CN106506140A - A kind of AES encryption and decryption method and device - Google Patents

Abstract

The embodiment of the present invention discloses an Advanced Encryption Standard (AES) encryption and decryption method, including: obtaining a new key, adding the new key to the next set of data to be encrypted; using the original key pair to add the new Perform AES encryption on a group of data to be encrypted with the key, and use the new key to perform AES encryption on each group of data to be encrypted that has not been AES encrypted; use the original key to perform AES decryption on each group of data to be decrypted in turn , until the new key is obtained; use the new key to perform AES decryption on each group of data to be decrypted that has not been decrypted. The embodiment of the invention also discloses an AES encryption and decryption device.

Description

A kind of AES encryption and decryption method and device

technical field

The present invention relates to Advanced Encryption Standard (AES) encryption and decryption technology, in particular to an AES encryption and decryption method and device.

Background technique

As a symmetric key encryption algorithm, the AES algorithm has attracted more and more attention. However, when the AES algorithm is used for encryption and decryption, a fixed key is usually used, so it is easy to bring hidden dangers to data security; A technical solution for changing keys during AES encryption and decryption.

Contents of the invention

In order to solve the above technical problems, the embodiment of the present invention expects to provide an AES encryption and decryption method and device, which can change the key without interrupting the encryption and decryption process, and improve the security of data use.

Technical scheme of the present invention is realized like this:

The embodiment of the present invention provides an AES encryption and decryption method, comprising:

Obtaining a new key, adding the new key to the next group of data to be encrypted; using the original key to perform AES encryption on a group of data to be encrypted with the new key added, and using the new key, Perform AES encryption on each group of data to be encrypted that has not been AES encrypted;

Using the original key to perform AES decryption on each group of data to be decrypted sequentially until the new key is obtained; using the new key to perform AES decryption on each group of data to be decrypted that has not been decrypted.

In the above solution, each set of data to be encrypted includes a plurality of data packets; adding the new key to the next set of data to be encrypted includes: in each data packet of a corresponding set of data to be encrypted Add a new key in;

Each set of data to be decrypted includes a plurality of data packets, and the use of the original key to perform AES decryption on each set of data to be decrypted in sequence until the new key is obtained includes: using the original key to decrypt each AES decryption is performed on each data packet of the group of data to be decrypted, and each data packet of each group of data to be decrypted is detected to determine whether each detected data packet contains a new key.

In the above solution, the use of the original key to sequentially perform AES decryption on each group of data to be decrypted until the new key is obtained includes: for each group of data to be decrypted, the detected data containing the new key When the number of packet headers is greater than or equal to the set threshold, the new key is acquired.

In the above scheme, each set of data to be encrypted includes a plurality of data packets;

Performing AES encryption on each group of data to be encrypted includes: performing stream encryption in codebook ECB mode or counting CTR mode stream encryption on each data packet of each group of data to be encrypted;

The flow encryption of each data packet in ECB mode includes: for the corresponding data packet, sequentially perform the first round of encryption logic operation to the Nth round of encryption logic operation, and obtain the AES encryption result of the corresponding data packet in ECB mode, where N is greater than 1 ; Among them, the hardware that realizes each round of encryption logic operations exists at the same time, and the hardware that realizes each round of encryption logic operations will not be reused;

Encrypting each data packet in CTR mode includes: obtaining the count value in advance before obtaining the corresponding data packet, and sequentially performing the first round of encryption logic operation to the K round of encryption logic operation on the count value to obtain the count encryption result. K is greater than 1; after obtaining the corresponding data packet, XOR operation is performed on the data in the corresponding data packet and the count encryption result to obtain the AES encryption result of the corresponding data packet in CTR mode; among them, the implementation of each round of encryption logic operation The hardware exists at the same time, and the hardware that implements each round of encryption logic operations will not be reused.

In the above scheme, each set of data to be decrypted includes a plurality of data packets;

AES decryption for each set of data to be decrypted includes: performing streamline decryption in ECB mode or streamline decryption in CTR mode for each data packet of each set of data to be decrypted;

Decryption of each data packet in ECB mode includes: performing the first round of decryption logic operations to the Nth round of decryption logic operations for the corresponding data packets in order to obtain the AES decryption results of the corresponding data packets in ECB mode, where N is greater than 1 ; Wherein, the hardware for realizing each round of decryption logic operations exists at the same time, and the hardware for realizing each round of decryption logic operations will not be reused;

Decrypting each data packet in CTR mode includes: obtaining the count value in advance before obtaining the corresponding data packet, and sequentially performing the first round of decryption logic operation to the K round of decryption logic operation on the count value to obtain the count decryption result, K is greater than 1; after obtaining the corresponding data packet, XOR operation is performed on the data in the corresponding data packet and the count decryption result, and the AES decryption result of the corresponding data packet in CTR mode is obtained; wherein, each round of decryption logic operation is realized The hardware exists at the same time, and the hardware that implements each round of decryption logic operations will not be reused.

In the above solution, the decryption sequence of each group of data to be decrypted is consistent with the encryption sequence of each group of data to be encrypted.

The embodiment of the present invention also provides an AES encryption and decryption device, including an encryption end and a decryption end; wherein,

The encryption end is used to obtain a new key, and add the new key to the next set of data to be encrypted; use the original key to perform AES encryption on the set of data to be encrypted with the new key added, and use the The new key is used to perform AES encryption on each group of data to be encrypted that has not been AES encrypted;

The decryption end is used to use the original key to perform AES decryption on each group of data to be decrypted sequentially until the new key is obtained; use the new key to perform AES decryption on each group of data to be decrypted that has not been decrypted.

In the above scheme, each set of data to be encrypted includes a plurality of data packets;

The encryption end is specifically used to add a new key to each data packet of a corresponding set of data to be encrypted;

Each set of data to be decrypted includes a plurality of data packets;

The decryption terminal is specifically used to use the original key to perform AES decryption on each data packet of each group of data to be decrypted, and detect each data packet of each group of data to be decrypted, and determine that each data packet detected Whether to include the new key.

In the above solution, the decryption end is configured to acquire the new key when the detected number of headers of data packets containing the new key is greater than or equal to a set threshold for each set of data to be decrypted.

In the above scheme, each set of data to be encrypted includes a plurality of data packets;

The encryption terminal is specifically used to perform ECB mode flow encryption or CTR mode flow encryption for each data packet of each group of data to be encrypted;

The encryption end is used to sequentially perform the first round of encryption logic operations to the Nth round of encryption logic operations for the corresponding data packets to obtain the AES encryption results of the corresponding data packets in ECB mode, where N is greater than 1; wherein, each The hardware for each round of encryption logic operations exists at the same time, and the hardware for each round of encryption logic operations will not be reused;

Alternatively, the encryption end is used to obtain the count value in advance before obtaining the corresponding data packet, and sequentially perform the first round of encryption logic operation to the K round of encryption logic operation on the count value to obtain the count encryption result, and K is greater than 1 ; After obtaining the corresponding data packet, XOR operation is performed on the data in the corresponding data packet and the count encryption result, and the AES encryption result of the corresponding data packet in CTR mode is obtained; wherein, the hardware for realizing each round of encryption logic operation exists at the same time , and the hardware implementing each round of encryption logic operations will not be reused.

In the above scheme, each set of data to be decrypted includes a plurality of data packets;

The decryption terminal is specifically used to perform streamline decryption in ECB mode or streamline decryption in CTR mode for each data packet of each group of data to be decrypted;

The decryption terminal is used to sequentially perform the first round of decryption logic operations to the Nth round of decryption logic operations for the corresponding data packets to obtain the AES decryption results of the corresponding data packets in ECB mode, where N is greater than 1; wherein, each The hardware for each round of decryption logic operations exists at the same time, and the hardware for each round of decryption logic operations will not be reused;

Alternatively, the decryption terminal is used to obtain the count value in advance before obtaining the corresponding data packet, and sequentially perform the first round of decryption logic operation to the K round of decryption logic operation on the count value to obtain a count decryption result, where K is greater than 1 ; After obtaining the corresponding data packet, XOR operation is performed on the data in the corresponding data packet and the count decryption result, and the AES decryption result of the corresponding data packet in CTR mode is obtained; wherein, the hardware for realizing each round of decryption logic operations exists at the same time , and the hardware implementing each round of decryption logic operations will not be reused.

An AES encryption and decryption method and device provided by the embodiments of the present invention obtain a new key, and add the new key to the next group of data to be encrypted; use the original key pair to add the new key to a group Perform AES encryption on the data to be encrypted, and use the new key to perform AES encryption on each group of data to be encrypted that has not been encrypted by AES; use the original key to perform AES decryption on each group of data to be decrypted in turn until all the data are obtained. The new key; use the new key to perform AES decryption on each group of undecrypted data to be decrypted. In this way, the key can be replaced without interrupting the encryption and decryption process, thereby improving the security of data usage.

Description of drawings

Fig. 1 is the flowchart of the first embodiment of the AES encryption and decryption method of the present invention;

Fig. 2 is the block flow diagram of multiple rounds of encryption logical operations in the first embodiment of the AES encryption and decryption method of the present invention;

Fig. 3 is the flowchart of multiple rounds of decryption logical operations in the first embodiment of the AES encryption and decryption method of the present invention;

Fig. 4 is the flowchart of the second embodiment of the AES encryption and decryption method of the present invention;

FIG. 5 is a schematic diagram of the composition and structure of an AES encryption and decryption device according to an embodiment of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention.

Fig. 1 is the flowchart of the first embodiment of the AES encryption and decryption method of the present invention, as shown in Fig. 1, the method comprises:

Step 100: Obtain a new key, add the new key to the next set of data to be encrypted; use the original key to perform AES encryption on the set of data to be encrypted with the new key added, and use the new key to The key is to perform AES encryption on each group of data to be encrypted that has not been AES encrypted.

In this step, the encryption end can be used to implement AES encryption; here, the encryption end can perform AES encryption through hardware, software, or a combination of software and hardware.

Here, obtaining a new key includes: generating a new key, or receiving a new key from an external device.

In practical applications, the data to be encrypted includes M groups of data, and M is greater than 1; here, the encryption order of each group of data can be preset.

Further, each group of data to be encrypted includes a plurality of data packets, in this case, the new key is added to the next group of data to be encrypted, including: each data in the corresponding group of data to be encrypted Add a new key to the packet; here, the new key can be added to the header of each data packet of a corresponding set of data to be encrypted. In addition, the packet header of each data packet carries indication information, which is used to indicate which data packet the data packet corresponds to in a group of data to be encrypted.

In the embodiment of the present invention, AES encryption can be implemented in Electronic Codebook (Electronic Codebook, ECB) mode or counter (Counter, CTR) mode. In this step, performing AES encryption on each set of data to be encrypted includes: performing streamline encryption in ECB mode or streamline encryption in CTR mode on each data packet of each set of data to be encrypted.

Specifically, performing ECB-mode pipeline encryption on each data packet includes: sequentially performing key XOR operations, the first round of encryption logic operations to the N-th round of encryption logic operations for the corresponding data packets, to obtain that the corresponding data packets are in the ECB mode The following AES encryption results, N is greater than 1; among them, the hardware that realizes each round of encrypted logical operations is different from each other, that is, the hardware that realizes each round of encrypted logical operations exists at the same time, and the hardware that realizes each round of encrypted logical operations does not be reused; in this way, multiple rounds of encryption logic operations in the form of pipelines can be realized, and the calculation process in AES encryption in ECB mode can be accelerated.

Here, the i-th round of encryption logic operations includes the S-box transformation (SubBytes) calculation step, the row shift transformation (ShiftRows) calculation step, the column mixing transformation (Mixcolumns) calculation step and the round key plus transformation (AddRound key) performed in order. ) calculation step, i ranges from 1 to N-1; the Nth round of encryption logic operations only includes the calculation steps of S-box transformation, row shift transformation calculation step and round key plus transformation calculation step executed in order.

Here, when performing ECB mode pipeline encryption on each data packet, it is necessary to obtain the initial key first, and expand the initial key into N+1 extended keys; performing key XOR operation on each data packet includes: An XOR operation is performed on the data corresponding to the data packet and the first extended key of the N+1 extended keys. When performing the i'th round of encryption logic operations on each data packet, the i'+1th extended key of the N+1 extended keys needs to be used, and i' ranges from 1 to N.

Specifically, performing CTR mode pipeline encryption on each data packet includes: before obtaining the corresponding data packet, pre-obtaining the count (COUNTER) value, and sequentially performing key XOR operation on the count value, the first round of encryption logic operation to the first round K rounds of encryption logic operations to obtain the counting encryption result, K is greater than 1; after obtaining the corresponding data packet, XOR operation is performed on the data in the corresponding data packet and the counting encryption result to obtain the AES of the corresponding data packet in CTR mode encryption result; here, the hardware for implementing each round of encryption logic operations is different from each other, that is to say, the hardware for implementing each round of encryption logic operations exists at the same time, and the hardware for implementing each round of encryption logic operations will not be reused; thus, it can Realize multiple rounds of encryption logic operations in the form of a pipeline, and speed up the calculation process in AES encryption in CTR mode.

Here, the j-th round of encryption logic operations includes the calculation steps of S-box transformation, row shift transformation, column mixing transformation and round key plus transformation calculation steps executed in sequence, and j ranges from 1 to K-1; The logical operation of round encryption only includes the calculation steps of S-box transformation, row shift transformation and round key plus transformation calculation steps executed in sequence.

Here, if the counting encryption result is not obtained in advance before obtaining the corresponding data packet, then after obtaining the corresponding data packet, it is necessary to obtain the counting encryption result before performing an XOR operation on the counting encryption result and the data in the data packet. In this way, the corresponding data packets need to be cached. Therefore, in the embodiment of the present invention, cache resources can be effectively saved by obtaining the counting encryption result in advance.

Here, when performing CTR mode pipeline encryption on each data packet, it is necessary to obtain the initial key first, and expand the initial key into K+1 extended keys; the key XOR operation for the count value includes: the count value Perform an XOR operation with the first extended key of the K+1 extended keys. When the j'th round of encryption logic operation is performed on the count value, the j'+1th extended key of the K+1 extended keys needs to be used, and j' ranges from 1 to K.

Fig. 2 is the flow chart diagram of multi-round encryption logical operation in the first embodiment of the AES encryption and decryption method of the present invention, as shown in Fig. 2, Input represents the input data of the data packet to be encrypted when carrying out the AES encryption of ECB mode, or represents The count value to be encrypted when performing AES encryption in CTR mode, the bit width of Input is 128bit; round means each round of encryption logic operation, except for the last round of encryption logic operation, each round of encryption logic operation includes S boxes executed in order Transformation calculation steps, row shift transformation calculation steps, column mixing transformation calculation steps and round key addition transformation calculation steps; the last round of encryption logic operations only includes S-box transformation calculation steps, row shift transformation calculation steps and round key addition Transform calculation steps. Output indicates the final output data obtained when performing AES encryption in ECB mode, or indicates the counting encryption result when performing AES encryption in CTR mode; the first key expansion module is used to expand the initial key into multiple extended keys , among the expanded keys obtained by the expansion of the first key expansion module, one expanded key is used to perform an XOR operation on Input, and the remaining expanded keys are used for corresponding rounds of encryption logic operations.

Further, the bit width of the initial key can be 128bits, 192bits or 256bits. When the bit width of the initial key is 128bits, the number of rounds of multi-round encryption logic operation is 10; when the bit width of the initial key is 192bits, the multi-round The number of rounds of encryption logic operations is 12; when the bit width of the initial key is 256 bits, the number of rounds of multi-round encryption logic operations is 14.

Step 101: Use the original key to perform AES decryption on each group of data to be decrypted sequentially until the new key is obtained; use the new key to perform AES decryption on each group of data to be decrypted that has not been decrypted.

In this step, the decryption terminal can be used to implement AES decryption; here, the decryption terminal can perform AES decryption through hardware, software, or a combination of software and hardware.

Here, the decryption sequence of each group of data to be decrypted is consistent with the encryption sequence of each group of data to be encrypted, that is, in step 100, AES is sequentially performed on the first group of data to be encrypted to the Mth group of data to be encrypted. Encrypt to obtain the corresponding 1st to Mth group of data to be decrypted; in this step, perform AES decryption on the 1st to Mth group of data to be decrypted sequentially.

It can be seen that in this step, the new key can be obtained through AES decryption.

Further, each set of data to be decrypted includes multiple data packets. In this case, the use of the original key to perform AES decryption on each set of data to be decrypted in turn until the new key is obtained includes: Use the original key to perform AES decryption on each data packet of each group of data to be decrypted, and detect the header of each data packet of each group of data to be decrypted, and determine whether the header of each detected data packet contains the new key. key; if for each group of data to be decrypted, the number of detected packet headers containing the new key is greater than or equal to the set threshold, the new key is obtained; otherwise, the new key is not obtained.

In the embodiment of the present invention, AES decryption can be implemented in ECB mode or CTR mode. In this step, performing AES decryption on each set of data to be decrypted includes: performing streamline decryption in ECB mode or streamline decryption in CTR mode on each data packet of each set of data to be decrypted.

Specifically, performing ECB mode pipeline decryption on each data packet includes: for the corresponding data packet, sequentially perform key XOR operation, the first round of decryption logic operation to the Nth round of decryption logic operation, and obtain the corresponding data packet in ECB mode For the AES decryption results below, N is greater than 1; among them, the hardware that realizes each round of decryption logic operations is different from each other, that is, the hardware that realizes each round of decryption logic operations exists at the same time, and the hardware that realizes each round of decryption logic operations does not are reused; in this way, multiple rounds of decryption logic operations in the form of a pipeline can be realized, and the calculation process in AES decryption in ECB mode can be accelerated.

Here, the i-th round of decryption logical operations includes the inverse row shift transformation (InvShiftRows) calculation step, the inverse S-box transformation (InvSubBytes) calculation step, the round key plus transformation (AddRound key) calculation step and the inverse column mixing transformation performed in sequence (InvMixcolumns) calculation step, i ranges from 1 to N-1; the Nth round of decryption logic operations only includes the calculation steps of inverse row shift transformation, inverse S-box transformation calculation step and round key plus transformation calculation step executed in sequence.

Here, when performing ECB mode pipeline decryption on each data packet, it is necessary to obtain the initial key first, and expand the initial key into N+1 extended keys; performing key XOR operation on each data packet includes: An XOR operation is performed on the data corresponding to the data packet and the first extended key of the N+1 extended keys. When performing the i'th round of decryption logic operations on each data packet, the i'+1th extended key of the N+1 extended keys needs to be used, and i' ranges from 1 to N.

It should be noted that the N+1 extended keys used to decrypt each data packet in ECB mode are the same as the N+1 extended keys used to encrypt each data packet in ECB mode. However, the order of use of the N+1 extended keys used when performing ECB-mode pipeline decryption on each data packet is: the order of N+1 extended keys used when performing ECB-mode pipeline encryption on each data packet The reverse order of usage.

Specifically, performing CTR mode pipeline decryption on each data packet includes: obtaining the count value in advance before obtaining the corresponding data packet, and sequentially performing key XOR operation on the count value, the first round of decryption logical operation to the K round of decryption Logical operation to obtain the count decryption result, K is greater than 1; after obtaining the corresponding data packet, XOR operation is performed on the data in the corresponding data packet and the count decryption result, and the AES decryption result of the corresponding data packet in CTR mode is obtained; Here, the hardware for each round of decryption logic operations is different from each other, that is to say, the hardware for each round of decryption logic operations exists at the same time, and the hardware for each round of decryption logic operations will not be reused; in this way, the pipeline form can be realized Multiple rounds of encryption logic operations speed up the calculation process of AES decryption in CTR mode.

Here, the j-th round of decryption logic operations includes the calculation steps of inverse row shift transformation, inverse S-box transformation calculation step, round key plus transformation calculation step and inverse column mixing transformation calculation step performed in order, and j is 1 to K-1; The K-th round of decryption logical operations only includes the calculation steps of inverse row shift transformation, inverse S-box transformation calculation and round key plus transformation calculation steps executed in sequence.

Here, if the counting decryption result is not obtained in advance before obtaining the corresponding data packet to be decrypted, then after obtaining the corresponding data packet, it is necessary to obtain the counting decryption result before the counting decryption result and the data in the data packet can be differentiated. OR operation, in this way, the corresponding data packets need to be cached. Therefore, in the embodiment of the present invention, cache resources can be effectively saved by obtaining the count decryption result in advance.

Here, when performing CTR mode pipeline decryption for each data packet, it is necessary to obtain the initial key first, and expand the initial key into K+1 extended keys; performing key XOR operation on the count value includes: converting the count value Perform an XOR operation with the first extended key of the K+1 extended keys. When the j'th round of decryption logic operation is performed on the count value, the j'+1th extended key of the K+1 extended keys needs to be used, and j' ranges from 1 to K.

It should be noted that the K+1 extended keys used when performing CTR mode pipeline decryption on each data packet are the same as the K+1 extended keys used when performing CTR mode pipeline encryption on each data packet, However, the usage order of the K+1 extended keys used when performing CTR mode pipeline decryption on each data packet is: the K+1 extended keys used when performing CTR mode pipeline encryption on each data packet The reverse order of usage.

Fig. 3 is the flow diagram of multiple rounds of decryption logical operations in the first embodiment of the AES encryption and decryption method of the present invention, as shown in Fig. 3, In represents the data of the data packet to be encrypted when performing the AES encryption of the ECB mode, or represents the data to be encrypted. The count value to be encrypted during AES encryption in CTR mode, the bit width of In is 128bit; Round represents each round of decryption logic operation, except for the last round of decryption logic operation, each round of decryption logic operation includes reverse shift performed in order Transformation calculation steps, inverse S-box transformation calculation steps, round key plus transformation calculation steps, and inverse-column mixed transformation calculation steps; the last round of decryption logic operations only includes inverse row shift transformation calculation steps, inverse S-box transformation calculation steps and round key Key plus transform calculation steps. Out represents the final encryption result when performing AES encryption in ECB mode, or the counting encryption result when performing AES encryption in CTR mode; the second key expansion module is used to expand the initial key into multiple extended keys , among the expanded keys obtained by the expansion of the second key expansion module, one expanded key is used to perform an XOR operation on In, and the rest of the expanded keys are used for corresponding rounds of decryption logic operations.

Further, the bit width of the initial key can be 128bits, 192bits or 256bits. When the bit width of the initial key is 128bits, the number of rounds of multi-round decryption logic operation is 10; when the bit width of the initial key is 192bits, the multi-round The number of rounds of decryption logic operation is 12; when the bit width of the initial key is 256 bits, the number of rounds of multi-round decryption logic operation is 14.

In the first embodiment of the AES encryption and decryption method of the present invention, the process of adding a new key is set in the process of AES encryption, so that the key can be replaced without interrupting the data flow.

second embodiment

In order to better reflect the purpose of the present invention, further illustrations are made on the basis of the first embodiment of the present invention.

Fig. 4 is the flowchart of the second embodiment of the AES encryption and decryption method of the present invention, as shown in Fig. 4, the method comprises:

Step 400: Utilize the control unit to send a key replacement notification carrying a new key to the encryption end.

Step 401: After receiving the key replacement notification, the encryption end adds a new key to the header of each data packet of the next set of data to be encrypted; and after adding the new key, uses the new key to pair the next Each data packet of a group of data to be encrypted is encrypted, and the information that the key of the encryption terminal has been changed is sent to the control unit.

Step 402: The decryption end uses the original key to decrypt the mth group of data to be decrypted, and detects the headers of each data packet of the mth group of data to be decrypted, and obtains the mth group of data to be decrypted. The number of packet headers of the data packet of the key, and the initial value of m is 1.

Step 403: when m is less than M, skip to step 404, where M represents the number of groups of data to be decrypted; when m is equal to M, end the process.

Step 404: When the number of headers of the data packet containing the new key corresponding to the mth group of data to be decrypted is greater than zero, perform step 405; otherwise, when the mth group of data to be decrypted corresponds to the data containing the new key The number of packet headers is zero, the value of m is incremented by 1, and the process returns to step 402 .

Step 405: Judging whether the number of packet headers containing the new key corresponding to the mth group of data to be decrypted is greater than or equal to the set threshold Y, if greater than or equal to the set threshold Y, then skip to step 406, otherwise, skip to Go to step 407.

Step 406: The decryption end uses the new key to perform AES decryption on the m+1th group of data to the Mth group of data in sequence, and sends the information that the key has been changed to the control unit; the process ends.

It can be seen that after step 406, the control unit knows that both the encryption end and the decryption end have performed the key replacement process.

Step 407: The decryption end sends a key replacement failure message to the control unit. After receiving the key replacement failure message, the control unit re-adds a new key to the header of each data packet for a set of data to be encrypted with a new key added , and replace the original data packet with each data packet after adding the new key again, use the new key to encrypt each data packet of the next group of data to be encrypted, and send the encryption end key to the control unit Replace the information, and then return to step 402.

third embodiment

For the method of the embodiment of the present invention, the embodiment of the present invention also provides an AES encryption and decryption device.

FIG. 5 is a schematic diagram of the composition and structure of an AES encryption and decryption device according to an embodiment of the present invention. As shown in FIG. 5 , the device includes an encryption terminal 500 and a decryption terminal 501; wherein,

The encryption terminal 500 is used to obtain a new key, and add the new key to the next group of data to be encrypted; use the original key to perform AES encryption on the group of data to be encrypted with the new key added, and use Described new key, carries out AES encryption to each group of data to be encrypted that does not carry out AES encryption;

The decryption terminal 501 is used to use the original key to perform AES decryption on each group of data to be decrypted sequentially until the new key is obtained; use the new key to perform AES decryption on each group of data to be decrypted that has not been decrypted .

Specifically, each set of data to be encrypted includes multiple data packets; each set of data to be decrypted includes multiple data packets.

The encryption terminal 500 is specifically configured to add a new key to each data packet of a corresponding set of data to be encrypted.

The decryption terminal 501 is specifically used to use the original key to perform AES decryption on each data packet of each group of data to be decrypted, and detect each data packet of each group of data to be decrypted, and determine the detected data packet contains the new key.

The decryption terminal 501 is configured to acquire the new key when the detected number of headers of data packets containing the new key is greater than or equal to a set threshold for each group of data to be decrypted.

Further, the encryption terminal 500 is specifically configured to perform pipeline encryption in ECB mode or pipeline encryption in CTR mode for each data packet of each group of data to be encrypted;

The encryption terminal 500 is used to sequentially perform the first round of encryption logic operations to the Nth round of encryption logic operations for the corresponding data packets to obtain the AES encryption results of the corresponding data packets in ECB mode, where N is greater than 1; wherein, The hardware for each round of encryption logic operations is different from each other; that is, the hardware for each round of encryption logic operations exists at the same time, and the hardware for each round of encryption logic operations will not be reused;

Alternatively, the encryption terminal 500 is used to obtain the count value in advance before obtaining the corresponding data packet, and sequentially perform the first round of encryption logic operation to the K round of encryption logic operation on the count value to obtain the count encryption result, and K is greater than 1. After obtaining the corresponding data packet, XOR operation is performed on the data in the corresponding data packet and the counting encryption result, and the AES encryption result of the corresponding data packet in CTR mode is obtained; wherein, the hardware interaction of each round of encryption logic operation is realized. Not the same; that is to say, the hardware that implements each round of encryption logic operations exists at the same time, and the hardware that implements each round of encryption logic operations will not be reused;

The decryption terminal 501 is specifically used to perform streamline decryption in ECB mode or streamline decryption in CTR mode for each data packet of each group of data to be decrypted;

The decryption terminal 501 is used to sequentially perform the first round of decryption logic operations to the Nth round of decryption logic operations for the corresponding data packets to obtain the AES decryption results of the corresponding data packets in ECB mode, where N is greater than 1; wherein, The hardware for each round of decryption logic operations is different from each other; that is, the hardware for each round of decryption logic operations exists at the same time, and the hardware for each round of decryption logic operations will not be reused;

Alternatively, the decryption terminal 501 is used to obtain the count value in advance before obtaining the corresponding data packet, and sequentially perform the first round of decryption logic operation to the K round of decryption logic operation on the count value to obtain the count decryption result, where K is greater than 1; After obtaining the corresponding data packet, XOR operation is performed on the data in the corresponding data packet and the count decryption result to obtain the AES decryption result of the corresponding data packet in CTR mode; wherein, the hardware interaction for each round of decryption logic operation is realized They are not the same; that is to say, the hardware for implementing each round of decryption logic operations exists at the same time, and the hardware for each round of decryption logic operations will not be reused.

In practical applications, the encryption terminal 500 and the decryption terminal 501 can be controlled by a central processing unit (Central Processing Unit, CPU), a microprocessor (Micro Processor Unit, MPU), a digital signal processor (Digital Signal Processor) located in the terminal , DSP), or Field Programmable Gate Array (Field Programmable Gate Array, FPGA) and other implementations.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems, or computer program products. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (11)

1. An Advanced Encryption Standard (AES) encryption and decryption method, the method comprising:

acquiring a new key, and adding the new key to the next group of data to be encrypted; carrying out AES encryption on a group of data to be encrypted added with a new key by using an original key, and carrying out AES encryption on each group of data to be encrypted which is not subjected to AES encryption by using the new key;

sequentially carrying out AES decryption on each group of data to be decrypted by using the original secret key until the new secret key is obtained; and carrying out AES decryption on each group of data to be decrypted which is not decrypted by utilizing the new secret key.

2. The method of claim 1, wherein each set of data to be encrypted comprises a plurality of data packets; the adding the new key to the next group of data to be encrypted includes: adding a new key in each data packet of the corresponding group of data to be encrypted;

each group of data to be decrypted comprises a plurality of data packets, and AES decryption is sequentially performed on each group of data to be decrypted by using the original secret key until the new secret key is obtained, wherein the AES decryption comprises the following steps: and carrying out AES decryption on each data packet of each group of data to be decrypted by using the original secret key, detecting each data packet of each group of data to be decrypted, and determining whether each detected data packet contains a new secret key.

3. The method according to claim 2, wherein the sequentially performing AES decryption on each set of data to be decrypted by using the original key until the new key is obtained comprises: and for each group of data to be decrypted, acquiring the new key when the number of the detected packet headers of the data packets containing the new key is larger than or equal to a set threshold value.

4. The method of claim 1, wherein each set of data to be encrypted comprises a plurality of data packets;

the AES encryption of each group of data to be encrypted comprises the following steps: carrying out codebook ECB mode stream encryption or counting CTR mode stream encryption on each data packet of each group of data to be encrypted;

performing ECB mode pipelined encryption on each packet includes: sequentially carrying out the encryption logic operation from the 1 st round to the N th round aiming at the corresponding data packet to obtain an AES encryption result of the corresponding data packet in the ECB mode, wherein N is larger than 1; the hardware for realizing each round of encryption logic operation exists at the same time, and the hardware for realizing each round of encryption logic operation cannot be reused;

performing CTR mode pipelined encryption on each packet includes: before acquiring the corresponding data packet, acquiring a count value in advance, and sequentially carrying out 1 st round encryption logic operation to K th round encryption logic operation on the count value to obtain a count encryption result, wherein K is greater than 1; after the corresponding data packet is obtained, carrying out exclusive OR operation on the data in the corresponding data packet and the counting encryption result to obtain an AES encryption result of the corresponding data packet in the CTR mode; the hardware for realizing each round of encryption logic operation exists at the same time, and the hardware for realizing each round of encryption logic operation cannot be reused.

5. The method of claim 1, wherein each set of data to be decrypted comprises a plurality of data packets;

the AES decryption of each group of data to be decrypted comprises the following steps: carrying out ECB mode running decryption or CTR mode running decryption on each data packet of each group of data to be decrypted;

performing ECB mode pipelined decryption on each packet includes: sequentially carrying out the 1 st round of decryption logic operation to the Nth round of decryption logic operation on the corresponding data packet to obtain an AES decryption result of the corresponding data packet in the ECB mode, wherein N is larger than 1; the hardware for realizing each round of decryption logic operation exists at the same time, and the hardware for realizing each round of decryption logic operation cannot be reused;

performing CTR mode pipelined decryption on each packet includes: before acquiring the corresponding data packet, acquiring a count value in advance, and sequentially carrying out 1 st round decryption logic operation to K th round decryption logic operation on the count value to obtain a count decryption result, wherein K is greater than 1; after the corresponding data packet is obtained, carrying out exclusive OR operation on the data in the corresponding data packet and the counting decryption result to obtain an AES decryption result of the corresponding data packet in the CTR mode; the hardware for realizing each round of decryption logic operation exists at the same time, and the hardware for realizing each round of decryption logic operation cannot be reused.

6. The method according to any one of claims 1 to 5, wherein the decryption order of each set of data to be decrypted is kept consistent with the encryption order of each set of data to be encrypted.

7. An AES encryption and decryption device, which is characterized by comprising an encryption end and a decryption end; wherein,

the encryption terminal is used for acquiring a new key and adding the new key to the next group of data to be encrypted; carrying out AES encryption on a group of data to be encrypted added with a new key by using an original key, and carrying out AES encryption on each group of data to be encrypted which is not subjected to AES encryption by using the new key;

the decryption end is used for sequentially carrying out AES decryption on each group of data to be decrypted by using the original secret key until the new secret key is obtained; and carrying out AES decryption on each group of data to be decrypted which is not decrypted by utilizing the new secret key.

8. The apparatus of claim 7, wherein each set of data to be encrypted comprises a plurality of data packets;

the encryption end is specifically used for adding a new key to each data packet of a corresponding group of data to be encrypted;

each group of data to be decrypted comprises a plurality of data packets;

the decryption end is specifically configured to perform AES decryption on each data packet of each set of data to be decrypted by using the original key, detect each data packet of each set of data to be decrypted, and determine whether each detected data packet contains a new key.

9. The apparatus according to claim 8, wherein the decryption end is configured to obtain the new key when the number of detected packet headers of the data packets containing the new key is greater than or equal to a set threshold for each set of data to be decrypted.

10. The apparatus of claim 7, wherein each set of data to be encrypted comprises a plurality of data packets;

the encryption end is specifically used for respectively carrying out ECB mode stream encryption or CTR mode stream encryption on each data packet of each group of data to be encrypted;

the encryption end is used for sequentially carrying out the 1 st round encryption logic operation to the Nth round encryption logic operation aiming at the corresponding data packet to obtain an AES encryption result of the corresponding data packet in an ECB mode, wherein N is larger than 1; the hardware for realizing each round of encryption logic operation exists at the same time, and the hardware for realizing each round of encryption logic operation cannot be reused;

or, the encryption end is used for acquiring a count value in advance before acquiring the corresponding data packet, and sequentially performing 1 st round encryption logic operation to K th round encryption logic operation on the count value to obtain a count encryption result, wherein K is greater than 1; after the corresponding data packet is obtained, carrying out exclusive OR operation on the data in the corresponding data packet and the counting encryption result to obtain an AES encryption result of the corresponding data packet in the CTR mode; the hardware for realizing each round of encryption logic operation exists at the same time, and the hardware for realizing each round of encryption logic operation cannot be reused.

11. The apparatus of claim 7, wherein each set of data to be decrypted comprises a plurality of data packets;

the decryption end is specifically used for performing ECB mode pipelined decryption or CTR mode pipelined decryption on each data packet of each group of data to be decrypted;

the decryption end is used for sequentially performing the 1 st round decryption logic operation to the Nth round decryption logic operation on the corresponding data packet to obtain an AES decryption result of the corresponding data packet in the ECB mode, wherein N is larger than 1; the hardware for realizing each round of decryption logic operation exists at the same time, and the hardware for realizing each round of decryption logic operation cannot be reused;

or, the decryption end is configured to obtain a count value in advance before obtaining the corresponding data packet, and sequentially perform 1 st round decryption logic operation to K th round decryption logic operation on the count value to obtain a count decryption result, where K is greater than 1; after the corresponding data packet is obtained, carrying out exclusive OR operation on the data in the corresponding data packet and the counting decryption result to obtain an AES decryption result of the corresponding data packet in the CTR mode; the hardware for realizing each round of decryption logic operation exists at the same time, and the hardware for realizing each round of decryption logic operation cannot be reused.