WO2013163854A1

WO2013163854A1 - Circuit, chip and method against power attack for grouping algorithms

Info

Publication number: WO2013163854A1
Application number: PCT/CN2012/081145
Authority: WO
Inventors: 李娜; 胡晓波; 赵东艳; 王于波; 张海峰
Original assignee: 国网电力科学研究院
Priority date: 2012-05-03
Filing date: 2012-09-07
Publication date: 2013-11-07
Also published as: CN103384197B; CN103384197A

Abstract

The present invention provides a circuit, a chip and a method against power attack for grouping algorithms, the circuit comprising: a round operation module, a round key generation module, a data random perturbation and recovery unit, a round data random perturbation and recovery unit, and a MUX2_1 module; the method comprising: a random perturbation and a random perturbation and recovery algorithms. The circuit, the chip and the method against power attack for grouping algorithms provided by the present invention, use the random perturbation and the random perturbation and recovery algorithms, to directly conceal the information of the plain text and the round data in registers with little cost, thus making defense effects better.

Description

FIELD OF THE INVENTION The present invention relates to the field of information security, and in particular to a circuit, a chip and a method for defending against energy attacks on a packet algorithm. BACKGROUND OF THE INVENTION With the development of information technology, computer applications have penetrated into various fields of social life, especially in e-commerce, making people rely more and more on information, making information security technology particularly important. Encryption is also gaining more and more attention as an important part of the information security field. Encryption has a long history and a variety of cryptographic algorithms. The cryptographic algorithm can be divided into a grouping algorithm and a stream cipher algorithm according to the processing of plaintext data. The grouping algorithm is an algorithm for encrypting a fixed length of a set of plaintext, which groups the plaintext according to a certain bit length, and all of the plaintext group and the key group are encrypted to obtain a ciphertext group. When decrypting, the ciphertext group and the key group are decrypted and restored to a plaintext group. The characteristics of the grouping algorithm are as follows: The key can be fixed for a certain period of time, and it is not necessary to change each time. Therefore, it is convenient for key distribution, but there are also security risks such as the key being vulnerable to attack.

Currently popular packet algorithms are DES, AES, and so on. The grouping algorithm has now been widely promoted and applied. However, with the development of attack algorithm methods, the anti-attack measures of packet algorithms are also constantly improving. Nowadays, the more common means of energy attack is: by giving a large amount of data for encryption operation, and then performing differential analysis on the power consumption of the operation to derive the key to achieve the purpose of the attack. The commonly used methods to defend against the above attacks are: Masking data or keys or calculating the timing of operations during the operation.

The operation process of the encryption algorithm includes: The encryption algorithm E under the control of the key K is denoted as E_K, and the ciphertext corresponding to the plaintext message m is E_K (m). Similarly, the decryption algorithm D under the control of the key K is denoted as D_K, and the plaintext message c corresponds to the plaintext note! ) _K (c). Obviously, for all plaintext m, there is 1)_1 _1 (111) ) =111. The general simplified structure of the grouping algorithm operation is shown in Figure 1.

The prior art is mainly for the defense measures taken by the S-box attack in the circle operation process, and there are fewer defense actions against the register attack and the Hamming distance attack.

The existing anti-attack method mainly covers the data in the operation process. For example, the commonly used MASK technology is to perform defensive energy differential attack through the data in the mask operation process, but the MASK technology is hard. The cost of the parts is relatively large. . Invent the contents of the invention

In order to overcome the defects described above, the present invention provides an electric circuit for providing an anti-defense against the sub-grouping algorithm.

The 55-core chip and the method of the square, the operation and the use of random machine disturbance and chaos and random machine disturbances also restore the original algorithm, to cover the cover directly with a small amount of small price. Obviously, the text and the circle data are stored in the information stored in the register, so that the anti-defense effect is better. .

In order to achieve the above-mentioned purpose, the present invention provides an electrical circuit for providing an anti-defense against the sub-grouping algorithm, an energy energy attack attack, and a package thereof. Including: the circle operation algorithm module block and the circle key key generation to generate the module module;; the circuit circuit also includes:: the data data according to the random machine disturbance and also restore the original The unit element and the circle number data are restored with the random machine disturbance and also restore the original single unit element and the MMUUXX22 __11 module block;; the data data is restored with the random machine disturbance and also restores the original single unit element, MMUUXX22 __ 11 mode The modulo 1100 block, the number of lap data, and the random machine disturbance are also restored to the original single unit element and the circle operation algorithm module block is connected in sequence; the circle key key generation generates a model The module block transmits and transmits the generated secret key key to the circle operation arithmetic module block. .

In the preferred embodiment of the present invention, the data is stored in accordance with the random machine disturbance and also restores the original single unit element package including: The random machine disturbance scrambling module block ((11)), the data data register register, and the random machine disturbance are also restored to the original module block ((22)). .

In the second preferred embodiment of the present invention, the number of data of the circle is reduced with the random machine disturbance and the original single unit element is restored. The following includes: 1157 times The secondary connection is connected with the random machine disturbance scrambling module block ((33)), the circle number data register register, and the random machine disturbance is also restored to the original module block ((44) ). .

In the third preferred embodiment of the present invention, the random module disturbs the modular module block ((11,, 33)) and uses the random machine number. The number of pairs of logarithmic data is processed in accordance with the disturbance. .

In the fourth preferred embodiment of the present invention, the MMUUXX22__11 module module is a two-two-choice selection device; For the halving grouping algorithm algorithm, the energy energy attack attack circuit is the SSSSMMPP1111 model number. .

2200 The invention provides a fifth-five-preferred preferred technique in the present invention, and provides an energy-saving method for the one-to-one package including the anti-defense against the sub-grouping algorithm The electric power of the electric circuit that attacks the attack is transmitted to the safety of the whole core chip. .

In the sixth sixth preferred method of the present invention, the present invention provides a method for providing an anti-defense against the sub-grouping algorithm. The method of the square, the package includes the following steps:

((11)) .. configuration configuration control and control register to store the input data, and judge whether it is necessary or not to perform the chaotic sequence of the log data Processing, 2255 If there is no need to need, then the storage and storage input and input data, and the logarithmic data according to the line plus / / decryption and decryption operation calculation, jump jump Go to the step ((66));; otherwise, proceed to the step ((22));

((22)) .. for the logarithmic data to be harassed and disturbed;

((33)) .. stored data storage disturbances after the chaos of the data;

((44)) .. to the logarithmic data according to the line to restore the original processing;; (6) . Output encryption and decryption results.

In a seventh preferred embodiment of the present invention, in the step (2), the random number is used to perform the scrambling process on the data.

In the eighth preferred technical solution provided by the present invention, in the step (5), the data is scrambled and stored after the end of the circle operation; wherein each stored circle operation result is disturbed.

Compared with the prior art, the present invention provides a circuit, a chip and a method for defending an energy attack on a packet algorithm, and uses a random scrambling and random scrambling reduction algorithm without using expensive MASK technology, which is low in cost and directly at a small cost. Covers the information in the register of plaintext and circle data, thus achieving a good anti-P effect. DRAWINGS

FIG. 1 is a schematic structural diagram of a prior art grouping algorithm encryption/decryption operation.

FIG. 2 is a schematic structural diagram of Embodiment 1 of a defense energy attack circuit according to the present invention.

FIG. 3 is a flowchart of Embodiment 1 of a method for defensive energy attack according to the present invention.

FIG. 4 is a schematic diagram of an embodiment of a loop processing result scrambling process flow in the method of the present invention. detailed description

This technology disrupts the following two parts.

The data in the input register is disturbed. It is scrambled when the plaintext or key is input, for example, by using a random number mask method to mask the plaintext or the key, to prevent the attacker from obtaining plaintext or key information through a register attack or a Hamming attack.

The loop operation result in the circle data register is disturbed and protected. Prevent attackers from obtaining circular operation result information through register attack or Hamming distance attack.

As shown in FIG. 2, a circuit for defending against energy attacks on a grouping algorithm includes: a circle operation module, a circle key generation module, a data random disturbance recovery unit, a loop data random disturbance reduction unit, and a MUX2_1 module; The disturbance recovery unit, the MUX2_1 module, the loop data random scrambling restore unit, and the circle operation module are sequentially connected; the circle key generation module transmits the generated key to the circle operation module.

The data random scrambling and restoring unit may include: a random scrambling module (1) connected in sequence, a data register, and a random scrambling and restoring module (2). The loop data random scrambling and restoring unit may include: a random scrambling module (3), a loop data register, and a random scrambling and restoring module (4) connected in sequence. The random scrambling module (1, 3) uses random numbers to scramble the data. The circle data register stores the out-of-sequence data after the circle operation ends. The MUX2_1 module can be a two-choice selector; the defense against the grouping algorithm energy attack circuit is the SSMP11 model.

A power communication security chip that includes circuitry to defend against energy attacks on packet algorithms.

As shown in FIG. 3 and FIG. 4, a defensive energy attack method includes the following steps:

(1) Configure the control register input data, and determine whether it is necessary to process the data out of order, if not, store the input data, add/decrypt the data, and jump to step (6); otherwise, perform the steps ( 2); (2) . Disrupting the data; (3) storing the disturbed data; (4) . Restoring the data; (5) . Adding/decrypting the data to the circle; (6) . Output encryption and decryption results.

In the step (2), the data is subjected to scrambling processing using a random number. In the step (5), the data is scrambled and stored after the end of the circle operation; wherein, the result of the circle operation stored each time is disturbed.

The invention is mainly applied to a grouping algorithm of a security chip. That is, a random scrambling and random scrambling reduction algorithm is added to the grouping algorithm. The specific hardware implementation method is to disturb the data in the input register and the circle operation result in the circle data register. The method of the disturbance may be a simple scrambling algorithm such as shifting out-of-order, XORing with a random number. The disturbed data should be restored to the original data during the operation, that is, the data must be restored before the encryption/decryption operation to disturb the data in the input register. The specific implementation method is as follows: Store the data in the corresponding register. Before the disturbance, the data is restored and the encryption/decryption loop operation is performed after starting the circle calculation, as shown in Fig. 3.

Specific steps are as follows:

Step 1: As shown in Figure 3 (steps 201-202), configure the control register input data as needed, and set whether data is out of order.

Step 2: As shown in Figure 3 (step 203), if you need to process out of order, enter the data.

Step 3: As shown in Fig. 3 (step 204), the scrambling process is performed, and the method of scrambling the data before being stored in the data register (step 205) is to perform simple scrambling by using random numbers.

Step 4: As shown in Fig. 3 (step 205), the disturbed data is stored, and the disturbed data is stored in the data register, and it is judged whether or not the encryption and decryption circle operation is started. If you start the operation, you need to restore the data.

Step 5: As shown in Figure 3 (step 206), the data is restored. Before starting the operation, the data must be restored back to the original data, and the restored data is stored in the intermediate operation data register. The data at this time is processed by the random disturbance reduction algorithm. Step 6: As shown in FIG. 3 (step 207), the data is subjected to an encryption/decryption loop operation.

The specific implementation method for the circle operation result stored in the circle data register is as follows: After the loop operation is completed, the data is disturbed and stored in the register. In the present invention, the result of the loop operation stored in the loop data register each time is disturbed, and the scrambling algorithm is different for each operation, as shown in Fig. 3.

Step 7: As shown in Figure 3 (step 208), the encryption and decryption result is output.

Step 8: As shown in FIG. 3 (steps 209-211), if out-of-order processing is not required, the data may skip the out-of-order processing of step 1, the data restoration processing of step 4 and step 5, and perform normal encryption/decryption loop operations on the data. After the process, the encryption and decryption results are output.

It is to be understood that the present invention and the specific embodiments thereof are intended to clarify the practical application of the technical solutions provided by the present invention, and should not be construed as limiting the scope of the present invention. Various modifications, equivalent substitutions, or improvements can be made by those skilled in the art in light of the spirit and principles of the invention. However, these changes or modifications are within the scope of the application for approval.

Claims

Claim

A circuit for defending energy attacks on a grouping algorithm, comprising: a circle operation module and a circle key generation module; and the method further comprises: a data random disturbance reduction unit, a loop data random disturbance reduction unit, and a MUX2_1 module The data random scrambling and restoring unit, the MUX2_1 module, the loop data random scrambling and restoring unit, and the circle computing module are sequentially connected; the circle key generating module transmits the generated key to the circle Arithmetic module.

2. The circuit according to claim 1, wherein the data random scrambling and restoring unit comprises: a random scrambling module (1), a data register and a random scrambling and restoring module (2) connected in sequence.

3. The circuit according to claim 1, wherein the loop data random scrambling and restoring unit comprises: a random scrambling module (3), a loop data register and a random scrambling and restoring module (4) connected in sequence.

4. Circuit according to claim 2 or 3, characterized in that the random scrambling module (1, 3) performs a scrambling process on the data using random numbers.

The circuit according to any one of claims 1 to 3, wherein the MUX2_1 module is a second-choice selector; and the defense-to-grouping algorithm energy attack circuit is an SSMP11 model.

6. A power communication security chip comprising the circuit of any of the preceding claims 1-5.

A method for defending an energy attack on a packet algorithm, characterized in that the method comprises the following steps:

(1) Configure the control register input data, and determine whether it is necessary to process the data out of order, if not, store the input data, add/decrypt the data, and jump to step (6); otherwise, perform the steps ( 2) ;

(2). Disturbing the data;

(3) storing the disturbed data;

(4) . Restore the data;

(5). Add/decrypt loop operations on the data;

(6) . Output encryption and decryption results.

8. The method according to claim 7, wherein in the step (2), the data is subjected to a scrambling process using a random number.

9. The method according to claim 7, wherein in the step (5), the data is scrambled and stored after the end of the circle operation; wherein each stored circle operation result is disturbed Disorganized.