment of an IC card chip (microcomputer) mounted on the IC card according to the present invention. Each circuit block shown in the figure is formed on a single semiconductor substrate such as single crystal silicon, although not particularly limited by a known MOS integrated circuit manufacturing technique.

The configuration of the IC card chip according to the present invention is basically the same as that of the microcomputer. Its configuration consists of a clock generation circuit, a central processing unit (hereinafter simply referred to as CPU), storage devices such as ROM (Read Only Memory), RAM (Random Access Memory), and non-volatile memory (EEPR〇M), encryption and Coprocessor that performs the operation of decryption processing (encryption It consists of a 'decryption device', input / output ports (I / O ports), etc.

The clock generation circuit receives an external clock CLK supplied from a reader / writer (external coupling device) (not shown) via the contact 102 in FIG. 1, forms a system clock signal synchronized with the external clock signal, and generates the system clock signal. This is a circuit to be supplied inside the chip. The CPU 201 is a device that performs a logical operation, an arithmetic operation, and the like, and controls a system control logic, a random number generator, a security logic, a timer, and the like. Storage devices such as RAM, ROM, and EEPROM are devices for storing program data. The coprocessor is composed of a circuit adapted to the DES diacritic system as described above. The IZO (input / output) port is a device that communicates with the reader / writer. The data bus and the address bus are buses that interconnect each device.

Among the above storage devices, the ROM is a memory in which stored contents are fixed in a nonvolatile manner, and is a memory mainly for storing programs. Volatile memory (hereinafter referred to as RAM) is a memory in which stored information can be freely rewritten. However, when power supply is interrupted, the stored content is lost. If the IC card is removed from the reader / writer, the power supply will be interrupted, and the contents of the RAM will not be retained.

The above non-volatile memory (hereinafter referred to as EE PROM (Electrical Erasable Programmable Read Only Memory)) is a non-volatile memory whose contents can be rewritten. Even if it is done, it is retained inside. This EEPROM is used to store data that needs to be rewritten and that should be retained even if the IC card is removed from the reader / writer. For example, when an IC card is used as a prepaid card, the frequency of the prepaid card is rewritten each time the card is used. In this case, the frequency, etc. Even if it is stored, it must be stored in the IC card, so it is stored in the EEPROM.

The CPU is configured similarly to a so-called microprocessor. That is, although not shown in detail, an instruction register therein, an instruction register, a micro instruction ROM for decoding various instructions written in the instruction register, and various micro instructions or control signals, an arithmetic circuit, a general-purpose register, etc. (Such as RG6) and an input / output circuit such as a bus driver and a bus receiver connected to the internal bus BUS. The CPU reads an instruction stored in a ROM or the like and performs an operation corresponding to the instruction. The CPU fetches external data input via the I / O port, reads data such as instructions from ROM and fixed data necessary for executing instructions, and reads data from RAM and EE PROM. It controls evening writing and reading operations. The CPU receives a system clock signal generated from a clock generation circuit and operates with an operation timing and a period determined by the system clock signal. The main part of the CPU is composed of a CMOS circuit consisting of a P-channel MOSFET and an N-channel MOSFET. Although not particularly limited, the CPU includes a CM0S scanning circuit capable of static operation such as a CMOS static flip-flop, a precharge of a charge to a signal output node and a signal to a signal output node. And a CM 0 S dynamic circuit that performs output in synchronization with a system clock signal.

As described above, the coprocessor adds a code bit to the plaintext data to be handled internally, so that it has both a positive / negative state. Data is changed randomly for each code at the time of repeated operation in encryption. Operations that are not affected by the sign (such as exclusive OR) are performed without regard to the sign. Operations that are affected by the sign (such as operations using a conversion table) An operation circuit for the operation and an operation circuit for the negative are prepared, and a mechanism is used to select the output of the operation circuit according to the sign of the data.

The IC card of this embodiment also employs a disturbing method in which the contents of internal processing are different each time a calculation is performed, so that the time required for one calculation is the same as when no countermeasure is taken, so that high-speed data processing is possible. It is possible, and since the DPA countermeasures are incorporated in the hardware, there is no need for the CPU to perform extra operations for the DPA countermeasures, so that no extra load is imposed on the user.

The operational effects obtained from the above embodiment are as follows. Ie

(1) The input selection circuit randomly fetches either the non-inverted data corresponding to the processing unit data of the plaintext data or the ciphertext or the inverted data of all the bits, and the input selecting circuit The data passed to the transposition and non-inversion data corresponding to the non-inverted data is transmitted to the positive scramble circuit that performs the transposition processing and the transposition and the negative scramble circuit that performs the substitution processing corresponding to the inverted data. One of the output signals transposed / substituted by the input scrambling circuit or the negative scrambling circuit is taken out in accordance with the selection operation of the input selection circuit, and the output scrambling circuit and the negative scrambling circuit are output by the output circuit. Transpose multiple times at the same time · By obtaining the ciphertext or plaintext data by final transposition of the result of substitution, only the simple configuration and high speed Stably effect Ru can achieve security by D P A countermeasure is obtained.

(2) In addition to the above, a code bit is added to the plaintext data or ciphertext, and a randomly generated selection signal is supplied to the input selection circuit, and the signal including the code bit is not inverted. Either the data or the inverted data of all the bits should be fetched, the above sign bit is separated and The data is transposed / substituted by the positive scramble circuit and the negative scramble circuit, and the non-inverted data or the non-inverted data captured by the input select circuit by controlling the output select circuit using the separated code bits is controlled. By taking out the above-mentioned transposed / substituted output signal corresponding to the inverted data of all the bits, the effect that the DPA countermeasure can be realized with a simple configuration is obtained.

(3) In addition to the above, by performing the transposition / substitution processing using the DES encryption / decryption algorithm, it is possible to simplify the circuit since B-encryption and decryption can be realized by the same processing. The effect is obtained. (4) In addition to the above, a selection signal generated at random is received by receiving a 1-bit binary signal formed by a random number generation circuit, and the appearance rate of logic 1 and logic 0 is reduced by almost 1/2. By adding a simple circuit to compensate for DPA, the effect of realizing more robust DPA measures can be obtained.

Although the invention made by the inventor has been specifically described based on the embodiment, the invention of the present application is not limited to the embodiment, and it can be said that various modifications can be made without departing from the gist of the invention. Not even. For example, the IC card may include a single semiconductor integrated circuit device or a plurality of semiconductor integrated circuit devices. The microcomputer on which the encryption / decryption device is mounted is not only formed on a single semiconductor integrated circuit device, but also includes a CPU and its peripheral circuits composed of multiple chips, mounted on a single module substrate. It may be made of.

The microphone port computer may be of any type as long as it includes a data processing device and a ROM in which a data processing procedure by the data processing device is written, and performs a data input / output operation in accordance with the data processing procedure. . For example, in addition to the IC card chip described above,

Various microphones that require security, such as a one-chip microcomputer It can be widely applied to mouth computers. Industrial applicability

INDUSTRIAL APPLICABILITY The present invention can be widely used in various IC microcomputers requiring an encryption / decryption device, an encryption / decryption method, a data encryption method, and confidentiality protection.

Claims

The scope of the claims

1. An input selection circuit that randomly picks up either non-inverted data corresponding to plaintext data or ciphertext processing unit data, or inverted data of all the bits, or a shift.

A positive scramble circuit for receiving transposition through the input selection circuit and performing transposition and substitution processing corresponding to the non-inverted data;

A negative scramble circuit that performs transposition and substitution processing corresponding to the inverted data in response to the data passed through the input selection circuit;

An output selection circuit that extracts one of the output signals transposed and transposed by the positive scramble circuit or the negative scramble circuit in accordance with the selection operation of the input selection circuit;

An output circuit for final transposing the result of the transposition and substitution in the positive scramble circuit and the negative scramble circuit,

An encryption / decryption device wherein ciphertext or plaintext data is obtained through the output circuit.

2. In Claim 1,

A circuit for adding a sign bit to the plaintext data or the ciphertext;

A selection signal generated at random is supplied to the input selection circuit so that either the non-inverted data including the sign bit or the inverted data of all the bits is taken in,

The sign bit is separated and the data is transposed and replaced by the positive scramble circuit and the negative scramble circuit,

Using the separated code bits, the output selection circuit is controlled to output the non-inverted data fetched by the input selection circuit or the transposed / substituted output signal corresponding to the inverted data of all the bits. It is characterized by taking out To encrypt and decrypt devices.

3. In Claim 1,

The above-mentioned transposition / substitution processing is performed by a DS encryption / decryption algorithm.

4. In Claim 2,

The selection signal generated at random is formed by a correction circuit that receives a 1-bit binary signal formed by a random number generation circuit and corrects the appearance ratio of logic 1 and logic 0 to approximately 1/2. Encryption / decryption device

5. First signal processing to randomly take in either the non-inverted data corresponding to the plaintext data or the ciphertext processing unit data or the inverted data of all the bits, and

Positive scrambling signal processing for transposition and substitution processing corresponding to the non-inverted data, and negative scrambling for transposition and substitution processing corresponding to the inverted data. A second signal processing for performing the signal processing in parallel;

A third signal processing for extracting one of the output signals subjected to transposition and substitution processing in the positive scramble signal processing or the negative scramble signal processing in accordance with the data selection operation in the first signal processing;

A plurality of times, and the result of the last transposition / substitution is used as encryption data or decryption data.

6. In Claim 5,

The method further includes an operation of adding a sign bit to the plaintext data or ciphertext, and an operation of forming a randomly generated selection signal. In the first signal processing, the operation includes including the sign bit using the selection signal. Either non-inverted data or inverted data of all bits So that

In the second signal processing, the code bits are separated and the positive and negative scramble signal processing is performed.

In the third signal processing, the non-inverted data fetched in the first signal processing or the output signal subjected to the transposition / substitution processing corresponding to the inverted data of all the bits is used by using the separated code bits. An encryption / decryption method characterized by being taken out.

7. In Claim 5,

An encryption / decryption method characterized in that the transposition / substitution processing is performed by a DS encryption / decryption algorithm.

8. In Claim 6,

The randomly generated selection signal is characterized by signal processing that corrects the appearance ratio of logic 1 and logic 0 of the 1-bit binary signal formed by the random number generation circuit to almost 1/2. The encryption method and the decryption method.

9. A data encryption method in which input data is subjected to a predetermined conversion process a predetermined number of times to obtain an encrypted data corresponding to the input data. ,

In the above-mentioned predetermined conversion processing, a control signal that takes a state of either logic 0 or logic 1 is input, and processing is performed on input data that does not invert all bits of the input data to generate first data. Process the input data obtained by inverting all the bits of the input data to generate second data, and convert any of the first data and the second data into the predetermined data according to the state of the control signal Output as an output of the conversion process, the first data generation and the second data generation are performed in parallel,

The state that the above control signal takes is controlled so that the appearance ratio of each of logic 0 or logic 1 is controlled to be approximately 50%. Encryption method.

10. In claim 9,

A data encryption method comprising using a control device for controlling the state of the control signal so that the appearance ratio of each of logic 0 or logic 1 is approximately 50%.

1 1. In claim 10,

The data encryption method, wherein the control device has a tongue number generation device.

1 2. The operating voltage is supplied by the external terminal being electrically connected to the read / write device, and the power is supplied to the read / write device. An IC card that includes data input / output operations with decryption processing,

The cryptographic processing unit is

An input selection circuit that randomly takes in either non-inverted data corresponding to plaintext data or ciphertext processing unit data or inverted data of all bits thereof,

A positive scramble circuit that receives data passed through the input selection circuit and performs transposition and substitution processing corresponding to the non-inverted data;

A negative scramble circuit for receiving the data passed through the input selection circuit and performing transposition and substitution processing corresponding to the inverted data;

An output selection circuit that transposes with the above-described positive scramble circuit or negative scramble circuit and takes out one of the output signals subjected to the substitution processing in accordance with the selection operation of the input selection circuit;

An output circuit for final transposition of the result of the transposition and substitution in the positive scramble circuit and the negative scramble circuit a plurality of times;

The ciphertext or plaintext data must be obtained through the output circuit. IC capabilities.

1 3. In Claims 1 and 2,

A circuit for adding a sign bit to the plaintext data or the ciphertext;

Using the separated code bits, the output selection circuit is controlled to perform the transposition / substitution processing corresponding to the non-inverted data captured by the input selecting circuit or the inverted data of all the bits. An IC card characterized by extracting output signals.

1 4. In Claims 1 and 2,

An IC card characterized in that the transposition / substitution processing is performed by a DS encryption / decryption algorithm.

15. In claim 13,

The selection signal generated at random is formed by a correction circuit that receives a 1-bit binary signal formed by a random number generation circuit and corrects the appearance ratio of logic 1 and logic 0 to approximately 1/2. IC card characterized by the fact that: