CN103336920A - Security system for wireless sensor network SOC - Google Patents

Abstract

The invention discloses a security system for a wireless sensor network SOC chip. The security system includes a register management unit, a state machine unit, and an encryption and decryption unit, wherein: the register management unit configures a security encryption module according to an AHB slave interface signal The register group reads and writes the control command register, the status register, and the information data registers required for encryption and decryption to realize the control of the security system; the encryption and decryption unit includes three parts: the data encryption unit, the data decryption unit and the key expansion unit; the status The machine unit includes a data read and write unit, a key management unit, and a data flow processing unit. The state machine unit realizes reading and writing of AHB bus address data according to the AHB host interface signal and the control command written in the register. The invention uses hardware circuits to relocate, encrypt, decrypt and store data streams, shortens the time required for data stream encryption and decryption, and provides guarantee for more efficient operation of the system.

Description

Security System for SOC Chips in Wireless Sensor Networks

technical field

The invention relates to the technical field of wireless sensors, in particular to a security system for a wireless sensor network SOC chip.

Background technique

For wireless sensor networks, secure booting can be said to be the most important, complex, and challenging content, because wireless sensor networks face resource constraints, so that traditional security booting methods cannot be directly applied to wireless sensor networks. . The security maintenance mainly studies the key update in the communication, and the security change caused by the network change. Communication confidentiality includes: group key secrecy, backward secrecy, forward secrecy, key independence, implicit key authentication, explicit key authentication, perfect forward secrecy, resistance to known key attacks, etc. The above-mentioned problems should be fully studied and paid attention to at all levels, but their respective emphases are not the same. The physical layer mainly considers security coding; the confidentiality of the link layer and the network layer considers the encryption and decryption technology of data frames and routing information; while the application layer focuses on the key management and exchange process to provide encryption and decryption for the lower layer. security support.

Contents of the invention

The purpose of the present invention is to provide a security system for SOC chips in wireless sensor networks, which can provide systematic security protection for SOC chips in wireless sensor networks, and fully implement data encryption and decryption, data flow processing and key encryption. Management and other protection functions.

In order to solve these problems in the prior art, the technical solution provided by the invention is:

A security system for a wireless sensor network SOC chip, the security system is mounted on the AHB bus of the wireless sensor network, the security system receives the AHB master interface signal and the AHB slave interface signal and completes the control command with the AHB bus and data transmission, the security system includes a register management unit, a state machine unit and an encryption and decryption unit, wherein:

The register management unit configures the register group of the security encryption module according to the AHB slave interface signal, and reads and writes the control command register, the status register, and the required information data registers such as encryption and decryption, so as to realize the control of the security system;

The encryption and decryption unit includes three parts: data encryption unit, data decryption unit and key expansion unit;

The state machine unit includes a data read and write unit, a key management unit, and a data flow processing unit. The state machine unit realizes reading and writing of AHB bus address data according to the AHB host interface signal and the control command written in the register.

As an optimization, the security system further includes an identity authentication unit, and the identity information in the identity authentication unit is sent to the register management unit to implement identity verification.

Compared with the scheme in the prior art, the advantages of the present invention are:

The security system for wireless sensor network SOC chips described in the present invention uses hardware circuits to relocate, encrypt, decrypt, and store data streams, which shortens the time required for data stream encryption and decryption, and provides more efficient operation of the system. provide assurance.

Description of drawings

The present invention will be further described below in conjunction with accompanying drawing and embodiment:

FIG. 1 is a schematic diagram of a framework of a security system in an embodiment of the present invention;

Fig. 2 is the working status diagram of encryption and decryption unit in the embodiment of the present invention;

Fig. 3 is a schematic diagram of the key expansion process of the encryption and decryption unit in the embodiment of the present invention;

Fig. 4 is a schematic diagram of the encryption process of the encryption and decryption unit in the embodiment of the present invention;

Fig. 5 is a schematic diagram of the decryption process of the encryption and decryption unit in the embodiment of the present invention;

Fig. 6 is the schematic diagram of encryption structure of RC5 packet algorithm in the embodiment of the present invention;

Fig. 7 is a schematic structural diagram of RC5 packet decryption and encryption in an embodiment of the present invention;

Fig. 8 is a schematic diagram of interface signals of the encryption and decryption unit in the embodiment of the present invention;

Detailed ways

The above solution will be further described below in conjunction with specific embodiments. It should be understood that these examples are used to illustrate the present invention and not to limit the scope of the present invention. The implementation conditions used in the examples can be further adjusted according to the conditions of specific manufacturers, and the implementation conditions not indicated are usually the conditions in routine experiments.

Example:

This embodiment describes a security system for a wireless sensor network SOC chip. Its structure is shown in Figure 1. The security system is mounted on the AHB bus of the wireless sensor network, and the security system receives the AHB host interface signal and the AHB Slave machine interface signals and complete the transmission of control commands and data with the AHB bus, the security system includes a register management unit, a state machine unit and an encryption and decryption unit, wherein:

The register management unit configures the register group of the security encryption module according to the AHB slave interface signal, and reads and writes the control command register, the status register, and the required information data registers such as encryption and decryption, so as to realize the control of the security system;

The encryption and decryption unit includes three parts: data encryption unit, data decryption unit and key expansion unit;

The state machine unit includes a data read and write unit, a key management unit, and a data flow processing unit. The state machine unit realizes reading and writing of AHB bus address data according to the AHB host interface signal and the control command written in the register.

The security system also includes an identity authentication unit, and the identity information in the identity authentication unit is sent to the register management unit to realize identity verification.

As the core functional module of the security encryption module, the encryption and decryption unit is designed and adopted the RC5-32/12/16 algorithm, which can realize key expansion, data encryption and data decryption.

The interface signal design of the encryption and decryption unit is shown in Figure 8. The signals are listed below, specifically as follows:

Clk, rst signal: the clock input signal and reset signal of the encryption and decryption unit, synchronized with the global clock signal and reset signal of the entire module;

Wr signal: encryption and decryption unit write enable signal;

Order[7:0]: used to write encryption and decryption control commands during single-time data encryption;

AHB_order[7:0], AHB_on: The signal is used for data flow encryption and decryption, wherein the AHB_order signal is used to write the data flow encryption and decryption control signal; AHB_on is used to indicate that the encryption and decryption unit is in the data flow working state;

Key[31:0]: key input signal;

addr_k[1:0]: Key address output signal, according to which the input of the Key[31:0] signal is determined;

pt0[31:0], pt1[31:0]: data input signal;

free: encryption and decryption unit idle signal;

intr: encryption and decryption interrupt signal;

ct0[31:0], ct1[31:0]: data output signal.

The encryption and decryption unit can be divided into five working states as shown in Figure 2:

Key expansion: when order=1, the encryption and decryption unit is in the key expansion state. Every time the key is updated, the key expansion process must be performed. If a fixed key is used, only one key expansion is required, and then this state is skipped, and the data to be encrypted or decrypted is cyclically input;

Data input: when order=0, the encryption and decryption unit is in the data input state. The pt0 and pt1 signal terminals input two 32-bit data as the data to be encrypted or decrypted;

Encryption: when order=2, the encryption and decryption unit is in the state of data encryption;

Decryption: when order=3, the encryption and decryption unit is in the state of data decryption;

Data output: After the data is encrypted or decrypted, the encryption and decryption unit enters the data output state, and outputs the result data of encryption and decryption to ct0 and ct1 signal terminals.

The parameter-variable block encryption algorithm RC5 designed by RSA is used because the RC5 algorithm only uses common elementary calculation operations (exclusive or, addition, subtraction, and cyclic shift). On the one hand, it is very convenient for hardware implementation. On the other hand, due to the simplicity of the algorithm, its calculation speed is very fast.

Key expansion design: According to the RC5 encryption algorithm, register arrays L[] and S[] are defined for key expansion operations. The key expansion process is shown in Figure 3. After S, L expansion goes through t=2r+2=2*12+2=26 cycles, the S[] and L[] arrays are the expanded key arrays. S[] is used to initialize the subkey, which is a 32-bit array with a size of t=26. The value of S[] is calculated cyclically according to the RC5 algorithm. L[] is used to convert the key and is a 32-bit array of size c=b*8/w=16*8/32=4. According to the key address addr_k output by the encryption and decryption unit, the state machine unit will return a 32-bit key to the key input terminal Key[31:0] of the encryption and decryption unit. By incrementing the value of addr_k each time a key is written, the newly entered key Key[31:0] is written into the key register group L[] to complete the initialization of L[]. The values of the register data L[] and S[] are mixed to complete the expansion of the key.

Encryption design: According to the RC5 algorithm, 32-bit registers A and B are defined for storing temporary data during encryption. The encryption process is shown in Figure 4. The update algorithm of the register A and register B values is given in the RC5 algorithm encryption process, and the update of the value of register A or register B can be completed once in each clock cycle. After r=12 cycles, the values in register A and register B are the encrypted ciphertext data. The encryption structure of the RC5 grouping algorithm is shown in Figure 6.

Decryption design: The decryption process is also designed according to the RC5 algorithm, and register A and register B are used as temporary data storage registers during the decryption process. The decryption process is shown in Figure 5. At this time, the updating algorithm of the value of register A and register B is given in the decryption process of the RC5 algorithm in Section 4.2.1, and the value of register A or register B can be updated once in each clock cycle. renew. After r=12 cycles, the values in register A and register B are the decrypted plaintext data. The decryption structure of the RC5 packet algorithm is shown in Figure 7.

The above examples are only to illustrate the technical conception and characteristics of the present invention, and its purpose is to allow people familiar with this technology to understand the content of the present invention and implement it accordingly, and cannot limit the protection scope of the present invention. All equivalent changes or modifications made according to the spirit of the present invention shall fall within the protection scope of the present invention.

Claims (2)

1. A security system for a wireless sensor network SOC chip, characterized in that the security system is mounted on the AHB bus of the wireless sensor network, and the security system receives the AHB host interface signal and the AHB slave interface signal and completes the communication with The transmission of control commands and data between AHB buses, the security system includes a register management unit, a state machine unit and an encryption and decryption unit, wherein: The register management unit configures the register group of the security encryption module according to the AHB slave interface signal, and reads and writes the control command register, the status register, and the required information data registers such as encryption and decryption, so as to realize the control of the security system; The encryption and decryption unit includes three parts: data encryption unit, data decryption unit and key expansion unit; The state machine unit includes a data read and write unit, a key management unit, and a data flow processing unit. The state machine unit realizes reading and writing of AHB bus address data according to the AHB host interface signal and the control command written in the register. 2. the security system that is used for wireless sensor network SOC chip according to claim 1, is characterized in that, described security system also comprises identity verification unit, and the identity information in described identity verification unit is sent to register management unit, Implement authentication.

Images